| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PC selbständig runter gefahrenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.02.2013, 10:13
| #16 |
 |  PC selbständig runter gefahren Der Rechner läuft wieder normal und stabil. Den Proxy-Server habe ich, glaube ich, nicht installiertOTL Logfile: Code:
ATTFilter OTL logfile created on: 10.02.2013 10:09:27 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Christian\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,98 Gb Total Physical Memory | 5,80 Gb Available Physical Memory | 72,64% Memory free 15,96 Gb Paging File | 13,16 Gb Available in Paging File | 82,42% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 923,02 Gb Total Space | 432,61 Gb Free Space | 46,87% Space Free | Partition Type: NTFS Computer Name: PECE | User Name: Christian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Christian\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Logitech\Vid HD\Vid.exe (Logitech Inc.) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Windows\SysWOW64\qimlsrv.exe (Comvigo, Inc.) PRC - C:\Windows\SysWOW64\dsrviml.exe (Comvigo, Inc.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe () PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7f6c86879d27a285cc97c12d59424dd0\System.ServiceProcess.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\40c7a89fe2cbf3c12a2c39e034da54cf\System.Xaml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\b8e60f81fd56934c9f9da7b15bee3376\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\932901ff0ad5e365ffbe705d7459a37e\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b519f42484e1d488662a9a8a87cb8849\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\fc476bbac36944e352c2f547352ffa64\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\8abaedf6aecb073b22f8801aa0b8babf\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7cd4aa51f6e6b9330b8f50bba8bb62c6\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\f93dca0e4baa1dcb37cf75392b7c89da\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Common Files\logishrd\SharedBin\LVAPI11.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\vpxmd.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\SDL.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll () MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtNetwork4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtCore4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\plugins\imageformats\qjpeg4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\plugins\imageformats\qico4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\plugins\imageformats\qgif4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtWebKit4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtXml4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtSql4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtOpenGL4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\QtGui4.dll () MOD - C:\Program Files (x86)\Logitech\Vid HD\phonon4.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (YahooAUService) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) SRV - (AdobeActiveFileMonitor) -- C:\Program Files (x86)\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe () SRV - (PhotoshopElementsDeviceConnect) -- C:\Program Files (x86)\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.) DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.) DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (HssDRV6) -- C:\Windows\SysNative\drivers\hssdrv6.sys (AnchorFree Inc.) DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC) DRV:64bit: - (MBfilt) -- C:\Windows\SysNative\drivers\MBfilt64.sys (Creative Technology Ltd.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (VCSVADHWSer) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{F300D1AA-08A4-41C0-86B0-4F15DF546E6E}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{F1CCEF95-68ED-4CF7-A02E-F856E94103F5}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Hyrican® Informationssysteme AG [binary data] IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 222.108.198.53:8080 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9 FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33 FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0035-ABCDEFFEDCBA%7D:6.0.35 FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0037-ABCDEFFEDCBA%7D:6.0.37 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Christian\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.06 17:07:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.17 20:20:28 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\eliteproxyswitcher@my-proxy.com: [2012.03.07 18:30:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\Extensions [2013.02.09 20:02:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\Firefox\Profiles\3q7h52jf.default\extensions [2012.12.11 17:13:00 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\firefox\profiles\3q7h52jf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2013.01.31 15:57:15 | 000,817,973 | ---- | M] () (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\firefox\profiles\3q7h52jf.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.02.06 17:07:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.02.06 17:07:32 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013.02.06 17:07:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.02.06 17:07:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.02.06 17:07:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.02.06 17:07:34 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.20 19:22:07 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.01 14:23:03 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.20 19:22:07 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.20 19:22:07 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.20 19:22:07 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.20 19:22:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: Google CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - homepage: Google CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll CHR - plugin: Conduit Chrome Plugin (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 7 U11 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll CHR - plugin: Java Deployment Toolkit 7.0.110.21 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll CHR - Extension: YouTube = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2013.02.09 20:21:51 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found. O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll () O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics) O4 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung) O4 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001..\Run: [Logitech Vid] C:\Program Files (x86)\Logitech\Vid HD\Vid.exe (Logitech Inc.) O4 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001..\Run: [OM2_Monitor] C:\Program Files (x86)\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.) O4 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8:64bit: - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\..Trusted Domains: fritz.repeater ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\..Trusted Ranges: Range37 ([*] in Lokales Intranet) O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 10.13.2) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} Reg Error: Value error. (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EEA831AB-E283-4431-B5D0-FA2A21006D74}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.10 10:01:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Christian\Desktop\OTL.exe [2013.02.09 20:30:14 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.02.09 20:23:23 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.02.09 20:13:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.02.09 20:13:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.02.09 20:13:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.02.09 20:13:43 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.02.09 20:13:28 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.02.09 20:06:36 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.02.09 20:06:29 | 000,000,000 | ---D | C] -- C:\JRT [2013.02.09 14:10:10 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump [2013.02.09 13:17:11 | 000,000,000 | ---D | C] -- C:\Users\Christian\Desktop\bella_b_c_c [2013.02.09 09:25:33 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{2E825E26-55B9-4E0F-8200-17CFB72CC759} [2013.02.08 13:13:25 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{252634CC-EBA8-49D1-A87A-8D20A938FE42} [2013.02.07 15:39:07 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{8DEA4296-A88D-4154-BF86-495942945A1B} [2013.02.06 17:07:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.02.05 15:55:10 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{6313EE2E-3EE3-4FAA-AC88-9C07E99F3F2D} [2013.02.02 11:31:15 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{DA5C4129-6DEA-4A41-9FD7-05D53677299C} [2013.02.01 18:36:35 | 000,000,000 | ---D | C] -- C:\Users\Christian\Desktop\Bilder 2012 [2013.01.31 17:29:46 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{944F0FEB-E5A3-47AC-A66E-35B7B1EEC573} [2013.01.30 16:31:32 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{87ED3C2B-D0FE-42E7-9775-A32EBA9B26B7} [2013.01.28 16:29:21 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\Programs [2013.01.28 16:00:12 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{3F2B9EED-B034-4A8F-95EC-E5D559DF7E06} [2013.01.27 19:58:38 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{ED65B90D-410B-4F55-86CB-D66BC25442BF} [2013.01.26 17:22:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2013.01.26 17:22:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2013.01.25 16:49:21 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\Fotokram [2013.01.25 15:40:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2013.01.25 15:38:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2013.01.24 16:40:06 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{3D10BEDE-1A1D-4C53-8A2F-B492A7AD84CB} [2013.01.23 23:50:01 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\AKVIS LLC [2013.01.23 23:43:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Coloriage [2013.01.23 23:43:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\AKVIS [2013.01.23 23:41:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AKVIS [2013.01.23 23:41:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AKVIS [2013.01.22 15:41:15 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{833CD9F3-1FB0-48B5-8F7D-26FBFECFE244} [2013.01.21 15:59:30 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\{E84A2D59-7EF0-4400-86A5-0423652F4E68} [2013.01.17 20:20:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird [2013.01.15 18:09:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.08.28 15:48:54 | 000,442,560 | ---- | C] (Shlemoon Media Inc) -- C:\Users\Christian\AppData\Roaming\fdmer.exe [2012.08.28 15:48:50 | 000,457,789 | ---- | C] (Freedom Download Manager ) -- C:\Users\Christian\AppData\Roaming\fdm-setup.exe [2012.08.28 15:48:49 | 000,419,554 | ---- | C] (SearchAmong ) -- C:\Users\Christian\AppData\Roaming\satoolbar.exe ========== Files - Modified Within 30 Days ========== [2013.02.10 10:04:10 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.10 10:04:10 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.10 10:01:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Christian\Desktop\OTL.exe [2013.02.10 09:57:06 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.10 09:56:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.10 09:56:45 | 2133,831,679 | -HS- | M] () -- C:\hiberfil.sys [2013.02.09 20:30:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.09 20:21:51 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2013.02.09 14:43:03 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.09 11:04:50 | 075,497,472 | ---- | M] () -- C:\Users\Christian\Documents\clip0312.avi [2013.02.09 11:04:27 | 000,780,000 | ---- | M] () -- C:\Users\Christian\Documents\clip0312.avi.bak [2013.02.09 11:00:47 | 536,958,032 | ---- | M] () -- C:\Users\Christian\Documents\clip0311.avi [2013.02.09 10:40:26 | 311,209,464 | ---- | M] () -- C:\Users\Christian\Documents\clip0310.avi [2013.02.09 10:31:46 | 681,211,286 | ---- | M] () -- C:\Users\Christian\Documents\clip0309.avi [2013.02.09 09:31:21 | 291,305,076 | ---- | M] () -- C:\Users\Christian\Documents\clip0308.avi [2013.02.09 03:53:19 | 1707,679,942 | ---- | M] () -- C:\Users\Christian\Documents\clip0307.avi [2013.02.09 03:08:12 | 195,422,916 | ---- | M] () -- C:\Users\Christian\Documents\clip0306.avi [2013.02.09 02:46:59 | 276,946,306 | ---- | M] () -- C:\Users\Christian\Documents\clip0305.avi [2013.02.07 22:27:53 | 984,005,802 | ---- | M] () -- C:\Users\Christian\Documents\clip0304.avi [2013.02.07 22:01:00 | 021,602,170 | ---- | M] () -- C:\Users\Christian\Documents\clip0303.avi [2013.02.07 16:47:13 | 165,218,932 | ---- | M] () -- C:\Users\Christian\Documents\clip0302.avi [2013.02.07 16:25:43 | 907,109,984 | ---- | M] () -- C:\Users\Christian\Documents\clip0301.avi [2013.02.07 16:17:42 | 176,507,644 | ---- | M] () -- C:\Users\Christian\Documents\clip0300.avi [2013.02.07 15:48:07 | 005,132,288 | ---- | M] () -- C:\Users\Christian\Desktop\Tatort - Reifezeugnis A.avi [2013.02.06 23:26:55 | 2445,722,222 | ---- | M] () -- C:\Users\Christian\Documents\clip0299.avi [2013.02.06 22:35:29 | 464,229,304 | ---- | M] () -- C:\Users\Christian\Documents\clip0298.avi [2013.02.06 22:15:18 | 391,122,786 | ---- | M] () -- C:\Users\Christian\Documents\clip0297.avi [2013.02.06 19:06:12 | 600,232,546 | ---- | M] () -- C:\Users\Christian\Documents\clip0296.avi [2013.02.06 00:46:44 | 833,301,802 | ---- | M] () -- C:\Users\Christian\Documents\clip0295.avi [2013.02.06 00:30:38 | 182,598,074 | ---- | M] () -- C:\Users\Christian\Documents\clip0294.avi [2013.02.06 00:21:48 | 595,110,420 | ---- | M] () -- C:\Users\Christian\Documents\clip0293.avi [2013.02.06 00:18:42 | 001,959,236 | ---- | M] () -- C:\Users\Christian\Documents\clip0292.avi [2013.02.06 00:18:38 | 324,158,364 | ---- | M] () -- C:\Users\Christian\Documents\clip0291.avi [2013.02.05 18:33:16 | 897,187,336 | ---- | M] () -- C:\Users\Christian\Documents\clip0290.avi [2013.02.05 18:25:25 | 079,749,014 | ---- | M] () -- C:\Users\Christian\Documents\clip0289.avi [2013.02.05 17:43:59 | 288,573,486 | ---- | M] () -- C:\Users\Christian\Documents\clip0288.avi [2013.02.05 17:37:00 | 375,135,188 | ---- | M] () -- C:\Users\Christian\Documents\clip0287.avi [2013.02.05 17:23:32 | 582,548,298 | ---- | M] () -- C:\Users\Christian\Documents\clip0286.avi [2013.02.05 16:58:15 | 317,452,478 | ---- | M] () -- C:\Users\Christian\Documents\clip0285.avi [2013.02.05 16:52:36 | 358,961,448 | ---- | M] () -- C:\Users\Christian\Documents\clip0284.avi [2013.02.04 20:49:19 | 577,400,210 | ---- | M] () -- C:\Users\Christian\Desktop\whoressss69_Part2.avi [2013.02.04 18:51:36 | 604,947,029 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.02.04 18:36:05 | 000,000,000 | ---- | M] () -- C:\Users\Christian\defogger_reenable [2013.02.01 18:17:16 | 001,527,550 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.02.01 18:17:16 | 000,664,618 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.02.01 18:17:16 | 000,624,800 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.02.01 18:17:16 | 000,134,786 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.02.01 18:17:16 | 000,110,438 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.01.28 16:32:01 | 000,068,078 | ---- | M] () -- C:\Windows\unins000.dat [2013.01.28 16:29:21 | 000,721,397 | ---- | M] () -- C:\Windows\unins000.exe ========== Files Created - No Company Name ========== [2013.02.09 20:13:48 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.02.09 20:13:48 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.02.09 20:13:48 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.02.09 20:13:48 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.02.09 20:13:48 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.02.09 11:04:24 | 075,497,472 | ---- | C] () -- C:\Users\Christian\Documents\clip0312.avi [2013.02.09 11:04:24 | 000,780,000 | ---- | C] () -- C:\Users\Christian\Documents\clip0312.avi.bak [2013.02.09 10:40:27 | 536,958,032 | ---- | C] () -- C:\Users\Christian\Documents\clip0311.avi [2013.02.09 10:31:54 | 311,209,464 | ---- | C] () -- C:\Users\Christian\Documents\clip0310.avi [2013.02.09 09:31:23 | 681,211,286 | ---- | C] () -- C:\Users\Christian\Documents\clip0309.avi [2013.02.09 09:28:24 | 291,305,076 | ---- | C] () -- C:\Users\Christian\Documents\clip0308.avi [2013.02.09 03:08:13 | 1707,679,942 | ---- | C] () -- C:\Users\Christian\Documents\clip0307.avi [2013.02.09 02:47:01 | 195,422,916 | ---- | C] () -- C:\Users\Christian\Documents\clip0306.avi [2013.02.09 02:30:23 | 276,946,306 | ---- | C] () -- C:\Users\Christian\Documents\clip0305.avi [2013.02.07 22:14:33 | 984,005,802 | ---- | C] () -- C:\Users\Christian\Documents\clip0304.avi [2013.02.07 21:12:14 | 021,602,170 | ---- | C] () -- C:\Users\Christian\Documents\clip0303.avi [2013.02.07 16:25:45 | 165,218,932 | ---- | C] () -- C:\Users\Christian\Documents\clip0302.avi [2013.02.07 16:17:44 | 907,109,984 | ---- | C] () -- C:\Users\Christian\Documents\clip0301.avi [2013.02.07 16:08:31 | 176,507,644 | ---- | C] () -- C:\Users\Christian\Documents\clip0300.avi [2013.02.07 15:46:28 | 005,132,288 | ---- | C] () -- C:\Users\Christian\Desktop\Tatort - Reifezeugnis A.avi [2013.02.06 22:35:49 | 2445,722,222 | ---- | C] () -- C:\Users\Christian\Documents\clip0299.avi [2013.02.06 22:15:25 | 464,229,304 | ---- | C] () -- C:\Users\Christian\Documents\clip0298.avi [2013.02.06 21:04:47 | 391,122,786 | ---- | C] () -- C:\Users\Christian\Documents\clip0297.avi [2013.02.06 18:38:28 | 600,232,546 | ---- | C] () -- C:\Users\Christian\Documents\clip0296.avi [2013.02.06 00:30:41 | 833,301,802 | ---- | C] () -- C:\Users\Christian\Documents\clip0295.avi [2013.02.06 00:22:50 | 182,598,074 | ---- | C] () -- C:\Users\Christian\Documents\clip0294.avi [2013.02.06 00:18:45 | 595,110,420 | ---- | C] () -- C:\Users\Christian\Documents\clip0293.avi [2013.02.06 00:18:41 | 001,959,236 | ---- | C] () -- C:\Users\Christian\Documents\clip0292.avi [2013.02.05 22:22:13 | 324,158,364 | ---- | C] () -- C:\Users\Christian\Documents\clip0291.avi [2013.02.05 18:26:14 | 897,187,336 | ---- | C] () -- C:\Users\Christian\Documents\clip0290.avi [2013.02.05 17:44:20 | 079,749,014 | ---- | C] () -- C:\Users\Christian\Documents\clip0289.avi [2013.02.05 17:37:07 | 288,573,486 | ---- | C] () -- C:\Users\Christian\Documents\clip0288.avi [2013.02.05 17:23:33 | 375,135,188 | ---- | C] () -- C:\Users\Christian\Documents\clip0287.avi [2013.02.05 16:58:16 | 582,548,298 | ---- | C] () -- C:\Users\Christian\Documents\clip0286.avi [2013.02.05 16:52:37 | 317,452,478 | ---- | C] () -- C:\Users\Christian\Documents\clip0285.avi [2013.02.05 15:49:16 | 358,961,448 | ---- | C] () -- C:\Users\Christian\Documents\clip0284.avi [2013.02.04 18:36:05 | 000,000,000 | ---- | C] () -- C:\Users\Christian\defogger_reenable [2013.02.04 18:00:13 | 577,400,210 | ---- | C] () -- C:\Users\Christian\Desktop\whoressss69_Part2.avi [2013.02.03 11:59:48 | 000,369,072 | ---- | C] () -- C:\Windows6.1-KB2394911-x64.msu [2013.01.28 16:32:00 | 000,721,397 | ---- | C] () -- C:\Windows\unins000.exe [2013.01.28 16:32:00 | 000,068,078 | ---- | C] () -- C:\Windows\unins000.dat [2013.01.25 15:38:26 | 000,001,116 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.01.25 15:38:24 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.29 12:09:28 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2012.10.29 12:09:28 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2012.10.29 12:09:28 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2012.10.29 12:09:28 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2012.10.29 12:09:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012.09.21 20:08:36 | 010,919,784 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll [2012.09.21 20:08:36 | 000,338,136 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll [2012.09.21 20:08:36 | 000,103,272 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe [2012.08.28 15:48:52 | 000,525,312 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\bsetter-own.exe [2012.02.27 22:02:41 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.11.24 07:04:25 | 000,219,162 | ---- | C] () -- C:\Users\Christian\Manteltarifvertrag der chemischen Industrie.pdf [2011.11.05 01:12:36 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.10.19 18:29:14 | 000,120,832 | ---- | C] () -- C:\Users\Christian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.13 16:09:46 | 000,000,097 | ---- | C] () -- C:\Users\Christian\AppData\Local\fusioncache.dat [2011.10.13 16:09:00 | 001,553,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.03.11 13:58:06 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll [2011.03.11 13:53:20 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.03.11 13:49:16 | 000,003,113 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.03.11 11:59:38 | 000,085,758 | ---- | C] () -- C:\Windows\SysWow64\tnblf.exe [2010.06.29 12:06:44 | 000,021,748 | ---- | C] () -- C:\ProgramData\winiml.dat [2010.06.29 12:06:44 | 000,021,748 | ---- | C] () -- C:\ProgramData\iml.xml ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.01.23 23:50:01 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\AKVIS LLC [2012.02.27 21:55:33 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Audacity [2012.02.27 21:10:16 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\avidemux [2012.05.26 13:25:33 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Avnex [2012.08.10 15:14:42 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\com.prakaz.project.photogettr [2012.12.27 23:00:28 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DVDVideoSoft [2012.08.16 18:00:02 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\elsterformular [2012.02.23 21:56:34 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\FreeFLVConverter [2012.12.28 20:34:09 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\GetRightToGo [2012.11.25 13:55:38 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\GrabPro [2012.03.05 18:33:37 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\HDRsoft [2013.02.09 20:32:33 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ICQ [2012.01.10 17:17:17 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Leadertech [2011.11.11 15:20:58 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Notepad++ [2012.02.27 22:41:50 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Opera [2012.11.27 21:32:44 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Orbit [2012.11.25 13:55:41 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ProgSense [2012.12.27 13:03:38 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Samsung [2012.05.26 14:25:00 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Screaming Bee [2012.08.29 16:04:35 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Solveig Multimedia [2011.10.13 14:28:56 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Thunderbird [2011.10.23 18:14:27 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TrueCrypt [2012.06.22 17:15:10 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TS3Client [2012.12.27 23:02:27 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TuneUp Software [2011.10.13 16:12:03 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Turbine [2012.08.28 16:02:33 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\uTorrent ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:810B9F0D < End of report > |
|
10.02.2013, 13:18
| #17 |
| /// TB-Ausbilder   | PC selbständig runter gefahren Servus,
__________________Bevor ich dir noch ein paar Tipps mit auf den Weg gebe und wir alle Tools wieder entfernen, führe bitte noch die folgenden Schritte durch:
Schritt 1 Fixen mit OTL
Code:
ATTFilter :OTL
IE - HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 222.108.198.53:8080
CHR - plugin: Conduit Chrome Plugin (Enabled) = C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll
O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[2012.08.28 15:48:50 | 000,457,789 | ---- | C] (Freedom Download Manager ) -- C:\Users\Christian\AppData\Roaming\fdm-setup.exe
[2012.08.28 15:48:49 | 000,419,554 | ---- | C] (SearchAmong ) -- C:\Users\Christian\AppData\Roaming\satoolbar.exe
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:810B9F0D
:files
C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc
:commands
[Emptytemp]
Schritt 2 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
10.02.2013, 14:42
| #18 |
| | PC selbständig runter gefahren All processes killed
__________________========== OTL ========== HKU\S-1-5-21-4035254862-1320941438-108263097-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! File C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll not found. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. C:\Users\Christian\AppData\Roaming\fdm-setup.exe moved successfully. C:\Users\Christian\AppData\Roaming\satoolbar.exe moved successfully. ADS C:\ProgramData\TEMP:810B9F0D deleted successfully. ========== FILES ========== C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Christian ->Temp folder emptied: 146563 bytes ->Temporary Internet Files folder emptied: 10708980 bytes ->Java cache emptied: 19870376 bytes ->FireFox cache emptied: 141321830 bytes ->Google Chrome cache emptied: 26954955 bytes ->Flash cache emptied: 15284054 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67765 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 204,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 02102013_143834 Files\Folders moved on Reboot... C:\Users\Christian\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.10.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Christian :: PECE [Administrator] 10.02.2013 14:44:54 mbam-log-2013-02-10 (14-44-54).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 236561 Laufzeit: 2 Minute(n), 58 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=864a3ed0d753094d92f5688eb44354b7 # engine=13093 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-02-10 07:22:48 # local_time=2013-02-10 08:22:48 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1799 16775165 100 99 21369 225947458 33642 0 # compatibility_mode=5893 16776573 100 94 85773 112154018 0 0 # scanned=428459 # found=1 # cleaned=0 # scan_time=7707 sh=6162CF814FF5EAA3BB31A6DCFF71406A7B668AD0 ft=1 fh=cd2d0bfa27b2ec00 vn="a variant of Win32/Adware.Moonshle.A application" ac=I fn="C:\Users\Christian\AppData\Roaming\bsetter-own.exe" Results of screen317's Security Check version 0.99.57 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.70.0.1100 Java(TM) 6 Update 37 Java 7 Update 13 Java version out of Date! Adobe Flash Player 11.5.502.149 Adobe Reader 10.1.5 Adobe Reader out of Date! Mozilla Firefox (18.0.2) Mozilla Thunderbird (17.0.2) Google Chrome 24.0.1312.56 Google Chrome 24.0.1312.57 ````````Process Check: objlist.exe by Laurent```````` Spybot Teatimer.exe is disabled! Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Geändert von januskopf198 (10.02.2013 um 14:48 Uhr) |
|
11.02.2013, 13:31
| #19 |
| /// TB-Ausbilder | PC selbständig runter gefahren Servus, bitte lösche die folgende Datei per Hand: C:\Users\Christian\AppData\Roaming\bsetter-own.exe Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1
Schritt 2 Deinstalliere bitte deine aktuelle Version von Adobe Reader Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader und lade dir die neue Version von Hier herunter- Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome. Schritt 3 Starte DeFogger und klicke auf Re-enable. Gegebenenfalls muss dein Rechner neu gestartet werden. Schritt 4 Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren. Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK. Code:
ATTFilter Combofix /Uninstall
 Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden. Nun die eben deaktivierten Programme wieder aktivieren. Schritt 5 Downloade dir bitte delfix auf deinen Desktop.
Schritt 6
Schritt 7 Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
13.02.2013, 00:26
| #20 |
| | PC selbständig runter gefahren bitte lösche die folgende Datei per Hand: C:\Users\Christian\AppData\Roaming\bsetter-own.exe - diese Datei finde ich nicht auf meinem Rechner Schritt 2 Deinstalliere bitte deine aktuelle Version von Adobe Reader Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader und lade dir die neue Version von Hier herunter- Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome. - irgendwie kann ich Acrobat Reader mit diesem Download nicht installieren. Die Installation bricht immer ab Schritt 3 Starte DeFogger und klicke auf Re-enable. - DeFogger starten? Wie denn? |
|
13.02.2013, 10:29
| #21 | |||
| /// TB-Ausbilder | PC selbständig runter gefahren Servus, Zitat:
 Zitat:
Haken zuvor bei McAfee Security Scan Plus entfernen. Zitat:
Ist andererseits nicht so wichtig, da bei dir keine Treiber deaktiviert wurden.  Ich bin froh, dass wir helfen konnten  Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
| Themen zu PC selbständig runter gefahren |
| arten, gefahren, neu, plötzlich, runter, selbständig, starte, starten, versuch |
Textbox. 
