| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Spy.Gen / Antimalware Doctor / Browser wird geHIJACKt & neue Viren geladenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
08.06.2010, 14:10
| #1 |
 |  TR/Spy.Gen / Antimalware Doctor / Browser wird geHIJACKt & neue Viren geladen Hi, ich war neulich auf einer Webseite unterwegs auf der plötzlich verschiedene Fenster aufgingen die mich dazu zwingen wollten eine neue Version von Java runter zu laden. Als schlauer Internetnutzer bin ich natürlich misstrauisch geworden und wollte die Fenster und die Seite schließen, allerdings hat sich der Browser aufgehängt und ich musste ihn im Task manager beenden. Als bald bekam ich die typischen Probleme von Antimalware Doctor. Über google kam ich an eine anleitung aus diesem Forum mit deren hilfe ich den Doctor vermutlich losgeworden bin. Allerdings habe ich immer noch Probleme mit Viren. AUsserdem wird mein Browser (Firefox) des öfteren auf andere Seiten geleitet. Ausserdem funktionieren seit einiger Zeit weder Windows Updates, noch Updates des Windows defenders. Soviel erstmal zu meinem Problem. Im folgenden Infos zu meinem System, ein Scan von OTL und 2 von SuperAntiSpyware. Einer direkt nachdem ich den Malware Doctor hatte und einen von heute morgen. Ausserdem 3 Screenshots meines geHIJACKten Browsers Code:
ATTFilter Betriebssystemname Microsoft® Windows Vista™ Home Premium
Version 6.0.6002 Service Pack 2 Build 6002
Zusätzliche Betriebssystembeschreibung Nicht verfügbar
Betriebssystemhersteller Microsoft Corporation
Systemname ***
Systemhersteller System manufacturer
Systemmodell System Product Name
Systemtyp X86-basierter PC
Prozessor Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz, 2133 MHz, 2 Kern(e), 2 logische(r) Prozessor(en)
BIOS-Version/-Datum Phoenix Technologies, LTD ASUS P5N-E SLI ACPI BIOS Revision 0505, 05.03.2007
SMBIOS-Version 2.4
Windows-Verzeichnis C:\Windows
Systemverzeichnis C:\Windows\system32
Startgerät \Device\HarddiskVolume1
Gebietsschema Deutschland
Hardwareabstraktionsebene Version = "6.0.6002.18005"
Benutzername ***
Zeitzone Mitteleuropäische Sommerzeit
Installierter physikalischer Speicher (RAM) 2,00 GB
Gesamter realer Speicher 2,00 GB
Verfügbarer realer Speicher 951 MB
Gesamter virtueller Speicher 4,23 GB
Verfügbarer virtueller Speicher 2,76 GB
Größe der Auslagerungsdatei 2,29 GB
Auslagerungsdatei C:\pagefile.sys
Code:
ATTFilter OTL logfile created on: 08.06.2010 12:23:21 - Run 2 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Carso\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 39,08 Gb Total Space | 4,22 Gb Free Space | 10,79% Space Free | Partition Type: NTFS Drive D: | 129,56 Gb Total Space | 58,90 Gb Free Space | 45,46% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive J: | 129,45 Gb Total Space | 49,22 Gb Free Space | 38,02% Space Free | Partition Type: NTFS Drive L: | 931,51 Gb Total Space | 797,19 Gb Free Space | 85,58% Space Free | Partition Type: NTFS Computer Name: *** Current User Name: *** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 60 Days Output = Minimal ========== Processes (SafeList) ========== PRC - D:\SuperAntiSpyWare\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com) PRC - C:\Users\Carso\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - D:\Kalenderchen\Kalenderchen.exe (Daniel Manger Software) ========== Modules (SafeList) ========== MOD - C:\Users\Carso\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH) SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH) SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (AcrSch2Svc) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (de_serv) -- C:\Programme\Common Files\AVM\De_serv.exe (AVM Berlin) ========== Driver Services (SafeList) ========== DRV - (SASKUTIL) -- D:\SuperAntiSpyWare\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (SASDIFSV) -- D:\SuperAntiSpyWare\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (taphss) -- C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc) DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (RMCAST) RMCAST (Pgm) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (Cdralw2k) -- C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions) DRV - (61883) -- C:\Windows\System32\drivers\61883.sys (Microsoft Corporation) DRV - (Avc) -- C:\Windows\System32\drivers\avc.sys (Microsoft Corporation) DRV - (MSDV) -- C:\Windows\System32\drivers\msdv.sys (Microsoft Corporation) DRV - (MSTAPE) -- C:\Windows\System32\drivers\mstape.sys (Microsoft Corporation) DRV - (AVCSTRM) -- C:\Windows\System32\drivers\avcstrm.sys (Microsoft Corporation) DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.) DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.) DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.) DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.) DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation) DRV - (timounter) -- C:\Windows\system32\DRIVERS\timntr.sys (Acronis) DRV - (tifsfilter) -- C:\Windows\System32\drivers\tifsfilt.sys (Acronis) DRV - (snapman) -- C:\Windows\system32\DRIVERS\snapman.sys (Acronis) DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (sonypvs1) -- C:\Windows\System32\drivers\sonypvs1.sys (Sony Corporation) DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.openintab: true FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/" FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7 FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0 FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8 FF - prefs.js..extensions.enabledItems: {8620c15f-30dc-4dba-a131-7c5d20cf4a29}:2.0.3 FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.4 FF - prefs.js..network.proxy.autoconfig_url: "file:///C:/Users/Carso/AppData/Local/RapidSolution/Videoraptor/WebRip/profile/rrproxy_ffox_4984e93c.pac" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: D:\RealPlayer\browserrecord [2008.01.29 15:43:59 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.05.08 15:16:44 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.21 21:05:46 | 000,000,000 | ---D | M] [2008.08.31 15:50:47 | 000,000,000 | ---D | M] -- C:\Users\Carso\AppData\Roaming\mozilla\Extensions [2010.06.07 22:32:11 | 000,000,000 | ---D | M] -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions [2009.09.02 16:46:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.01.25 21:09:30 | 000,000,000 | ---D | M] (Nightly Tester Tools) -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions\{8620c15f-30dc-4dba-a131-7c5d20cf4a29} [2010.01.25 21:09:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2009.12.18 13:29:15 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8} [2010.01.25 21:08:59 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\Carso\AppData\Roaming\mozilla\Firefox\Profiles\ahsvcjx6.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca} [2010.06.07 22:32:11 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DMS-Kalenderchen] D:\Kalenderchen\Kalenderchen.exe (Daniel Manger Software) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [SUPERAntiSpyware] D:\SuperAntiSpyWare\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - J:\poker\PartyPoker\RunApp.exe File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - J:\poker\PartyPoker\RunApp.exe File not found O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ6.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Users\Carso\AppData\Roaming\sdra64.exe) - C:\Users\Carso\AppData\Roaming\sdra64.exe File not found O20 - Winlogon\Notify\!SASWinLogon: DllName - D:\SuperAntiSpyWare\SASWINLO.dll - D:\SuperAntiSpyWare\SASWINLO.dll (SUPERAntiSpyware.com) O22 - SharedTaskScheduler: {da3b49f6-8c54-4429-a275-21a86dcca413} - admissibility - Reg Error: Key error. File not found O24 - Desktop WallPaper: D:\Kalenderchen\hgdesktop.bmp O24 - Desktop BackupWallPaper: D:\Kalenderchen\hgdesktop.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\SuperAntiSpyWare\SASSEH.DLL (SuperAdBlocker.com) O30 - LSA: Authentication Packages - (relog_ap) - C:\Windows\System32\relog_ap.dll (Acronis) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{78d3952b-0adf-11dc-a949-00040effffff}\Shell\Open(0)\command - "" = K:\Recycled\ctfmon.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk /r \??\K:) - File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: chkdinst - (C:\Windows\system32\cmstNAME.dll) - C:\Windows\System32\cmstNAME.dll File not found O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 60 Days ========== [2010.06.08 03:13:46 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.06.04 18:17:05 | 000,000,000 | ---D | C] -- C:\Users\Carso\Downloads\Crazy Browser [2010.05.18 17:32:20 | 000,000,000 | -HSD | C] -- C:\Users\Carso\AppData\Roaming\lowsec [2010.05.17 23:07:28 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll [2010.05.17 23:07:28 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll [2010.05.17 23:07:27 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll [2010.05.16 15:39:41 | 000,000,000 | ---D | C] -- C:\Users\Carso\AppData\Roaming\LolClient [2010.05.07 20:30:34 | 000,000,000 | ---D | C] -- C:\Users\Carso\AppData\Local\Activision [2010.05.05 23:09:01 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DivX Shared [2010.05.05 23:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX [2010.05.05 23:07:26 | 001,180,952 | ---- | C] (DivX, Inc. ) -- C:\Users\Carso\Downloads\DivXInstaller.exe [2010.05.03 13:06:44 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2010.05.03 13:06:36 | 000,000,000 | ---D | C] -- C:\Users\Carso\AppData\Roaming\SUPERAntiSpyware.com [2010.05.03 12:42:47 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Users\Carso\Desktop\OTL.exe [2010.05.02 20:31:11 | 000,000,000 | ---D | C] -- C:\Users\Carso\AppData\Roaming\Malwarebytes [2010.05.02 20:30:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.05.02 20:30:53 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.05.02 20:30:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.05.02 18:58:57 | 006,153,648 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Carso\Downloads\herbert-setup.exe [2010.05.02 17:10:38 | 000,000,000 | ---D | C] -- C:\Users\Carso\AppData\Roaming\BA7DEBABCC77DDAA9D3B4E471F112208 [2010.04.28 17:23:33 | 000,000,000 | ---D | C] -- C:\Users\Carso\Downloads\%userprofile% [2010.04.27 00:04:42 | 000,353,592 | ---- | C] (DivX, Inc.) -- C:\Windows\System32\DivXControlPanelApplet.cpl [2010.04.21 21:38:25 | 000,000,000 | ---D | C] -- C:\Users\Carso\Downloads\GTA San Andreas User Files [2010.04.21 04:55:28 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [2010.04.14 15:52:07 | 003,600,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.04.14 15:52:07 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.04.14 15:52:04 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.04.14 15:51:48 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010.04.14 15:51:48 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [3 C:\Users\Carso\Desktop\*.tmp files -> C:\Users\Carso\Desktop\*.tmp -> ] ========== Files - Modified Within 60 Days ========== [2010.06.08 12:26:04 | 005,505,024 | ---- | M] () -- C:\Users\Carso\ntuser.dat [2010.06.08 12:25:28 | 000,823,808 | ---- | M] () -- C:\Windows\System32\drivers\bgcctfx.sys [2010.06.08 12:25:11 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{4318E496-D163-410D-9ABB-89E26924B160}.job [2010.06.08 12:19:39 | 001,418,612 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.06.08 12:19:39 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.06.08 12:19:39 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.06.08 12:19:39 | 000,122,442 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.06.08 12:19:39 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.06.08 12:17:31 | 000,001,022 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2010.06.08 12:16:03 | 000,245,596 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.06.08 12:16:00 | 000,245,596 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.06.08 12:15:04 | 000,000,500 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job [2010.06.08 12:14:56 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.06.08 12:14:56 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.06.08 12:14:55 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.06.08 12:14:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.06.08 12:11:38 | 000,524,288 | -HS- | M] () -- C:\Users\Carso\ntuser.dat{a1e6e1b3-2616-11de-a110-001a92821b19}.TMContainer00000000000000000001.regtrans-ms [2010.06.08 12:11:38 | 000,065,536 | -HS- | M] () -- C:\Users\Carso\ntuser.dat{a1e6e1b3-2616-11de-a110-001a92821b19}.TM.blf [2010.06.08 12:11:36 | 004,116,005 | -H-- | M] () -- C:\Users\Carso\AppData\Local\IconCache.db [2010.06.07 14:49:09 | 000,093,696 | ---- | M] () -- C:\Users\Carso\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.07 13:28:37 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2010.06.07 02:19:46 | 000,000,474 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2010.06.03 23:59:54 | 000,022,224 | ---- | M] () -- C:\Users\Carso\Desktop\Protokoll_01_02_2010.pdf [2010.06.03 23:59:47 | 000,019,331 | ---- | M] () -- C:\Users\Carso\Desktop\Protokoll_01_02_2010.doc [2010.05.29 16:53:14 | 000,002,379 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2010.05.27 23:50:12 | 000,004,804 | ---- | M] () -- C:\Users\Carso\Downloads\torrentdownloads net Sucking On Her Clit - A Guide That Will Teach You How To Make Her Clitoris Cum Like Crazy.torrent [2010.05.27 23:47:49 | 000,011,743 | ---- | M] () -- C:\Users\Carso\Downloads\torrentdownloads net Wolfgang & Heike Hohlbein Märchenmond Hoerbuch (German).torrent [2010.05.27 19:00:35 | 000,008,944 | ---- | M] () -- C:\Users\Carso\Desktop\Aufgabenblatt3.pdf [2010.05.26 13:48:26 | 000,000,150 | ---- | M] () -- C:\Windows\System32\ImportDF.ini [2010.05.17 22:47:12 | 000,000,277 | ---- | M] () -- C:\Windows\VideodeLuxe.INI [2010.05.17 14:59:26 | 000,025,088 | ---- | M] () -- C:\Users\Carso\Downloads\Sprechstundenliste.xls [2010.05.05 23:07:31 | 001,180,952 | ---- | M] (DivX, Inc. ) -- C:\Users\Carso\Downloads\DivXInstaller.exe [2010.05.04 16:14:31 | 000,071,168 | ---- | M] () -- C:\Users\Carso\Downloads\chall_für_MPs.xls [2010.05.03 13:06:37 | 000,000,567 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010.05.03 12:47:19 | 008,050,208 | ---- | M] () -- C:\Users\Carso\Downloads\SUPERAntiSpyware.exe [2010.05.03 12:42:50 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Carso\Desktop\OTL.exe [2010.05.03 00:45:24 | 000,335,069 | ---- | M] () -- C:\Users\Carso\Downloads\plugin-Aufgabenblatt_1_Montag.pdf [2010.05.02 19:22:41 | 000,363,520 | ---- | M] () -- C:\Users\Carso\Downloads\rkill.com [2010.05.02 19:22:41 | 000,363,520 | ---- | M] () -- C:\Users\Carso\Desktop\rkill.com [2010.05.02 18:59:08 | 006,153,648 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Carso\Downloads\herbert-setup.exe [2010.05.02 04:43:43 | 000,000,398 | ---- | M] () -- C:\Users\Carso\Downloads\LauncherFix.zip [2010.04.29 20:10:48 | 000,523,712 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.04.29 18:07:31 | 000,000,016 | ---- | M] () -- C:\Users\Carso\AppData\Roaming\wzmjhy.dat [2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.28 18:02:52 | 000,000,653 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends.lnk [2010.04.28 17:23:22 | 001,302,136 | ---- | M] () -- C:\Users\Carso\Downloads\loleudownloader.exe [2010.04.27 00:04:42 | 000,353,592 | ---- | M] (DivX, Inc.) -- C:\Windows\System32\DivXControlPanelApplet.cpl [2010.04.14 23:11:35 | 013,707,362 | ---- | M] () -- C:\Users\Carso\Downloads\PC-Installer.zip [2010.04.14 20:48:06 | 000,136,187 | ---- | M] () -- C:\Users\Carso\Desktop\CHATROULETTE-BINGO-BOARD.jpg [2010.04.12 05:47:15 | 000,091,937 | ---- | M] () -- C:\Users\Carso\Desktop\polen.jpg [2010.04.11 04:14:58 | 000,000,599 | ---- | M] () -- C:\Windows\ULead32.ini [2010.04.09 15:02:38 | 000,005,125 | ---- | M] () -- C:\Users\Carso\Desktop\1-2b404e8d6149ef0d.jpg [2010.04.09 14:11:04 | 000,160,644 | ---- | M] () -- C:\Users\Carso\Desktop\Mobilfunkantrag_56266.pdf [3 C:\Users\Carso\Desktop\*.tmp files -> C:\Users\Carso\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.06.03 23:28:51 | 000,019,331 | ---- | C] () -- C:\Users\Carso\Desktop\Protokoll_01_02_2010.doc [2010.06.03 23:27:06 | 000,022,224 | ---- | C] () -- C:\Users\Carso\Desktop\Protokoll_01_02_2010.pdf [2010.05.27 19:00:35 | 000,008,944 | ---- | C] () -- C:\Users\Carso\Desktop\Aufgabenblatt3.pdf [2010.05.26 13:48:26 | 000,000,150 | ---- | C] () -- C:\Windows\System32\ImportDF.ini [2010.05.17 14:59:26 | 000,025,088 | ---- | C] () -- C:\Users\Carso\Downloads\Sprechstundenliste.xls [2010.05.04 16:14:30 | 000,071,168 | ---- | C] () -- C:\Users\Carso\Downloads\chall_für_MPs.xls [2010.05.03 13:06:37 | 000,000,567 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010.05.03 12:46:58 | 008,050,208 | ---- | C] () -- C:\Users\Carso\Downloads\SUPERAntiSpyware.exe [2010.05.03 12:29:22 | 000,363,520 | ---- | C] () -- C:\Users\Carso\Desktop\rkill.com [2010.05.03 00:45:13 | 000,335,069 | ---- | C] () -- C:\Users\Carso\Downloads\plugin-Aufgabenblatt_1_Montag.pdf [2010.05.02 19:22:39 | 000,363,520 | ---- | C] () -- C:\Users\Carso\Downloads\rkill.com [2010.05.02 17:11:30 | 000,823,808 | ---- | C] () -- C:\Windows\System32\drivers\bgcctfx.sys [2010.05.02 04:43:42 | 000,000,398 | ---- | C] () -- C:\Users\Carso\Downloads\LauncherFix.zip [2010.04.29 18:07:06 | 000,000,016 | ---- | C] () -- C:\Users\Carso\AppData\Roaming\wzmjhy.dat [2010.04.28 18:02:52 | 000,000,653 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends.lnk [2010.04.28 17:23:19 | 001,302,136 | ---- | C] () -- C:\Users\Carso\Downloads\loleudownloader.exe [2010.04.14 23:11:16 | 013,707,362 | ---- | C] () -- C:\Users\Carso\Downloads\PC-Installer.zip [2010.04.14 20:48:06 | 000,136,187 | ---- | C] () -- C:\Users\Carso\Desktop\CHATROULETTE-BINGO-BOARD.jpg [2010.04.12 05:47:14 | 000,091,937 | ---- | C] () -- C:\Users\Carso\Desktop\polen.jpg [2010.04.09 15:02:38 | 000,005,125 | ---- | C] () -- C:\Users\Carso\Desktop\1-2b404e8d6149ef0d.jpg [2010.04.09 14:11:03 | 000,160,644 | ---- | C] () -- C:\Users\Carso\Desktop\Mobilfunkantrag_56266.pdf [2009.10.26 13:42:08 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.05.21 16:06:27 | 000,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2009.02.09 01:14:50 | 000,000,086 | ---- | C] () -- C:\Windows\EmperorEdit.INI [2009.01.27 18:17:22 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll [2009.01.27 18:17:11 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll [2009.01.27 17:10:42 | 000,002,856 | ---- | C] () -- C:\Windows\mgxoschk.ini [2009.01.23 02:38:54 | 000,000,073 | ---- | C] () -- C:\Windows\maplev4.ini [2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest [2008.10.07 18:07:43 | 000,000,374 | ---- | C] () -- C:\Windows\capture.ini [2008.09.06 19:21:42 | 000,003,654 | ---- | C] () -- C:\Windows\System32\drivers\Sonyhcp.dll [2008.06.18 15:59:56 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2007.11.13 22:31:59 | 000,000,023 | ---- | C] () -- C:\Windows\SLAY.INI [2007.10.30 23:28:54 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2007.10.30 00:24:52 | 000,001,414 | ---- | C] () -- C:\Windows\disney.ini [2007.06.11 22:23:52 | 000,000,277 | ---- | C] () -- C:\Windows\VideodeLuxe.INI [2007.06.04 21:06:58 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit.INI [2007.05.20 15:28:49 | 000,034,308 | ---- | C] () -- C:\Windows\System32\Chip.dll [2007.05.14 14:49:33 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.05.10 16:16:03 | 000,000,599 | ---- | C] () -- C:\Windows\ULead32.ini [2007.05.08 15:10:28 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI [2007.05.08 15:10:27 | 000,000,000 | ---- | C] () -- C:\Windows\NSREX.INI [2007.04.16 09:03:57 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys [2007.04.16 09:03:55 | 000,012,231 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2007.04.16 09:03:47 | 000,010,288 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:1247C505 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:8173A019 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:ECF5194F < End of report > |
| Themen zu TR/Spy.Gen / Antimalware Doctor / Browser wird geHIJACKt & neue Viren geladen |
| 0x00000001, acroiehelper.dll, ad-aware, alternate, antivir, aufgehängt, avgntflt.sys, avira, bho, bonjour, browser, components, corp./icp, cpu, error, firefox, firefox 3.6.3, firefox.exe, fontcache, format, google, home, immer noch probleme, internet, location, logfile, mozilla, neue version, nvlddmkm.sys, nvstor.sys, oldtimer, otl logfile, otl.exe, otl.txt, physikalischer speicher, plug-in, programdata, realtek, registry, scan, sched.exe, searchplugins, software, sptd.sys, system, updates, viren, windows, windows updates |
Baum-Darstellung