| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Vermute Virus bzw. Wurm auf SystemWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
24.04.2010, 16:57
| #1 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Vermute Virus bzw. Wurm auf System Hallo und  Zitat:
Bitte nun einen Vollscan mit Malwarebytes machen und Log posten. Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
24.04.2010, 20:58
| #2 | ||
 | Vermute Virus bzw. Wurm auf SystemZitat:
Zitat:
Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 4032 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 24.04.2010 21:30:05 mbam-log-2010-04-24 (21-30-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 208895 Laufzeit: 56 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (hxxp://flvdirect.iamwired.net/) Good: (hxxp://www.google.com) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Program Files\7-PDF\7-PDF Maker\lib\App\OOo\URE\bin\unicows.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Users\user\AppData\Local\Temp\Pgk.exe (Trojan.FakeAlert) -> Delete on reboot. C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. Info: Bestimmte Objekte konnten nicht entfernt werden. Eine Logdatei wurde im Logdatei-Verzeichnis gespeichert. |
|
24.04.2010, 21:01
| #3 |
| | Vermute Virus bzw. Wurm auf System Anschließend der OTL Log:
__________________OTL logfile created on: 24.04.2010 21:42:21 - Run 1 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Users\user\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 78,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 166,64 Gb Free Space | 71,56% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: USER-PC Current User Name: user Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) PRC - C:\Program Files\Join Air\AssistantServices.exe () PRC - C:\Program Files\Join Air\UIExec.exe () PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE () PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (UI Assistant Service) -- C:\Program Files\Join Air\AssistantServices.exe () SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) ========== Driver Services (SafeList) ========== DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (ALWIL Software) DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software) DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software) DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software) DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software) DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated) DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated) DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated) DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated) DRV - (ManyCam) -- C:\Windows\System32\drivers\ManyCam.sys (ManyCam LLC.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s125mgmt.sys (MCCI Corporation) DRV - (s125obex) -- C:\Windows\System32\drivers\s125obex.sys (MCCI Corporation) DRV - (s125mdm) -- C:\Windows\System32\drivers\s125mdm.sys (MCCI Corporation) DRV - (s125mdfl) -- C:\Windows\System32\drivers\s125mdfl.sys (MCCI Corporation) DRV - (s125bus) Sony Ericsson Device 125 driver (WDM) -- C:\Windows\System32\drivers\s125bus.sys (MCCI Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (Windows (R) Codename Longhorn DDK provider) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation) DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=" FF - prefs.js..browser.search.order.1: "GMX Suche" FF - prefs.js..browser.search.order.2: "1und1 Suche" FF - prefs.js..browser.search.order.3: "amazon.de" FF - prefs.js..browser.search.order.4: "WEB.DE Suche" FF - prefs.js..browser.search.selectedEngine: "Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 5 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.18 FF - prefs.js..keyword.URL: "hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.03 12:38:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.20 02:29:14 | 000,000,000 | ---D | M] [2009.12.16 23:08:53 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Extensions [2010.04.24 04:08:21 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions [2009.12.17 00:36:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.01.27 03:19:55 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66} [2010.04.22 23:00:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2010.04.05 02:56:27 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com [2010.03.16 00:09:00 | 000,000,266 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\FireFox\Profiles\79jwbfte.default\searchplugins\Search.xml [2010.03.30 22:14:21 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [UIExec] C:\Program Files\Join Air\UIExec.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ManyCam] C:\Program Files\ManyCam 2.4\ManyCam.exe (ManyCam LLC) O4 - HKCU..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\user\AppData\Local\Temp\Pgk.exe File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\user\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\user\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.24 21:40:07 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2010.04.24 20:28:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes [2010.04.24 20:28:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.24 20:28:08 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.24 20:28:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010.04.24 20:28:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.04.24 04:27:39 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis [2010.04.23 19:53:54 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\MGM [2010.04.22 23:01:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\QuickScan [2010.04.17 18:53:15 | 000,000,000 | ---D | C] -- C:\Program Files\Latte! [2010.04.15 19:20:59 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Eigene WinZip-Dateien [2010.04.15 18:58:44 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZip [2010.04.15 18:32:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\7-PDFMaker [2010.04.15 18:32:13 | 000,000,000 | ---D | C] -- C:\Program Files\7-PDF [2010.04.15 18:26:18 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\RoNaSoft.de [2010.04.15 16:09:21 | 000,000,000 | ---D | C] -- C:\Games [2010.04.15 12:44:14 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\EleFun Games [2010.04.14 22:28:56 | 003,600,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.04.14 22:28:56 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.04.14 22:28:42 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.04.14 22:28:21 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010.04.14 22:28:21 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010.04.14 13:32:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\URSE Games [2010.04.13 03:16:30 | 000,000,000 | ---D | C] -- C:\ProgramData\GameXzone [2010.04.13 03:13:46 | 000,000,000 | ---D | C] -- C:\Program Files\MyRealGames.com [2010.04.08 01:47:44 | 000,000,000 | ---D | C] -- C:\Program Files\StreamTorrent 1.0 [2010.04.08 01:47:44 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\StreamTorrent [2010.04.05 02:59:42 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\TVU Networks [2010.04.05 02:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\TVU Networks [2010.04.05 02:56:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\TVUAx [2010.04.05 01:01:57 | 000,000,000 | ---D | C] -- C:\Program Files\SopCast [2010.03.31 12:30:38 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.03.31 12:30:37 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010.03.31 12:30:37 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.03.31 12:30:37 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.03.31 12:30:37 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.03.31 12:30:36 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.03.31 12:30:36 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010.03.31 12:30:36 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010.03.31 12:30:36 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2010.03.31 12:30:36 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010.03.31 12:30:36 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010.03.31 12:30:36 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.03.31 12:30:36 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.03.31 12:30:36 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.03.31 12:30:35 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.03.30 22:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.03.30 22:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010.03.30 22:14:19 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.03.30 22:14:19 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.03.30 22:14:19 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.03.26 20:51:03 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0 [2009.06.16 14:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.04.24 21:44:17 | 001,418,612 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.04.24 21:44:17 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.04.24 21:44:17 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.04.24 21:44:17 | 000,122,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.04.24 21:44:17 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.04.24 21:41:21 | 002,097,152 | -HS- | M] () -- C:\Users\user\NTUSER.DAT [2010.04.24 21:40:09 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2010.04.24 21:37:49 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.04.24 21:37:46 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.24 21:37:46 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.24 21:37:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.24 21:37:35 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys [2010.04.24 21:36:59 | 000,524,288 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.04.24 21:36:59 | 000,065,536 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.04.24 21:36:26 | 006,291,456 | -H-- | M] () -- C:\Users\user\AppData\Local\IconCache.db [2010.04.24 21:21:01 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4201475959-196226615-1442939389-1000UA.job [2010.04.24 20:28:12 | 000,000,778 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.24 04:38:29 | 000,002,611 | ---- | M] () -- C:\Users\user\Desktop\HiJackThis.lnk [2010.04.24 01:21:00 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4201475959-196226615-1442939389-1000Core.job [2010.04.23 19:55:03 | 000,000,515 | ---- | M] () -- C:\Users\user\Desktop\MINIGOLF - Verknüpfung.lnk [2010.04.21 00:24:54 | 000,002,037 | ---- | M] () -- C:\Users\user\Desktop\Google Chrome.lnk [2010.04.20 02:29:15 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.04.17 18:56:53 | 000,000,736 | ---- | M] () -- C:\Users\user\Desktop\Latte! - Verknüpfung.lnk [2010.04.15 18:32:24 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\7-PDF Maker.lnk [2010.04.15 15:43:38 | 000,000,951 | ---- | M] () -- C:\Users\user\Desktop\Sky Fight.lnk [2010.04.15 12:43:37 | 000,001,004 | ---- | M] () -- C:\Users\user\Desktop\Egyptian Ball.lnk [2010.04.15 12:03:54 | 000,001,008 | ---- | M] () -- C:\Users\user\Desktop\Fun And Bullets.lnk [2010.04.15 11:57:27 | 000,000,951 | ---- | M] () -- C:\Users\user\Desktop\Mini Golf.lnk [2010.04.14 13:31:20 | 000,000,944 | ---- | M] () -- C:\Users\user\Desktop\Gem Ball.lnk [2010.04.13 03:13:55 | 000,000,975 | ---- | M] () -- C:\Users\user\Desktop\Tibet Quest.lnk [2010.04.08 01:47:44 | 000,000,874 | ---- | M] () -- C:\Users\user\Desktop\StreamTorrent 1.0.lnk [2010.04.05 01:01:58 | 000,000,748 | ---- | M] () -- C:\Users\user\Desktop\SopCast.lnk [2010.03.29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.03.29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.03.26 21:01:13 | 000,005,239 | ---- | M] () -- C:\Users\user\.recently-used.xbel [2010.03.26 20:51:26 | 000,000,858 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.04.24 20:28:12 | 000,000,778 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.24 04:27:40 | 000,002,611 | ---- | C] () -- C:\Users\user\Desktop\HiJackThis.lnk [2010.04.23 19:55:03 | 000,000,515 | ---- | C] () -- C:\Users\user\Desktop\MINIGOLF - Verknüpfung.lnk [2010.04.17 18:56:53 | 000,000,736 | ---- | C] () -- C:\Users\user\Desktop\Latte! - Verknüpfung.lnk [2010.04.15 18:32:24 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\7-PDF Maker.lnk [2010.04.15 15:43:38 | 000,000,951 | ---- | C] () -- C:\Users\user\Desktop\Sky Fight.lnk [2010.04.15 12:43:37 | 000,001,004 | ---- | C] () -- C:\Users\user\Desktop\Egyptian Ball.lnk [2010.04.15 12:03:54 | 000,001,008 | ---- | C] () -- C:\Users\user\Desktop\Fun And Bullets.lnk [2010.04.15 11:57:27 | 000,000,951 | ---- | C] () -- C:\Users\user\Desktop\Mini Golf.lnk [2010.04.14 13:31:20 | 000,000,944 | ---- | C] () -- C:\Users\user\Desktop\Gem Ball.lnk [2010.04.13 03:13:55 | 000,000,975 | ---- | C] () -- C:\Users\user\Desktop\Tibet Quest.lnk [2010.04.08 01:47:44 | 000,000,874 | ---- | C] () -- C:\Users\user\Desktop\StreamTorrent 1.0.lnk [2010.04.05 01:01:58 | 000,000,748 | ---- | C] () -- C:\Users\user\Desktop\SopCast.lnk [2010.03.26 21:01:13 | 000,005,239 | ---- | C] () -- C:\Users\user\.recently-used.xbel [2010.03.26 20:51:26 | 000,000,858 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2010.03.16 00:18:32 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2010.01.25 20:47:50 | 000,138,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.09.24 00:15:32 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.14 08:08:36 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2009.06.16 14:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini < End of report > |
|
24.04.2010, 21:02
| #4 |
| | Vermute Virus bzw. Wurm auf System UND:OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 24.04.2010 21:42:21 - Run 1
OTL by OldTimer - Version 3.2.2.0 Folder = C:\Users\user\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 166,64 Gb Free Space | 71,56% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: USER-PC
Current User Name: user
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3ED0DA1F-C2BF-45AF-942D-B701222E2210}" = lport=139 | protocol=6 | dir=in | app=system |
"{4283ACAB-BBC6-4928-88A5-41077B2BA092}" = rport=137 | protocol=17 | dir=out | app=system |
"{49B658DD-CE07-4609-8A1D-6FAF19413A74}" = lport=138 | protocol=17 | dir=in | app=system |
"{49B6D2F0-B127-4A8F-890D-BF267F101EB0}" = rport=138 | protocol=17 | dir=out | app=system |
"{527AE066-1A27-45B9-9C04-A4AD5A9AD11E}" = rport=139 | protocol=6 | dir=out | app=system |
"{54B7E53F-249F-48D8-9F39-6A68010C3E12}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{54C965DB-0263-4FE0-A822-0DA25A1392B8}" = rport=445 | protocol=6 | dir=out | app=system |
"{BAB3DD93-E7EA-4A83-8A1D-0D189CCDF0E5}" = lport=137 | protocol=17 | dir=in | app=system |
"{CE60F459-ECD3-4E0E-ABF0-95F1B59AF4D2}" = lport=445 | protocol=6 | dir=in | app=system |
"{F645BE02-F9FC-4ED1-9C4D-3CB9643A68AD}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1591B78B-D488-40B8-8639-DDF8F0CF1B9A}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe |
"{43CF36E3-EE8F-4050-BB29-4FB8E3E114A6}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"{5AE33398-2833-47DF-BE2C-5F1AF11A7964}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6A1C00B6-5A6D-4E88-AA5C-7CCB66BE001A}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe |
"{6C358D63-EF0B-40BC-B22C-18AA18FE4168}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{6D98E2E3-67A1-42A4-A319-84A25E789D84}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"{749FCB3D-B705-46CE-899A-53853E42C48A}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{99E9304F-23E5-40B3-996D-7D837B3DFB66}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9F72B063-4A1F-4614-A5B9-E0E9C598DAB0}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"{AA102975-87AB-4EA1-8D38-B76656C43565}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{B905EEB7-1DCF-4035-8E7C-C04770CC392F}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe |
"{E1DB75E3-F5BC-4459-9995-77243335F746}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"{E2720A88-37DD-47B3-8743-E35BBCB6B897}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbir.exe |
"{E763C537-DB4E-4137-A2D8-A511AC93EE09}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"TCP Query User{012CF062-3C97-4E46-82B9-19832F632CBD}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{1128B8C4-42B4-48D4-96C6-B7B6820AD6A3}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=6 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe |
"TCP Query User{121755E1-DBA6-432C-9A18-56C95129BAF0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{213EF35B-20BE-4D39-875C-8D0ADF3D6D04}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{5D06D591-2FAB-4CEF-9E7D-0E29E3944DD4}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{69617AD0-459C-4E53-9D84-67B0B5B82546}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"TCP Query User{758CAFD2-7A15-43CF-833A-6F448DFEE54F}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{A775C90D-BD86-49E1-8145-AB8A3BAF92E5}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{DC641BE6-9C4E-4CEF-A750-5E751095775D}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{F917F689-E48B-4F11-BF76-AC68CF6BA2A0}C:\program files\winamp remote\bin\orbtray.exe" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"UDP Query User{342E93AA-0EFE-4265-8328-AB3E5255EB4D}C:\program files\streamtorrent 1.0\streamtorrent.exe" = protocol=17 | dir=in | app=c:\program files\streamtorrent 1.0\streamtorrent.exe |
"UDP Query User{472CD4D6-709E-4BB6-BED6-3C950CACFC28}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{66F5F770-615F-4DA1-894B-07A7A61BA0E1}C:\program files\winamp remote\bin\orbtray.exe" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe |
"UDP Query User{810874F5-5E61-4E85-9AAB-DF2C6E9C7399}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{8B144B15-37DE-4511-83AE-E2BB285D4919}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{9085A2AF-B686-4264-B7BB-09F0AC8C076B}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{97574C74-2901-4C2E-AB8F-F22AC55CCF4F}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"UDP Query User{B378E594-252D-44B7-A1CF-88E054662352}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{D80DAC7C-0C63-491F-BDD7-DA15AB1528F8}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{F5E23D80-6BE6-4666-A69E-F6BD406D5D5A}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1CD220E7-1512-A5E1-327F-9607587B75AD}" = Catalyst Control Center Graphics Light
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 19
"{3E5948BC-A071-3C35-7DC4-31F5F293F35B}" = Catalyst Control Center Graphics Full New
"{3E981E45-833E-44C4-AB75-3668AA77F8EC}" = Adobe Flash Media Live Encoder 3
"{43EA3C14-C1F7-A093-1F4D-362A09F9A63B}" = CCC Help German
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{462F002C-0A03-6C5F-3475-228396D8F2AB}" = ccc-core-static
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{62D917DF-16DE-4383-9239-8C8BA06EB829}" = OpenOffice.org 3.1
"{63A56D6A-8AA4-4568-A9E0-790D31B2F30E}" = Adobe Flash Media Encoder 2.5
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BB19E5E-2AD7-B464-3B80-FB0CD8C504FB}" = Catalyst Control Center Graphics Full Existing
"{7C379BEF-4E12-3224-B2E8-513363B99181}" = ccc-utility
"{8AD67572-0AE2-0CAC-CD8B-17FBAC973901}" = ATI Catalyst Install Manager
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95ED7549-7C66-A618-3100-B6999F6A79A4}" = Catalyst Control Center Localization German
"{960EED1D-8F37-9EF5-C2F2-19C19983658B}" = Catalyst Control Center Core Implementation
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = Join Air
"{ABC80104-036E-6193-566F-4308420A4005}" = Catalyst Control Center Graphics Previews Vista
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DEE7AE5E-A8D1-05CF-5383-E5DC68486A54}" = Skins
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"7-PDF Maker_is1" = 7-PDF Maker Version 1.0.5 (Build 164)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast!" = avast! Antivirus
"Egyptian Ball_is1" = Egyptian Ball
"Fun And Bullets_is1" = Fun And Bullets
"Gem Ball_is1" = Gem Ball
"JDownloader" = JDownloader
"Latte! Fußballmanagement pur" = Latte! Fußballmanagement pur
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mini Golf_is1" = Mini Golf
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Orb" = Winamp Remote
"Prism" = Prism Video Converter
"Sky Fight_is1" = Sky Fight
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SopCast" = SopCast 3.2.9
"Streamripper" = Streamripper (Remove only)
"StreamTorrent 1.0" = StreamTorrent 1.0
"Switch" = Switch Sound File Converter
"TeamViewer 5" = TeamViewer 5
"Tibet Quest_is1" = Tibet Quest
"VLC media player" = VLC media player 1.0.5
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 21.04.2010 22:15:09 | Computer Name = user-PC | Source = EventSystem | ID = 4621
Description =
Error - 22.04.2010 17:10:23 | Computer Name = user-PC | Source = EventSystem | ID = 4621
Description =
Error - 23.04.2010 14:13:36 | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = Programm MINIGOLF.EXE, Version 0.0.0.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 11c4 Anfangszeit: 01cae3109488a6b8 Zeitpunkt der Beendigung:
141
Error - 23.04.2010 16:31:37 | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung java.exe, Version 6.0.190.4, Zeitstempel 0x4b960e06,
fehlerhaftes Modul java.dll, Version 6.0.190.4, Zeitstempel 0x4b963ed1, Ausnahmecode
0xc0000005, Fehleroffset 0x00004e46, Prozess-ID 0xaf4, Anwendungsstartzeit 01cae323f8315648.
Error - 23.04.2010 16:32:09 | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung java.exe, Version 6.0.190.4, Zeitstempel 0x4b960e06,
fehlerhaftes Modul java.dll, Version 6.0.190.4, Zeitstempel 0x4b963ed1, Ausnahmecode
0xc0000005, Fehleroffset 0x00004e46, Prozess-ID 0x14e0, Anwendungsstartzeit 01cae3240bd3bc18.
Error - 23.04.2010 18:04:21 | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Pgk.exe, Version 0.0.0.0, Zeitstempel 0x4bcc4c7a,
fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode
0xc0000005, Fehleroffset 0x002a3961, Prozess-ID 0x1650, Anwendungsstartzeit 01cae330c3be4aa8.
Error - 23.04.2010 22:24:03 | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Pgk.exe, Version 0.0.0.0, Zeitstempel 0x4bcc4c7a,
fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode
0xc0000005, Fehleroffset 0x0027a000, Prozess-ID 0x1140, Anwendungsstartzeit 01cae35511ebf418.
Error - 23.04.2010 23:26:19 | Computer Name = user-PC | Source = EventSystem | ID = 4621
Description =
Error - 24.04.2010 11:53:46 | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = Programm MINIGOLF.EXE, Version 0.0.0.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 1448 Anfangszeit: 01cae3c63599feb1 Zeitpunkt der Beendigung:
125
Error - 24.04.2010 12:41:34 | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Pgk.exe, Version 0.0.0.0, Zeitstempel 0x4bcc4c7a,
fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode
0xc0000005, Fehleroffset 0x00282000, Prozess-ID 0x788, Anwendungsstartzeit 01cae3cccaed7221.
[ System Events ]
Error - 24.11.2009 23:30:29 | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =
Error - 25.11.2009 10:22:58 | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.11.2009 10:34:15 | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =
Error - 25.11.2009 10:36:48 | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 25.11.2009 11:40:01 | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =
Error - 25.11.2009 14:05:46 | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 26.11.2009 00:47:51 | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =
Error - 26.11.2009 12:08:15 | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 26.11.2009 23:40:51 | Computer Name = user-PC | Source = DCOM | ID = 10010
Description =
Error - 27.11.2009 06:53:37 | Computer Name = user-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
|
|
| Themen zu Vermute Virus bzw. Wurm auf System |
| 32-bit, administrator, adobe, antivirus, assembly, avast, avast!, components, defender, firefox, google, helper, hijack, hijackthis, internet, internet explorer, local\temp, monitor, mozilla, notebook, opera, plug-in, port 80, programm, realtek, software, studio, system, temp, uiexec.exe, virus, vista, visual studio, windows, write, wurm |
Hybrid-Darstellung
