| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Antispyware soft erfolgreich entfernt?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.05.2010, 21:57
| #1 |
 |  Antispyware soft erfolgreich entfernt? Hallo, alle zusammen. Hatte heute früh nach dem hochfahren festgestellt, dass sich ein ungebetener Gast auf meinem System befindet: Antispyware Soft. Nach Neustart mit Ubuntu bin ich dann auf den Thread von AdminBot und DaGuRu gestoßen (Vielen Dank euch beiden für eure Mühe. Ohne eure Arbeit wäre ich aufgeschmissen gewesen) Habe alle Schritte wie beschrieben durchgeführt. Jetzt scheint mein System (XP 32 Bit) wieder normal zu laufen. Wie empfohlen hier der Log von MBAM: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4155 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 6.0.2900.5512 30.05.2010 10:35:06 mbam-log-2010-05-30 (10-35-06).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 127888 Laufzeit: 5 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 22 Infizierte Registrierungswerte: 8 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 14 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\cscrptxt.cscrptxt (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e0ec6fba-f009-3535-95d6-b6390db27da1} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e6737946-5ade-4165-b548-014484ef31e4} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e6737946-5ade-4165-b548-014484ef31e4} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e6737946-5ade-4165-b548-014484ef31e4} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\cscrptxt.cscrptxt.1.0 (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshnas (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\adgj.aghlp (Adware.EZLife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\adgj.aghlp.1 (Adware.EZLife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\adshothlpr.adshothlpr (Adware.Adrotator) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\adshothlpr.adshothlpr.1.0 (Adware.Adrotator) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvoryecd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvoryecd (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asam (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asam (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fdffuqsykk (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Documents and Settings\Penner\Local Settings\Application Data\wbedsgorq\knrmucvtssd.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Application Data\asam.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jsxhifsa.dll (Adware.EZlife) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Temp\comver.dll (Adware.GameSpyArcade) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Temp\noxmrswaec.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Temp\wgvyd.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Application Data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\cleansweep.exe\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\cleansweep.exe\config.bin (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Penner\Local Settings\Temp\Bcx.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jlvbkzbqgw.dll (Trojan.Agent) -> Quarantined and deleted successfully. Hoffe, dass ich das vollständig weg bekommen habe. Und nochmal: Vielen Dank für euere Mühe. |
|
30.05.2010, 22:21
| #2 |
| /// Helfer-Team  | Antispyware soft erfolgreich entfernt? Hi und
__________________ !Sieht schonmal nicht schlecht aus, zur genaueren Analyse bitte mal mit OTL scannen: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
__________________ |
|
30.05.2010, 22:57
| #3 |
| |  Antispyware soft erfolgreich entfernt? [SIZE="2"]OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 30.05.2010 23:48:36 - Run 1 OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Penner\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 73,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 86,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 39,06 Gb Total Space | 1,98 Gb Free Space | 5,07% Space Free | Partition Type: NTFS Drive D: | 37,62 Gb Total Space | 25,92 Gb Free Space | 68,89% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded Drive H: | 5,41 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF I: Drive not present or media not loaded Drive S: | 465,76 Gb Total Space | 344,32 Gb Free Space | 73,93% Space Free | Partition Type: NTFS Computer Name: *** Current UserName:*** Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Penner\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Program Files\Eraser\Eraser.exe (The Eraser Project) PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe () PRC - C:\Program Files\Safari\Safari.exe (Apple Inc.) PRC - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\OpenOffice.org 2.4\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files\OpenOffice.org 2.4\program\soffice.exe (OpenOffice.org) PRC - C:\WINDOWS\system32\Crypserv.exe (CrypKey (Canada) Ltd.) PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) PRC - C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe (InterVideo Inc.) PRC - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe () ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\Penner\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (NMSAccessU) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe () SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (Crypkey License) -- C:\WINDOWS\System32\Crypserv.exe (CrypKey (Canada) Ltd.) SRV - (UleadBurningHelper) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) ========== Driver Services (SafeList) ========== DRV - (wggufgup) -- C:\WINDOWS\system32\drivers\wggufgup.sys () DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (BT848) -- C:\WINDOWS\system32\drivers\BT848.sys (Illusion & Hope.) DRV - (StarOpen) -- C:\WINDOWS\system32\drivers\StarOpen.sys () DRV - (gdrv) -- C:\WINDOWS\gdrv.sys (Windows (R) 2000 DDK provider) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (AF9035BDA) -- C:\WINDOWS\system32\drivers\AF9035BDA.sys (AfaTech ) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (RTHDMIAzAudService) -- C:\WINDOWS\system32\drivers\RtHDMI.sys (Realtek Semiconductor Corp.) DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative) DRV - (MPE) -- C:\WINDOWS\system32\drivers\MPE.sys (Microsoft Corporation) DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation) DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (NetworkX) -- C:\WINDOWS\system32\ckldrv.sys () DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.) DRV - (LVCap138) -- C:\WINDOWS\system32\drivers\tvcap.sys (Philips) DRV - (lvtuner) -- C:\WINDOWS\system32\drivers\tvtuner.sys (Philips) DRV - (ndiscm) -- C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.) DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation) DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245 IE - HKCU\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll (DeviceVM Inc.) IE - HKCU\..\URLSearchHook: {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL (Ask.com) IE - HKCU\..\URLSearchHook: {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Program Files\Games_Bar_1\tbGam1.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "softonic-de3 Customized Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2431245&SearchSource=13" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 5 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.5.8.6 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.30 02:19:38 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.15 02:35:25 | 000,000,000 | ---D | M] [2009.06.04 15:53:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Penner\Application Data\Mozilla\Extensions [2010.04.24 15:29:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\extensions [2010.01.27 05:38:01 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8} [2010.04.16 01:43:06 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.01.27 05:35:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.04.24 15:29:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\extensions\firefox@tvunetworks.com [2010.03.16 11:42:56 | 000,000,927 | ---- | M] () -- C:\Documents and Settings\Penner\Application Data\Mozilla\Firefox\Profiles\kqc598wa.default\searchplugins\conduit.xml [2010.04.24 15:29:20 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009.09.23 08:34:26 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2009.09.23 08:34:26 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2009.09.23 08:34:26 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2009.09.23 08:34:26 | 000,000,986 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2009.09.23 08:34:26 | 000,000,801 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (moigh Object) - {15D85275-5ED8-4985-9CA4-B86C94DA6F43} - C:\WINDOWS\system32\sqaticxi.dll () O2 - BHO: (voguecash browser enhancer) - {4E87C27C-4BDE-98F5-1F99-482D1CE17DAA} - C:\WINDOWS\System32\jlvbkzbqgw.dll File not found O2 - BHO: (Ask Search Assistant BHO) - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL (Ask.com) O2 - BHO: (Games Bar 1 Toolbar) - {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Program Files\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O2 - BHO: (Ask Toolbar BHO) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH) O3 - HKLM\..\Toolbar: (Games Bar 1 Toolbar) - {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Program Files\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (Ask Toolbar) - {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Games Bar 1 Toolbar) - {BC04B34E-5DD8-465A-A5E0-86F7C11BC009} - C:\Program Files\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project) O4 - HKLM..\Run: [GEST] File not found O4 - HKLM..\Run: [MChk] C:\WINDOWS\system32\goebfbjd.exe () O4 - HKLM..\Run: [skb] File not found O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [WinDVR SchSvr] C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe (InterVideo Inc.) O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe () O4 - Startup: C:\Documents and Settings\Penner\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O15 - HKCU\..Trusted Domains: ([]msn in My Computer) O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.234.128.7 195.234.128.16 85.233.58.60 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop WallPaper: C:\Documents and Settings\Penner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Penner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.26 01:14:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2007.05.15 06:19:35 | 000,000,063 | R--- | M] () - H:\autorun.inf -- [ UDF ] O32 - AutoRun File - [2007.09.03 06:34:51 | 000,218,440 | R--- | M] () - H:\autorun_PES2008.exe -- [ UDF ] O33 - MountPoints2\{7ee03a50-498f-11de-909c-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{7ee03a50-498f-11de-909c-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{7ee03a50-498f-11de-909c-806d6172696f}\Shell\AutoRun\command - "" = H:\autorun_PES2008.exe -- [2007.09.03 06:34:51 | 000,218,440 | R--- | M] () O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\autorun_PES2008.exe -- [2007.09.03 06:34:51 | 000,218,440 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.05.30 23:46:29 | 000,571,392 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Penner\Desktop\OTL.exe [2010.05.30 10:25:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Penner\Application Data\Malwarebytes [2010.05.30 10:25:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.05.30 10:25:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.05.30 10:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010.05.30 10:25:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010.05.30 10:09:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010.05.30 10:09:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010.05.30 08:25:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Penner\Application Data\Street-Ads [2010.05.30 08:25:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Penner\Application Data\Sky-Banners [2010.05.30 08:24:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Penner\Local Settings\Application Data\wbedsgorq [2010.05.30 08:24:45 | 000,000,000 | ---D | C] -- C:\Program Files\$NtUninstallWTF1012$ [2010.05.02 18:28:21 | 000,000,000 | ---D | C] -- C:\Program Files\AVS4YOU [2010.05.01 14:50:07 | 000,000,000 | ---D | C] -- C:\Program Files\Veetle [2010.05.01 12:49:30 | 000,464,416 | ---- | C] (KRÜGER Softwareentwicklung) -- C:\WINDOWS\System32\Ksowl25f.dll [2010.05.01 12:49:30 | 000,380,928 | ---- | C] (KSE Software) -- C:\WINDOWS\System32\ksplz32.dll [2010.05.01 12:49:30 | 000,176,128 | ---- | C] (Borland International) -- C:\WINDOWS\System32\Cw3215.dll [2010.05.01 12:49:27 | 000,203,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Richtx32.ocx [2010.05.01 12:49:27 | 000,049,152 | ---- | C] (Borland International) -- C:\WINDOWS\System32\Bids45f.dll [2010.05.01 12:49:27 | 000,036,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Rchtxde.dll [2010.05.01 12:49:26 | 000,823,296 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\Flash.ocx [2010.05.01 12:49:26 | 000,525,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Dbgrid32.ocx [2010.05.01 12:49:26 | 000,413,696 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\Tx32.dll [2010.05.01 12:49:26 | 000,339,968 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_word.dll [2010.05.01 12:49:26 | 000,275,456 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\Tx4ole.ocx [2010.05.01 12:49:26 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Comdlg32.ocx [2010.05.01 12:49:26 | 000,126,976 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_htm32.dll [2010.05.01 12:49:26 | 000,115,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSINET.OCX [2010.05.01 12:49:26 | 000,098,304 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_rtf32.dll [2010.05.01 12:49:26 | 000,081,920 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\txtls32.dll [2010.05.01 12:49:26 | 000,061,440 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\wndtls32.dll [2010.05.01 12:49:26 | 000,045,056 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_tif32.flt [2010.05.01 12:49:26 | 000,032,768 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_wmf32.flt [2010.05.01 12:49:26 | 000,032,768 | ---- | C] (The Imaging Source Europe GmbH) -- C:\WINDOWS\System32\tx_bmp32.flt [2010.05.01 12:49:26 | 000,030,720 | ---- | C] (DBS GmbH) -- C:\WINDOWS\System32\Pgrul.ocx [2010.05.01 12:49:25 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Msbind.dll [2010.05.01 12:49:22 | 000,557,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dao360.dll [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.05.30 23:44:12 | 000,002,187 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk [2010.05.30 23:30:00 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.05.30 23:13:04 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\Penner\Local Settings\Application Data\WebpageIcons.db [2010.05.30 22:37:49 | 004,980,736 | ---- | M] () -- C:\Documents and Settings\Penner\ntuser.dat [2010.05.30 22:23:11 | 000,508,956 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.05.30 22:23:11 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.05.30 22:23:11 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.05.30 22:20:25 | 000,000,539 | ---- | M] () -- C:\WINDOWS\win.ini [2010.05.30 22:18:14 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.05.30 22:18:09 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.05.30 22:18:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.05.30 10:49:23 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Penner\ntuser.ini [2010.05.30 10:25:12 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.05.30 09:59:36 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.05.30 09:25:15 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\wggufgup.sys [2010.05.30 08:24:50 | 000,050,981 | ---- | M] () -- C:\WINDOWS\System32\wjxurjwdaattf.exe [2010.05.30 08:24:30 | 000,124,416 | ---- | M] () -- C:\WINDOWS\Btigaa.exe [2010.05.30 08:14:38 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.05.30 00:24:00 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Penner\Desktop\OTL.exe [2010.05.28 01:48:39 | 000,079,360 | ---- | M] () -- C:\Documents and Settings\Penner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.05.26 17:28:49 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\TubeBox! starten.lnk [2010.05.26 02:28:17 | 397,926,864 | ---- | M] () -- D:\My Documents\Lindenstrasse_10.05.25_17-55_ardeinsfestival_30_TVOON_DE.mpg.avi.otrkey [2010.05.25 20:33:13 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk [2010.05.25 07:38:04 | 000,309,248 | ---- | M] () -- C:\WINDOWS\System32\sqaticxi.dll [2010.05.24 18:31:20 | 000,040,633 | ---- | M] () -- C:\WINDOWS\System32\goebfbjd.exe [2010.05.16 10:11:03 | 000,000,669 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk [2010.05.16 08:57:58 | 731,453,440 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\ubuntu-10.04-desktop-amd64.iso [2010.05.12 10:51:07 | 001,128,522 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\Folge 86.mp3 [2010.05.06 15:42:59 | 003,174,762 | -H-- | M] () -- C:\Documents and Settings\Penner\Local Settings\Application Data\IconCache.db [2010.05.03 02:13:46 | 000,001,982 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\vba.ini [2010.05.01 19:24:05 | 000,000,549 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\iSnooker.lnk [2010.05.01 15:28:56 | 005,279,114 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\SopCast.zip [2010.05.01 14:47:40 | 011,048,840 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\veetle-0.9.17.exe [2010.05.01 13:20:27 | 000,025,372 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\Ländercodes im Briefdienst – Wikipedia.html [2010.05.01 13:20:16 | 000,233,604 | ---- | M] () -- C:\Documents and Settings\Penner\Desktop\Ländercodes im Briefdienst – Wikipedia.webarchive [2010.05.01 12:49:27 | 000,000,375 | ---- | M] () -- C:\WINDOWS\plzdir21.ini [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.05.30 10:25:12 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.05.30 08:24:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\wggufgup.sys [2010.05.30 08:24:50 | 000,050,981 | ---- | C] () -- C:\WINDOWS\System32\wjxurjwdaattf.exe [2010.05.30 08:24:35 | 000,124,416 | ---- | C] () -- C:\WINDOWS\Btigaa.exe [2010.05.26 02:28:17 | 397,926,864 | ---- | C] () -- D:\My Documents\Lindenstrasse_10.05.25_17-55_ardeinsfestival_30_TVOON_DE.mpg.avi.otrkey [2010.05.25 20:33:13 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk [2010.05.25 07:38:04 | 000,309,248 | ---- | C] () -- C:\WINDOWS\System32\sqaticxi.dll [2010.05.24 18:31:20 | 000,040,633 | ---- | C] () -- C:\WINDOWS\System32\goebfbjd.exe [2010.05.16 10:11:03 | 000,000,669 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk [2010.05.16 08:36:49 | 731,453,440 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\ubuntu-10.04-desktop-amd64.iso [2010.05.12 10:51:01 | 001,128,522 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\Folge 86.mp3 [2010.05.03 02:13:13 | 000,001,982 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\vba.ini [2010.05.01 23:36:33 | 005,279,114 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\SopCast.zip [2010.05.01 14:46:33 | 011,048,840 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\veetle-0.9.17.exe [2010.05.01 13:20:27 | 000,025,372 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\Ländercodes im Briefdienst – Wikipedia.html [2010.05.01 13:20:16 | 000,233,604 | ---- | C] () -- C:\Documents and Settings\Penner\Desktop\Ländercodes im Briefdienst – Wikipedia.webarchive [2010.05.01 12:49:27 | 000,000,375 | ---- | C] () -- C:\WINDOWS\plzdir21.ini [2010.05.01 12:49:26 | 000,062,464 | ---- | C] () -- C:\WINDOWS\System32\DBGRID32.oca [2010.05.01 12:49:26 | 000,002,494 | ---- | C] () -- C:\WINDOWS\System32\Comdlg32.dep [2010.05.01 12:49:26 | 000,002,385 | ---- | C] () -- C:\WINDOWS\System32\Dbgrid32.dep [2010.05.01 12:49:25 | 000,002,494 | ---- | C] () -- C:\WINDOWS\System32\Mscomctl.dep [2010.05.01 12:49:25 | 000,000,492 | ---- | C] () -- C:\WINDOWS\System32\Msbind.dep [2010.04.27 03:07:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iSnooker.INI [2010.01.24 04:36:49 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2010.01.13 20:29:00 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2010.01.13 20:29:00 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2010.01.13 20:29:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2010.01.13 20:29:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2010.01.13 20:29:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2010.01.13 20:29:00 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2010.01.13 11:07:03 | 000,000,035 | ---- | C] () -- C:\WINDOWS\DevCap.ini [2009.12.31 04:22:53 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini [2009.12.31 04:21:49 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDE D78DEFGIPS.ini [2009.11.19 18:06:36 | 000,000,071 | ---- | C] () -- C:\WINDOWS\Crypkey.ini [2009.11.19 18:06:33 | 000,031,846 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys [2009.11.19 18:06:33 | 000,018,432 | ---- | C] () -- C:\WINDOWS\Setup_ck.dll [2009.11.14 04:23:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll [2009.09.20 13:29:04 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI [2009.07.16 07:22:39 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini [2009.06.21 18:03:37 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8BE05FA < End of report > Natürlich auch dir und allen anderen hier: Danke, dass ihr uns helft. |
|
30.05.2010, 23:12
| #4 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Hi, da fährt noch einiges an Malware herum, u.a. ein Rootkit. Lade mal bitte folgende Dateien einzeln bei Virustotal.com zur Auswertung hoch: C:\WINDOWS\System32\d3d9caps.dat C:\WINDOWS\System32\drivers\wggufgup.sys C:\WINDOWS\System32\wjxurjwdaattf.exe C:\WINDOWS\Btigaa.exe C:\WINDOWS\System32\sqaticxi.dll C:\WINDOWS\System32\goebfbjd.exe Poste mir dann bitte jeweils den Link. |
|
30.05.2010, 23:22
| #5 |
| | Antispyware soft erfolgreich entfernt? Hoffe, das funktioniert denn mal hxxp://www.virustotal.com/analisis/5604146c90c834bedca093b20c13ac6c10348bd7f6ff4070f4554d9497fbc405-1275258032 Bei 2. Datei kam folgendes: hxxp://www.virustotal.com/vt/en/recepcion?5b98b81af0ed59848ca1e3c31c0be7c1 hxxp://www.virustotal.com/analisis/73978e071f4726954c7fe11e7d7e67b6eb1e39a3ca5504eb6f8843536a30d16a-1275238571 hxxp://www.virustotal.com/analisis/f1416efabbe550678951ef4c6c5bebd527a6a812438ed086392aa90768d41a25-1275258758 Bei C:\WINDOWS\System32\sqaticxi.dll wird ein Server- Error gemeldet Und das ist die letzte: hxxp://www.virustotal.com/analisis/acc07505fd7ef82d0212487138db01bc0985c18fd6d82dd9e492de74fac49893-1275238350 Warum hab ich schon eine Ahnung, was du antworten wirst??? hxxp://www.trojaner-board.de/images/icons/icon8.gif |
|
31.05.2010, 10:34
| #6 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Hi, ok, lass mal bitte einen Rootkitscan durchlaufen: Rootkit-Suche Was sind Rootkits? Einige Scans auf Dateien, Prozesse u2nd Registryeinträge, die vor den meisten anderen Scannern versteckt werden (durch ein sogenanntes Rootkit). Während dieser Scans soll(en):
__________________ --> Antispyware soft erfolgreich entfernt? |
|
31.05.2010, 12:40
| #7 |
| | Antispyware soft erfolgreich entfernt? Hi. OK werde das später mal wenn ich Windoof gestartet habe, machen. Nur noch eine Frage: Wenn die Meldung kommt, heißt das wohl Format C:, oder? |
|
31.05.2010, 13:10
| #8 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Die hier? Code:
ATTFilter WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?
Unbedingt auf "No" klicken.
|
|
31.05.2010, 16:52
| #10 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Hm, das Log ist weg. Evtl. nochmal mit GMER scannen oder: Rootkit-Suche mit Sophos Anti-Rootkit Wichtig: Bei jedem Rootkit-Scans soll/en:
|
|
01.06.2010, 03:16
| #11 |
| | Antispyware soft erfolgreich entfernt? So. Habe nun nochmal gescannt. Wieder keine Meldung. Hier nun der Log: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-01 04:05:30
Windows 5.1.2600 Service Pack 3
Running: gmer rootkitfinder.exe; Driver: C:\DOCUME~1\Penner\LOCALS~1\Temp\kxacykog.sys
---- System - GMER 1.0.15 ----
SSDT BAF1CF5E ZwCreateKey
SSDT BAF1CF54 ZwCreateThread
SSDT BAF1CF63 ZwDeleteKey
SSDT BAF1CF6D ZwDeleteValueKey
SSDT BAF1CF8B ZwLoadDriver
SSDT BAF1CF72 ZwLoadKey
SSDT BAF1CF40 ZwOpenProcess
SSDT BAF1CF45 ZwOpenThread
SSDT BAF1CF7C ZwReplaceKey
SSDT BAF1CF77 ZwRestoreKey
SSDT BAF1CF90 ZwSetSystemInformation
SSDT BAF1CF68 ZwSetValueKey
SSDT BAF1CF4F ZwTerminateProcess
---- EOF - GMER 1.0.15 ----
|
|
01.06.2010, 10:24
| #12 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Hi, sieht gut aus. Wir entfernen jetzt mit OTL die u.a. die sechs Dateien, die Du vorher ausgewertet hast. Die sind mit großer Wahrscheinlichkeit Malware(-Spuren). 1.) Fixen mit OTL
Code:
ATTFilter :OTL
DRV - (wggufgup) -- C:\WINDOWS\system32\drivers\wggufgup.sys ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
O2 - BHO: (moigh Object) - {15D85275-5ED8-4985-9CA4-B86C94DA6F43} - C:\WINDOWS\system32\sqaticxi.dll ()
O2 - BHO: (voguecash browser enhancer) - {4E87C27C-4BDE-98F5-1F99-482D1CE17DAA} - C:\WINDOWS\System32\jlvbkzbqgw.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [GEST] File not found
O4 - HKLM..\Run: [MChk] C:\WINDOWS\system32\goebfbjd.exe ()
O4 - HKLM..\Run: [skb] File not found
:files
C:\Documents and Settings\Penner\Local Settings\Application Data\wbedsgorq
C:\WINDOWS\System32\d3d9caps.dat
C:\WINDOWS\System32\drivers\wggufgup.sys
C:\WINDOWS\System32\wjxurjwdaattf.exe
C:\WINDOWS\Btigaa.exe
C:\WINDOWS\System32\sqaticxi.dll
C:\WINDOWS\System32\goebfbjd.exe
:Commands
[emptytemp]
[resethosts]
[reboot]
2.) Scan mit SystemLook Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
|
|
01.06.2010, 14:02
| #13 |
| | Antispyware soft erfolgreich entfernt? Ok. Danke für deine Anleitung. Alleine hätte ich warscheinlich mehr Probleme gehabt. Hier der LOG von OTL nach Reboot: All processes killed Error: Unable to interpret <DRV - (wggufgup) -- C:\WINDOWS\system32\drivers\wggufgup.sys ()> in the current context! Error: Unable to interpret <IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555> in the current context! Error: Unable to interpret <O2 - BHO: (moigh Object) - {15D85275-5ED8-4985-9CA4-B86C94DA6F43} - C:\WINDOWS\system32\sqaticxi.dll ()> in the current context! Error: Unable to interpret <O2 - BHO: (voguecash browser enhancer) - {4E87C27C-4BDE-98F5-1F99-482D1CE17DAA} - C:\WINDOWS\System32\jlvbkzbqgw.dll File not found> in the current context! Error: Unable to interpret <O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [GEST] File not found> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [MChk] C:\WINDOWS\system32\goebfbjd.exe ()> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [skb] File not found> in the current context! ========== FILES ========== C:\Documents and Settings\Penner\Local Settings\Application Data\wbedsgorq folder moved successfully. C:\WINDOWS\System32\d3d9caps.dat moved successfully. C:\WINDOWS\System32\drivers\wggufgup.sys moved successfully. C:\WINDOWS\System32\wjxurjwdaattf.exe moved successfully. C:\WINDOWS\Btigaa.exe moved successfully. C:\WINDOWS\System32\sqaticxi.dll moved successfully. C:\WINDOWS\System32\goebfbjd.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 646322 bytes ->Temporary Internet Files folder emptied: 4392165 bytes ->FireFox cache emptied: 3012195 bytes ->Apple Safari cache emptied: 56916 bytes ->Flash cache emptied: 796 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 41 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 2480808 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 1568631 bytes ->Flash cache emptied: 1430 bytes User: Penner ->Temp folder emptied: 4748919924 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 67714884 bytes ->FireFox cache emptied: 56867437 bytes ->Google Chrome cache emptied: 6045668 bytes ->Apple Safari cache emptied: 666533623 bytes ->Flash cache emptied: 162982 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1138618 bytes %systemroot%\System32 .tmp files removed: 2894353 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 79300541 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 101367 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 134 bytes RecycleBin emptied: 4304329306 bytes Total Files Cleaned = 9.485,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.1 log created on 06012010_145037 Files\Folders moved on Reboot... Muss ich mir wegen der Error- Meldungen Sorgen machen??? |
|
01.06.2010, 23:03
| #14 |
| /// Helfer-Team | Antispyware soft erfolgreich entfernt? Hi, hast beim OTL-Fix das ":OTL" am Anfang mitkopiert? Bitte nachholen, dann kommen auch nicht diese Fehlermeldungen. |
|
02.06.2010, 23:13
| #15 |
| | Antispyware soft erfolgreich entfernt? Hi. STLB. Hatte leider erst jetzt Zeit, das zu tun All processes killed ========== OTL ========== Error: No service named wggufgup was found to stop! Service\Driver key wggufgup not found. File C:\WINDOWS\system32\drivers\wggufgup.sys not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15D85275-5ED8-4985-9CA4-B86C94DA6F43}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15D85275-5ED8-4985-9CA4-B86C94DA6F43}\ not found. File C:\WINDOWS\system32\sqaticxi.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E87C27C-4BDE-98F5-1F99-482D1CE17DAA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E87C27C-4BDE-98F5-1F99-482D1CE17DAA}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\GEST not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MChk not found. File C:\WINDOWS\system32\goebfbjd.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\skb not found. ========== FILES ========== File\Folder C:\Documents and Settings\Penner\Local Settings\Application Data\wbedsgorq not found. File\Folder C:\WINDOWS\System32\d3d9caps.dat not found. File\Folder C:\WINDOWS\System32\drivers\wggufgup.sys not found. File\Folder C:\WINDOWS\System32\wjxurjwdaattf.exe not found. File\Folder C:\WINDOWS\Btigaa.exe not found. File\Folder C:\WINDOWS\System32\sqaticxi.dll not found. File\Folder C:\WINDOWS\System32\goebfbjd.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: Penner ->Temp folder emptied: 936949 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Apple Safari cache emptied: 1868564 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 108802 bytes Total Files Cleaned = 3,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.1 log created on 06022010_141744 Files\Folders moved on Reboot... Registry entries deleted on Reboot... Leider habe ich jetzt das Problem, dass die CPU Usage konstant bei 30 und mehr Prozent liegt, ohne, dass eine Anwendung. Die Sanduhr neben dem Cursor leuchtet durchgehend auf, aber der PC arbeitet einwandfrei ohne Geschwindigkeits- und Qualitätsverlust. |
|
| Themen zu Antispyware soft erfolgreich entfernt? |
| 32 bit, adware.adrotator, adware.ezlife, adware.gamespyarcade, adware.mywebsearch, anti-malware, antispyware, avsuite, bot, browser, cleansweep.exe, data, dateien, entfernt?, explorer, festgestellt, handle, helper, hochfahren, log, mbam, microsoft, neustart, service pack 3, services, soft, software, system, system32, temp, trojan.agent, trojan.downloader, trojan.fakealert, ubuntu |
Textbox.
.
