| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andereWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.05.2013, 20:13
| #1 |
| | ![Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere - Standard](images/icons/icon1.gif){kind=icon} Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere Hallo liebe Helfer, habe Probleme mit Viren hatte mir für Java Vorlesung Java Environment runtergeladen und hab jetzt jede menge probleme damit. Erstens habe ich G-data scan gemacht und poste am besten gleich das protokol es wurden 5 viren gefunden davon wurden 3 erfolgreich in quarantäne verschoben und ich habe sie dann manuell gelöscht jedoch konnten andere nicht gelöscht werden. Habe die 3 schritte befolgt und defogger drüber laufen lassen dann olt und schließlich GMER und poste die Protokolle anschließend (Danke im schonmal) Virenprüfung mit G Data InternetSecurity 2013 Version 23.1.0.2 (16.01.2013) Virensignaturen vom 07.05.2013 Startzeit: 07.05.2013 17:35:13 Engine(s): Engine A (AVA 22.9491), Engine B (AVL 22.1690) Heuristik: Ein Archive: Ein Systembereiche: Ein RootKits prüfen: Aus Prüfung der Systembereiche... Prüfung folgender Verzeichnisse und Dateien: C:\ E:\ C:\Users\gehtjagarnichtklar\ ::{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93} C:\Users\gehtjagarnichtklar\Desktop\ilkerstick\ C:\Users\gehtjagarnichtklar\Desktop\mpztechnik\ C:\Users\gehtjagarnichtklar\Desktop\Neuer Ordner\ C:\Users\gehtjagarnichtklar\Desktop\Neuer Ordner (2)\ C:\Users\gehtjagarnichtklar\Desktop\peistick\ C:\Users\gehtjagarnichtklar\Desktop\wc\ Analyse vollständig durchgeführt: 07.05.2013 20:14:50 316872 Dateien überprüft 5 infizierte Dateien gefunden 0 verdächtige Dateien gefunden Objekt: bje0t.dat Pfad: C:\ProgramData Status: Datei in Quarantäne verschoben Virus: Win32:Rootkit-gen [Rtk] (Engine B) Objekt: cbCkFeX.exe Pfad: C:\Users\gehtjagarnichtklar\AppData\Local\Temp Status: Datei in Quarantäne verschoben Virus: Win32:Rootkit-gen [Rtk] (Engine B) Archiv: 7ada2b5-498231b5 Pfad: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 Status: Datei in Quarantäne verschoben Virus: Java:Agent-DOA [Trj], Java:Malware-gen [Trj] (12x) (Engine B) Objekt: nkYy.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Agent-DOA [Trj] (Engine B) Objekt: sIy.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: tqYNqf.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: wCOgQFNTD.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: WlGODcAl.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: XjBfmIu.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: FgxUpMX.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: FpafaGNh.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: iACJTDdsx.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: iAlcBdlK.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: Lkjxx.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: lmoVXz.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: lyKpLobCv.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: cbCkFeX.exe Pfad: C:\Users\gehtjagarnichtklar\AppData\Local\Temp Status: Datei konnte nicht in die Quarantäne verschoben werden Virus: Win32:Rootkit-gen [Rtk] (Engine B) Archiv: 7ada2b5-498231b5 Pfad: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 Status: Datei konnte nicht in die Quarantäne verschoben werden Virus: Java:Agent-DOA [Trj], Java:Malware-gen [Trj] (12x) (Engine B) Objekt: nkYy.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Agent-DOA [Trj] (Engine B) Objekt: sIy.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: tqYNqf.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: wCOgQFNTD.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: WlGODcAl.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: XjBfmIu.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: FgxUpMX.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: FpafaGNh.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: iACJTDdsx.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: iAlcBdlK.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: Lkjxx.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: lmoVXz.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Objekt: lyKpLobCv.class In Archiv: C:\Users\gehtjagarnichtklar\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\7ada2b5-498231b5 Status: Virus gefunden Virus: Java:Malware-gen [Trj] (Engine B) Der Zugriff auf die folgenden Dateien wurde verweigert: C:\Windows\System32\wbem\Repository\MAPPING2.MAP C:\Windows\System32\wbem\Repository\INDEX.BTR C:\Windows\System32\winevt\Logs\DebugChannel.etl C:\Windows\System32\winevt\Logs\HardwareEvents.evtx C:\Windows\System32\winevt\Logs\Internet Explorer.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx Die folgenden Dateien sind Passwortgeschützt: C:\Users\gehtjagarnichtklar\Desktop\peistick\ss_09\Eteching.de\Digitaltechnik\Klausuren\Kla_DIG_2007_WS_V03.pdf C:\Users\gehtjagarnichtklar\Desktop\peistick\ss_09\Eteching.de\Digitaltechnik\Klausuren\Kla_DIG_2007_WS_V03.pdf C:\Users\gehtjagarnichtklar\Desktop\peistick\ss_09\Eteching.de\Digitaltechnik\Klausuren\Kla_DIG_2007_WS_V03.pdf So hier ist das OTL Protokol:OTL Logfile: Code:
ATTFilter OTL logfile created on: 07.05.2013 20:23:30 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\gehtjagarnichtklar\Downloads 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,92 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 53,86% Memory free 5,84 Gb Paging File | 3,63 Gb Available in Paging File | 62,24% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 278,56 Gb Total Space | 205,07 Gb Free Space | 73,62% Space Free | Partition Type: NTFS Drive D: | 1,89 Gb Total Space | 1,39 Gb Free Space | 73,50% Space Free | Partition Type: FAT Computer Name: GEHTJAGARNICHTK | User Name: gehtjagarnichtklar | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.07 19:38:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\gehtjagarnichtklar\Downloads\OTL.exe PRC - [2013.05.04 21:01:41 | 001,105,408 | ---- | M] (Spotify Ltd) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2013.04.05 00:41:44 | 025,863,280 | ---- | M] (Dropbox, Inc.) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2013.01.09 14:01:22 | 001,035,216 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.11.29 06:20:10 | 001,475,096 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe PRC - [2012.11.29 05:49:49 | 001,548,312 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe PRC - [2012.11.29 05:47:08 | 000,469,016 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe PRC - [2012.03.29 04:42:26 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe PRC - [2010.07.23 23:41:52 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2010.02.08 20:04:04 | 001,080,448 | ---- | M] (asus) -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe PRC - [2010.02.05 19:05:08 | 000,182,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe PRC - [2010.02.04 23:05:32 | 007,350,912 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe PRC - [2010.01.05 22:59:12 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe PRC - [2010.01.05 02:43:36 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe PRC - [2009.12.23 07:10:13 | 000,711,736 | ---- | M] (Conexant Systems, Inc) -- C:\Program Files\Conexant\SAII\SmartAudio.exe PRC - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe PRC - [2009.11.02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe PRC - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2009.07.31 19:38:24 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe PRC - [2009.06.19 19:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe PRC - [2009.06.19 19:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe PRC - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe PRC - [2008.12.23 02:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ========== Modules (No Company Name) ========== MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Dropbox\bin\libcef.dll MOD - [2013.02.17 15:29:38 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\24b67c1b2ec7be301ca76726b4b205c1\WindowsFormsIntegration.ni.dll MOD - [2013.02.17 15:28:25 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\a97f4e39d47dc3d5098150a8b14a9662\Microsoft.VisualBasic.ni.dll MOD - [2013.02.17 15:28:24 | 001,299,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\SmartAudio\cc3389a979c643c8524cb69f2e544894\SmartAudio.ni.exe MOD - [2013.02.17 14:00:25 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\05682429807d34d6ff05a77ea153935f\System.Windows.Forms.ni.dll MOD - [2013.01.10 20:59:04 | 000,220,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\24ab5f14e55ae0dec23141f6e59a577c\CustomMarshalers.ni.dll MOD - [2013.01.10 20:59:01 | 000,250,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.CxHDAudioAP#\904afebecd4b9d77aed25020dc5f2b98\Interop.CxHDAudioAPILib.ni.dll MOD - [2013.01.10 20:58:59 | 000,997,888 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\ee4683cbfd60ee35d95e2e6d32fc3981\System.Management.ni.dll MOD - [2013.01.10 17:59:21 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\0aeaf4f1629dbe8eafc8f47b1795b18a\PresentationFramework.Aero.ni.dll MOD - [2013.01.10 17:59:03 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\01b47a246b4ec7bfec31bf4503aceda1\System.Runtime.Remoting.ni.dll MOD - [2013.01.10 17:58:52 | 014,325,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\36b839247bd1d22a7fd014a74abe9729\PresentationFramework.ni.dll MOD - [2013.01.10 17:58:30 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e2ee5d77ebe0bd025e7a7a317a43d677\System.Drawing.ni.dll MOD - [2013.01.10 17:58:27 | 012,218,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\549690bfac66934b7c7fd5cf8b120b7c\PresentationCore.ni.dll MOD - [2013.01.10 17:58:15 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\82a4c4666ad83c3a375210247e69646b\WindowsBase.ni.dll MOD - [2013.01.10 17:58:09 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10aba2c167cc1119b80159fd9ac71ca8\System.Xml.ni.dll MOD - [2013.01.10 17:58:05 | 007,974,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c54750e64ba10d0fb7b6a636fb3695ca\System.ni.dll MOD - [2013.01.10 17:58:05 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\96a3b737db1e72adaf32d2b350e50c23\System.Configuration.ni.dll MOD - [2013.01.10 17:57:59 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b0b8554c05f194f546a8ed531320760b\mscorlib.ni.dll MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll MOD - [2010.02.03 01:51:50 | 000,076,288 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll MOD - [2010.02.03 01:51:32 | 000,186,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll MOD - [2010.02.03 01:51:24 | 000,050,688 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll MOD - [2010.02.03 01:51:14 | 000,041,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll MOD - [2010.02.03 01:51:10 | 000,071,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll MOD - [2010.01.05 02:43:36 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe MOD - [2009.11.02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2009.11.02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll MOD - [2009.08.04 11:50:05 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll MOD - [2009.08.04 11:49:50 | 000,167,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll MOD - [2009.06.10 23:22:50 | 000,069,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll MOD - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ========== Services (SafeList) ========== SRV:64bit: - [2010.01.22 03:01:11 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.12.08 01:16:34 | 000,379,520 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent) SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2013.04.10 08:56:49 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.03.13 19:42:17 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.11.29 06:14:21 | 002,377,736 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe -- (GDFwSvc) SRV - [2012.11.29 06:08:54 | 002,012,592 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe -- (AVKWCtl) SRV - [2012.11.29 05:49:49 | 001,548,312 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy) SRV - [2012.11.29 05:47:08 | 000,469,016 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe -- (AVKService) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.03.29 04:42:26 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.12.15 19:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2009.10.01 04:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2009.10.01 04:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009.06.16 02:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard) DRV:64bit: - [2013.04.18 19:08:46 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD) DRV:64bit: - [2013.04.18 19:01:17 | 000,064,416 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre) DRV:64bit: - [2013.04.18 19:01:00 | 000,126,880 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt) DRV:64bit: - [2013.04.18 19:01:00 | 000,065,008 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd) DRV:64bit: - [2013.04.18 19:01:00 | 000,054,176 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave) DRV:64bit: - [2013.01.16 20:22:31 | 000,062,368 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt) DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.07.23 23:48:41 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.03.03 13:51:39 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.03.02 10:45:23 | 001,594,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.02.25 05:26:57 | 000,115,312 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\JME.sys -- (JME) DRV:64bit: - [2010.01.22 03:13:23 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2010.01.22 03:13:23 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:64bit: - [2010.01.22 02:07:55 | 000,161,280 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.01.20 15:48:56 | 000,332,688 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11) DRV:64bit: - [2010.01.18 14:37:57 | 000,128,512 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2009.10.30 04:50:03 | 000,704,512 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009.09.30 03:34:31 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2009.08.20 04:41:37 | 001,800,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) DRV:64bit: - [2009.08.18 10:23:31 | 000,143,472 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR) DRV:64bit: - [2009.07.20 11:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.18 21:18:10 | 000,015,928 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\lullaby.sys -- (lullaby) DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.13 18:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2008.12.08 17:35:52 | 000,061,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2008.05.24 02:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.07.03 02:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUT_deDE504 IE - HKCU\..\SearchScopes\{C3F40B9D-965D-4072-B5A6-8A9C26F60C17}: "URL" = hxxp://www.bing.com/search?FORM=ASUBDF&PC=MAAU&q={searchTerms}&src=IE-SearchBox IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledAddons: ffToolbar%40couponarchiv.de:1.12 FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@TrendMicro.com/FFExtension: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.14 19:25:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.12 10:51:59 | 000,000,000 | ---D | M] [2012.10.03 20:52:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\mozilla\Extensions [2013.02.23 16:18:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\mozilla\Firefox\Profiles\m2zc4ha3.default\extensions [2013.02.23 16:18:23 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\mozilla\Firefox\Profiles\m2zc4ha3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.01.11 00:52:48 | 000,018,310 | ---- | M] () (No name found) -- C:\Users\gehtjagarnichtklar\AppData\Roaming\mozilla\firefox\profiles\m2zc4ha3.default\extensions\ffToolbar@couponarchiv.de.xpi [2013.04.17 19:15:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.04.17 19:15:00 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad} [2013.04.10 08:57:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2013.04.10 10:18:46 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.04.10 10:18:46 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013.04.10 10:18:46 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2013.04.10 10:18:46 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2013.04.10 10:18:46 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2013.04.10 10:18:46 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4:64bit: - HKLM..\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe () O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\f3b3.dat,FG00 File not found O4 - HKCU..\Run: [Spotify] C:\Users\gehtjagarnichtklar\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\gehtjagarnichtklar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) O4 - Startup: C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\gehtjagarnichtklar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F9F1553-0C75-4D49-8A0E-8E27E0BC2F7B}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013.01.13 04:37:46 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{68496e03-96a1-11df-aeae-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{68496e03-96a1-11df-aeae-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SYSTEM\AUTOSTRT.EXE O33 - MountPoints2\{68496e03-96a1-11df-aeae-806e6f6e6963}\Shell\install1\command - "" = E:\system\Elevate.exe "Start.exe" O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.05.07 18:30:47 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\Desktop\iphone [2013.05.07 17:34:54 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Local\G DATA [2013.05.04 00:09:06 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe [2013.04.27 19:04:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Conexant [2013.04.27 19:04:02 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Local\Conexant [2013.04.24 13:15:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2013.04.24 11:16:53 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\Desktop\wc [2013.04.23 12:47:04 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\Desktop\ilkerstick [2013.04.21 17:49:24 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Screenshoter [2013.04.18 19:08:46 | 000,106,648 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys [2013.04.18 18:57:28 | 000,311,200 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2013.04.18 18:57:21 | 000,188,832 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2013.04.18 18:57:21 | 000,188,320 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2013.04.18 18:57:21 | 000,108,448 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2013.04.18 15:21:49 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\.jeliot [2013.04.17 22:16:25 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Local\Spotify [2013.04.17 22:16:07 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Spotify [2013.04.17 19:15:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity 2013 [2013.04.17 19:14:46 | 000,126,880 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys [2013.04.17 19:14:46 | 000,064,416 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys [2013.04.17 19:14:45 | 000,065,008 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys [2013.04.17 19:14:45 | 000,054,176 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys [2013.04.17 16:08:05 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Local\ElevatedDiagnostics [2013.04.17 16:04:06 | 000,000,000 | ---D | C] -- C:\Windows\pss [2013.04.17 14:28:20 | 000,000,000 | -HSD | C] -- C:\found.000 [2013.04.14 19:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.04.12 10:49:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.04.11 13:29:55 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Canneverbe Limited [2013.04.11 13:29:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2013.04.11 13:29:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP [2013.04.10 18:43:21 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013.04.10 18:43:21 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.04.10 18:43:20 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.04.10 18:43:20 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013.04.10 18:43:20 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013.04.10 18:43:20 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.04.10 18:43:20 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013.04.10 18:43:20 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.04.10 18:43:19 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.04.10 18:43:19 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013.04.10 18:43:19 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013.04.10 18:43:19 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.04.10 18:43:17 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.04.10 18:43:17 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.04.10 18:43:17 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013.04.10 18:22:33 | 003,138,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll [2013.04.10 18:22:32 | 002,691,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2013.04.10 18:22:32 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll [2013.04.10 18:22:32 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll [2013.04.10 18:22:32 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll [2013.04.10 18:22:32 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll [2013.04.10 18:22:21 | 005,497,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013.04.10 18:22:20 | 003,902,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013.04.10 18:22:19 | 003,958,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013.04.10 18:22:19 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe [2013.04.10 18:22:19 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2013.04.10 18:22:19 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll [2013.04.08 23:13:57 | 000,000,000 | ---D | C] -- C:\Users\gehtjagarnichtklar\Desktop\peistick [2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.05.07 20:17:26 | 000,000,000 | ---- | M] () -- C:\Users\gehtjagarnichtklar\defogger_reenable [2013.05.07 19:42:58 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.05.07 19:34:10 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.05.07 16:28:27 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.05.07 16:28:27 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.05.07 16:25:05 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.05.07 16:25:05 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.05.07 16:25:05 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.05.07 16:25:05 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.05.07 16:25:05 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.05.07 16:20:04 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.05.07 16:19:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.05.07 16:19:36 | 457,625,609 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.05.07 16:19:34 | 2350,284,800 | -HS- | M] () -- C:\hiberfil.sys [2013.05.07 14:31:14 | 095,023,320 | ---- | M] () -- C:\ProgramData\3b3f.pad [2013.05.07 14:16:41 | 001,065,573 | ---- | M] () -- C:\Windows\SysWow64\sig.bin [2013.05.07 14:16:41 | 000,054,727 | ---- | M] () -- C:\Windows\SysWow64\nmp.map [2013.05.04 00:09:34 | 000,000,150 | ---- | M] () -- C:\ProgramData\3b3f.reg [2013.05.04 00:09:34 | 000,000,054 | ---- | M] () -- C:\ProgramData\3b3f.bat [2013.05.04 00:09:16 | 000,001,023 | ---- | M] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk [2013.05.04 00:09:11 | 095,023,320 | ---- | M] () -- C:\ProgramData\t0ejb.pad [2013.05.04 00:09:06 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe [2013.04.24 21:12:42 | 000,229,377 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Desktop\Blockade.jpg [2013.04.24 13:15:28 | 000,001,068 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2013.04.19 20:11:28 | 000,070,915 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Desktop\_Einverständniserklärung_EB.pdf_ [2013.04.19 20:11:25 | 000,069,491 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Desktop\Augenbefund.pdf [2013.04.19 20:11:20 | 000,051,187 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Desktop\_Erreichbarkeit_Frau_Feßke_BV.pdf_ [2013.04.18 19:08:46 | 000,106,648 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys [2013.04.18 19:01:17 | 000,064,416 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys [2013.04.18 19:01:00 | 000,126,880 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys [2013.04.18 19:01:00 | 000,065,008 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys [2013.04.18 19:01:00 | 000,054,176 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys [2013.04.18 18:57:18 | 000,108,448 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll [2013.04.18 18:57:17 | 001,092,512 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll [2013.04.18 18:57:17 | 000,971,680 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll [2013.04.18 18:57:17 | 000,311,200 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe [2013.04.18 18:57:17 | 000,188,832 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe [2013.04.18 18:57:17 | 000,188,320 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe [2013.04.18 15:18:48 | 000,002,002 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini [2013.04.17 22:16:25 | 000,001,881 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Desktop\Spotify.lnk [2013.04.17 19:14:33 | 000,002,136 | ---- | M] () -- C:\Users\Public\Desktop\G Data InternetSecurity.lnk [2013.04.17 19:01:32 | 000,001,073 | ---- | M] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.04.15 23:10:41 | 000,089,718 | ---- | M] () -- C:\Users\gehtjagarnichtklar\Documents\Fotostrom einer Solarzelle.xps [2013.04.14 19:25:05 | 000,001,149 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.04.11 13:29:41 | 000,001,951 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2013.04.10 19:06:14 | 000,416,360 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.05.07 20:17:26 | 000,000,000 | ---- | C] () -- C:\Users\gehtjagarnichtklar\defogger_reenable [2013.05.04 00:09:34 | 000,000,150 | ---- | C] () -- C:\ProgramData\3b3f.reg [2013.05.04 00:09:34 | 000,000,054 | ---- | C] () -- C:\ProgramData\3b3f.bat [2013.05.04 00:09:16 | 000,001,023 | ---- | C] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk [2013.05.04 00:09:10 | 095,023,320 | ---- | C] () -- C:\ProgramData\3b3f.pad [2013.05.04 00:09:09 | 095,023,320 | ---- | C] () -- C:\ProgramData\t0ejb.pad [2013.04.24 21:12:42 | 000,229,377 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Desktop\Blockade.jpg [2013.04.24 13:15:28 | 000,001,068 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2013.04.19 20:11:28 | 000,070,915 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Desktop\_Einverständniserklärung_EB.pdf_ [2013.04.19 20:11:24 | 000,069,491 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Desktop\Augenbefund.pdf [2013.04.19 20:11:20 | 000,051,187 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Desktop\_Erreichbarkeit_Frau_Feßke_BV.pdf_ [2013.04.17 22:16:25 | 000,001,881 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Desktop\Spotify.lnk [2013.04.17 22:16:25 | 000,001,867 | ---- | C] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk [2013.04.17 19:14:33 | 000,002,136 | ---- | C] () -- C:\Users\Public\Desktop\G Data InternetSecurity.lnk [2013.04.17 19:01:32 | 000,001,073 | ---- | C] () -- C:\Users\gehtjagarnichtklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2013.04.15 23:10:40 | 000,089,718 | ---- | C] () -- C:\Users\gehtjagarnichtklar\Documents\Fotostrom einer Solarzelle.xps [2013.04.14 19:25:05 | 000,001,149 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.04.14 19:25:04 | 000,001,161 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.04.11 13:29:41 | 000,001,951 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2013.04.11 13:29:41 | 000,001,901 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2013.01.17 01:20:09 | 001,065,573 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2012.10.13 02:44:08 | 000,017,408 | ---- | C] () -- C:\Users\gehtjagarnichtklar\AppData\Local\WebpageIcons.db [2012.10.03 22:07:24 | 000,000,036 | ---- | C] () -- C:\Users\gehtjagarnichtklar\AppData\Local\housecall.guid.cache [2010.07.23 23:18:30 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:AB689DEA < End of report > und schließlich das GMER protokol: GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-07 20:21:38
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0003 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\GEHTJA~1\AppData\Local\Temp\kwtyypoc.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [404:1392] 000007fefaae59a0
Thread C:\Windows\System32\svchost.exe [404:3404] 000007fef6421dd0
Thread C:\Windows\System32\svchost.exe [404:3456] 000007fefd561a70
Thread C:\Windows\System32\svchost.exe [404:3488] 000007fef5a1a2b0
Thread C:\Windows\System32\svchost.exe [404:936] 000007fef75a7750
Thread C:\Windows\System32\svchost.exe [404:3376] 000007fef7ab88f8
Thread C:\Windows\System32\spoolsv.exe [1620:2252] 000007fef97410c8
Thread C:\Windows\System32\spoolsv.exe [1620:2680] 000007fef9706144
Thread C:\Windows\System32\spoolsv.exe [1620:2684] 000007fef78a5fd0
Thread C:\Windows\System32\spoolsv.exe [1620:2696] 000007fef7a23438
Thread C:\Windows\System32\spoolsv.exe [1620:2700] 000007fef78a63ec
Thread C:\Windows\System32\spoolsv.exe [1620:2708] 000007fef9da5e5c
Thread C:\Windows\System32\spoolsv.exe [1620:2712] 000007fef983484c
Thread C:\Windows\System32\WUDFHost.exe [3500:3580] 000007fef58924a0
Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3564:3496] 000007fef4322264
Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3564:2104] 000007fef431d73c
Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3564:3092] 000007fef431d73c
---- EOF - GMER 2.1 ----
Geändert von Kuemmel (07.05.2013 um 20:20 Uhr) |
|
07.05.2013, 23:18
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
09.05.2013, 11:40
| #3 |
| | Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere Nein hab ich nicht ich hab alles gepostet was ich habe und bin auch nach den Schritten vorgegangen die in den Regeln aufgelistet sind. Habe mich jetzt umentschieden und werde Windows neu aufsetzen hab aber jetzt noch ein Problem und zwar will der ASUS Laptop von mir eine Sicherungskopie der Werkseinstellung, da ich wenn ich Neu starte und F9 drücke Windows ohne CD nich neu aufsetzen kann. Meine frage ist jetzt wenn ich eine Wrkseinstellungs CD erstelle könnte es sein das auf dieser die Bedrohungen mit drauf kommen. Das heisst also ob ich mir Windows ganz neu kaufen muss oder ich noch eine Chance habe.
__________________ |
|
09.05.2013, 18:07
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere Deswegen musst du nicht Windows neu kaufen! Lies mal hier => http://www.trojaner-board.de/100776-...tml#post676887
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere |
| agent, appdata, cache, dateien, defender, desktop, digital, enigma, folge, g-data, gelöscht, gmer, infizierte, java, opera, ordner, plug-in, probleme, prüfen, scan, security, spotify web helper, system32, viren, win, win32, windows, zugriff |
![Hallo bin Liebe TB User. Habe Probleme mit Trojan.script.480412 & Java Agent DOA [TRJ] sowie andere](iconimages/plagegeister-aller-art-deren-bekaempfung/hallo-liebe-tb-user-habe-probleme-trojan-script-480412-java-agent-doa-trj-andere_ltr.gif)
Linear-Darstellung
