| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRAWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.08.2010, 17:21
| #31 |
 |  AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Habe beide Schritte ausgefuehrt. Habe nun einen Ordner auf dem Desktop namens Infected. Dort sind die 3 Dateien drin die er laut bat Datei kopieren sollte. Hier der Text aus dem Bat Fenster 1 file(s) copied. 1 file(s) copied. 1 file(s) copied. Insert the diskette that contains the batch file and press any key when ready. Nun die OTL.txt file created on: 8/6/2010 8:17:23 PM - Run OTLPE by OldTimer - Version 3.1.40.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 30.00 Gb Total Space | 12.68 Gb Free Space | 42.29% Space Free | Partition Type: NTFS Drive D: | 30.00 Gb Total Space | 25.98 Gb Free Space | 86.61% Space Free | Partition Type: NTFS Drive E: | 1337.26 Gb Total Space | 526.50 Gb Free Space | 39.37% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: | 433.24 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard Using ControlSet: ControlSet002 ========== Custom Scans ========== < MD5 for: DMIO.SYS > [2006/02/28 08:00:00 | 000,154,112 | ---- | M] (Microsoft Corp., Veritas Software) MD5=084EB0A50A4F7B4705C8A57F234E5291 -- C:\WINDOWS\$NtServicePackUninstall$\dmio.sys [2008/04/14 01:28:20 | 000,154,112 | ---- | M] () MD5=0978B034C116BCB51C5BE583F29074B8 -- C:\WINDOWS\system32\drivers\dmio.sys [2008/04/14 01:28:20 | 000,154,112 | ---- | M] (Microsoft Corp., Veritas Software) MD5=53720AB12B48719D00E327DA470A619A -- C:\WINDOWS\ServicePackFiles\i386\dmio.sys < End of report > |
|
06.08.2010, 18:53
| #32 |
| /// Selecta Jahrusso   | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Sehr gut
__________________ Schritt 1 Hab ich was übersehen. Bitte folgende Datei manuell in den Ordner Infected Kopieren. C:\WINDOWS\ExplorerSrv.exe Die Datei dann im Ordner Infected in ExplorerSrv.exe.vir umbenennen. Nun rechtsklick auf den Ordner, 7zip (sollte vorhanden sein) und auf add to infected.zip klicken. Schritt 2
Code:
ATTFilter :OTL
O4 - HKLM..\Run: [combofix] C:\Combo\CF13435.cfx File not found
O4 - HKU\MP.MEDIAPC.000_ON_C..\Run: [Sgoqisukinasule] C:\WINDOWS\dftsonp.DLL (MaresWEB)
O4 - HKLM..\RunOnce: [combofix] C:\Combo\CF13435.cfx File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O20 - HKLM Winlogon: UserInit - (c:\programme\microsoft\desktoplayer.exe) - c:\Programme\Microsoft\DesktopLayer.exe (SOFTWIN S.R.L.)
[2010/08/06 05:11:51 | 000,059,392 | ---- | C] (SOFTWIN S.R.L.) -- C:\WINDOWS\ExplorerSrv.exe
[2010/08/05 12:02:09 | 000,059,392 | ---- | C] (SOFTWIN S.R.L.) -- C:\WINDOWS\System32\controlSrv.exe
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\VDLL.DLL
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\runouce.exe
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\rundll16.exe
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\RUNDL132.EXE
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo1_.exe
[2010/08/01 19:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\logo_1.exe
[2009/08/16 10:52:26 | 000,060,416 | ---- | C] () -- C:\WINDOWS\System32\antiwpa.dll
:services
:files
C:\WINDOWS\System32\drivers\dmio.sys | C:\WINDOWS\$NtServicePackUninstall$\dmio.sys /replace
:reg
:Commands
[purity]
[emptytemp]
[reboot]
Schritt 3 Der Rechner sollte nun wieder booten. Berichte bitte
__________________ |
|
07.08.2010, 01:00
| #33 |
| | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA So.
__________________Schritte ausgeführt. Windows startet wieder. Hier das OTL Log ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\combofix deleted successfully. Registry value HKEY_USERS\MP.MEDIAPC.000_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\Sgoqisukinasule deleted successfully. C:\WINDOWS\dftsonp.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\combofix deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:c:\programme\microsoft\desktoplayer.exe deleted successfully. c:\Programme\Microsoft\DesktopLayer.exe moved successfully. C:\WINDOWS\ExplorerSrv.exe moved successfully. C:\WINDOWS\system32\controlSrv.exe moved successfully. C:\WINDOWS\VDLL.DLL folder moved successfully. C:\WINDOWS\System32\runouce.exe folder moved successfully. C:\WINDOWS\rundll16.exe folder moved successfully. C:\WINDOWS\RUNDL132.EXE folder moved successfully. C:\WINDOWS\logo1_.exe folder moved successfully. C:\WINDOWS\logo_1.exe folder moved successfully. C:\WINDOWS\system32\antiwpa.dll moved successfully. ========== SERVICES/DRIVERS ========== ========== FILES ========== File C:\WINDOWS\System32\drivers\dmio.sys successfully replaced with C:\WINDOWS\$NtServicePackUninstall$\dmio.sys ========== REGISTRY ========== ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.MEDIAPC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: All Users.WINDOWS User: Default User User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT-AUTORITÄT ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT-AUTORITÄT.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Flash cache emptied: 0 bytes User: MP ->Temp folder emptied: 0 bytes ->Opera cache emptied: 7365176 bytes User: MP.MEDIAPC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: MP.MEDIAPC.000 ->Temp folder emptied: 95371 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 27673513 bytes ->Flash cache emptied: 0 bytes User: MP3D0B~1~MED User: MPMEDI~1~000 User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT-AUTORITÄT ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT-AUTORITÄT.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 6281896 bytes ->Flash cache emptied: 1092 bytes User: test ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes Total Files Cleaned = 40.00 mb OTLPE by OldTimer - Version 3.1.40.0 log created on 08072010_035240 |
|
07.08.2010, 10:22
| #34 |
| /// Selecta Jahrusso | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Schritt 1 CustomScan mit OTL Benenne bitte die OTL.exe in OTL.com um. Ignoriere die warnung
Code:
ATTFilter netsvcs
drivers32 /all
msconfig
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Schritt 2 Bitte
Bitte poste in Deiner nächsten Antwort OTL.txt Gmer.txt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
08.08.2010, 12:52
| #35 |
| | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA So, da ich gestern nicht zu Hause war, kommt leider jetzt erst meine Rueckmeldung. Habe die Schritte ausgefuehrt. Nach dem Umbenennen der OTL.exe in OTL.com und deren starten, wurde wieder eine OTLSRV.exe angelegt. Beim Ausfuehren der gmer.com Datei war dies nicht der Fall. anbei die beiden Logs. OTL file created on: 08.08.2010 14:15:32 - Run 2 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MFTools Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 86,00% Memory free 5,00 Gb Paging File | 5,00 Gb Available in Paging File | 92,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 30,00 Gb Total Space | 11,76 Gb Free Space | 39,20% Space Free | Partition Type: NTFS Drive D: | 30,00 Gb Total Space | 25,98 Gb Free Space | 86,61% Space Free | Partition Type: NTFS Drive E: | 1337,26 Gb Total Space | 526,50 Gb Free Space | 39,37% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MEDIAPC Current User Name: MP Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.08.04 11:37:17 | 000,635,904 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MFTools\OTL.com PRC - [2010.08.02 11:08:52 | 002,662,400 | ---- | M] (SoundGraph, Inc.) -- C:\Programme\SOUNDGRAPH\iMON\iMON.exe PRC - [2010.08.02 11:05:45 | 000,248,320 | ---- | M] () -- C:\Programme\DVBViewer TE2\SkystarIR.exe PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2009.11.19 19:41:24 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared files\brs.exe PRC - [2009.08.16 19:16:39 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe PRC - [2009.07.16 21:08:20 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe PRC - [2009.01.07 23:17:44 | 000,188,416 | ---- | M] (Team MediaPortal) -- D:\MediaPortal TV Server\TvService.exe PRC - [2008.11.25 08:31:10 | 029,263,712 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe PRC - [2008.11.25 08:31:07 | 000,239,968 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe PRC - [2008.11.24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe PRC - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2008.07.11 16:04:22 | 000,200,704 | ---- | M] () -- C:\WINDOWS\system\HsMgr.exe PRC - [2008.05.02 02:44:08 | 000,805,392 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe PRC - [2008.05.02 02:40:56 | 000,076,304 | ---- | M] (Logitech, Inc.) -- C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.07.24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe ========== Modules (SafeList) ========== MOD - [2010.08.04 11:37:17 | 000,635,904 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MFTools\OTL.com MOD - [2009.07.12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll MOD - [2008.08.14 15:39:28 | 000,217,088 | ---- | M] (C-Media Electronics Inc.) -- C:\WINDOWS\system\HsSrv.dll MOD - [2008.05.02 02:42:50 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPoint\lgscroll.dll MOD - [2008.04.14 07:52:16 | 000,072,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msacm32.dll MOD - [2008.04.14 07:52:10 | 000,367,616 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dsound.dll MOD - [2008.04.14 07:51:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - [2009.01.07 23:17:44 | 000,188,416 | ---- | M] (Team MediaPortal) [Auto | Running] -- D:\MediaPortal TV Server\TVService.exe -- (TVService) SRV - [2008.11.25 08:31:10 | 029,263,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) SRV - [2008.11.25 08:31:07 | 000,239,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2008.11.25 08:31:07 | 000,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) SRV - [2008.11.24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2008.05.02 02:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2007.07.24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\MPMEDI~1.000\LOKALE~1\Temp\catchme.sys -- (catchme) DRV - [2009.11.04 18:15:30 | 004,423,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2009.10.12 21:24:56 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Programme\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM) DRV - [2009.10.12 21:24:54 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009.10.12 21:24:52 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2009.08.28 19:36:24 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/12/07 21:07:36] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) DRV - [2009.08.19 14:05:56 | 000,100,368 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2009.08.16 22:09:12 | 000,003,026 | ---- | M] (Logix4u) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\hwinterface.sys -- (hwinterface) DRV - [2009.08.16 19:19:47 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd) DRV - [2008.10.07 15:54:10 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) DRV - [2008.09.01 19:44:26 | 001,983,424 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cmudaxp.sys -- (cmudaxp) DRV - [2008.04.14 00:51:02 | 000,162,816 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\netbt.sys -- (NetBT) DRV - [2008.04.14 00:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE) DRV - [2008.04.13 22:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008.02.29 03:13:36 | 000,079,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE) DRV - [2008.02.29 03:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2008.02.29 03:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2008.02.29 03:12:56 | 000,063,120 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou) DRV - [2008.02.29 03:12:48 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd) DRV - [2008.02.18 14:39:53 | 000,253,968 | R--- | M] (TechniSat Provide) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MtsBda.sys -- (MTSBDA) DRV - [2008.02.18 14:39:53 | 000,023,568 | R--- | M] (TechniSat Provide) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MtsHID.sys -- (MtsHID) DRV - [2008.01.03 16:10:16 | 000,105,856 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2007.10.12 03:40:12 | 000,009,096 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdide.sys -- (amdide) DRV - [2007.06.29 14:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AmdLLD.sys -- (AmdLLD) DRV - [2007.04.17 20:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\regi.sys -- (regi) DRV - [2006.07.01 23:30:28 | 000,043,520 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005.09.20 17:27:20 | 000,010,368 | ---- | M] (InterVideo, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iviaspi.sys -- (Iviaspi) DRV - [2004.12.22 15:51:06 | 000,018,090 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iMON_PAD.sys -- (SGIR) DRV - [2003.12.30 23:28:50 | 000,045,060 | ---- | M] (TG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TG_iMON.sys -- (SGHIDI) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Programme\Real\RealPlayer\browserrecord [2009.08.16 19:16:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2009.09.24 12:06:23 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.01 22:05:57 | 000,000,000 | ---D | M] [2009.09.24 12:06:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Mozilla\Extensions [2010.08.03 13:09:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Mozilla\Firefox\Profiles\irjily61.default\extensions [2009.10.06 18:19:38 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Mozilla\Firefox\Profiles\irjily61.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.08.03 13:09:11 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.08.01 22:05:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.08.01 22:05:46 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2009.08.24 21:25:19 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2009.08.24 21:25:19 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2009.08.24 21:25:19 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2009.08.24 21:25:19 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2009.08.24 21:25:19 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.08.05 12:40:54 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD) O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared files\brs.exe (cyberlink) O4 - HKLM..\Run: [Cmaudio8788GX] C:\WINDOWS\system\HsMgr.exe () O4 - HKLM..\Run: [iMON] C:\Programme\SOUNDGRAPH\iMON\iMON.exe (SoundGraph, Inc.) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Programme\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl8] C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [Sgoqisukinasule] C:\WINDOWS\dftsonp.DLL (CyberLink Corp.) O4 - Startup: C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Startmenü\Programme\Autostart\Verknüpfung mit SkystarIR.exe.lnk = C:\Programme\DVBViewer TE2\SkystarIR.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O15 - HKCU\..Trusted Domains: corel.com ([]http in Trusted sites) O15 - HKCU\..Trusted Domains: corel.com ([www] * in Trusted sites) O15 - HKCU\..Trusted Domains: intervideo.com ([]http in Trusted sites) O15 - HKCU\..Trusted Domains: intervideo.com ([www] * in Trusted sites) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250436985359 (WUWebControl Class) O16 - DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} hxxp://www.cyberlink.com/prog/aacs/UpdateAdvisor.cab (CUpdateAdvisorCtrl Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (c:\programme\microsoft\desktoplayer.exe) - c:\Programme\Microsoft\DesktopLayer.exe (SOFTWIN S.R.L.) O20 - HKLM Winlogon: UserInit - (c:\programme\java\jre6\bin\jqssrv.exe) - c:\Programme\Java\jre6\bin\jqsSrv.exe (SOFTWIN S.R.L.) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.dll - C:\Programme\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.01.17 23:26:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009.01.18 22:52:50 | 002,018,243 | ---- | M] () - C:\AutoHotkey104706_Install.exe -- [ NTFS ] O32 - AutoRun File - [2009.01.18 21:56:27 | 008,352,136 | ---- | M] (AutoIt Team) - C:\autoit-v3-setup.exe -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi7 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midi8 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation) Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer7 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: mixer8 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm () Drivers32: msacm.divxa32 - C:\WINDOWS\System32\DivXa32.acm (Hacked With Joy !) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation) Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation) Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIV3 - C:\WINDOWS\System32\DivXc32.dll (Hacked with Joy !) Drivers32: vidc.DIV4 - C:\WINDOWS\System32\DivXc32f.dll (Hacked with Joy !) Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation) Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation) Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll () Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation) Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave7 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wave8 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point (17465003472846848) ========== Files/Folders - Created Within 90 Days ========== [2010.08.07 09:52:45 | 000,552,960 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe [2010.08.07 09:52:40 | 000,000,000 | ---D | C] -- C:\_OTL [2010.08.07 03:57:14 | 000,059,392 | ---- | C] (SOFTWIN S.R.L.) -- C:\WINDOWS\ExplorerSrv.exe [2010.08.06 12:26:52 | 000,000,000 | ---D | C] -- C:\Combo [2010.08.05 12:23:40 | 000,000,000 | RHSD | C] -- C:\cmdcons [2010.08.05 12:20:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010.08.05 12:20:20 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010.08.05 12:20:20 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010.08.05 12:20:20 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010.08.05 11:58:50 | 000,000,000 | ---D | C] -- C:\Qoobox [2010.08.04 11:38:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010.08.04 11:37:23 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT [2010.08.04 11:32:20 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip [2010.08.04 11:28:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MFTools [2010.08.02 17:34:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\TrojanHunter [2010.08.02 16:38:45 | 000,000,000 | ---D | C] -- C:\Programme\TrojanHunter 5.3 [2010.08.02 10:38:46 | 000,000,000 | ---D | C] -- C:\Programme\riva1 [2010.08.02 01:31:28 | 000,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe [2010.08.02 01:31:25 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\MicroWorld [2010.08.02 01:31:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\MicroWorld [2010.08.02 01:02:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Spybot - Search & Destroy [2010.08.02 00:59:20 | 000,000,000 | ---D | C] -- C:\Programme\trend micro [2010.08.02 00:59:20 | 000,000,000 | ---D | C] -- C:\rsit [2010.08.02 00:05:56 | 000,000,000 | ---D | C] -- C:\$AVG [2010.08.02 00:05:27 | 000,000,000 | ---D | C] -- C:\Programme\AVG [2010.08.01 23:03:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\F-Secure [2010.08.01 22:28:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2010.08.01 22:06:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Sun [2010.08.01 22:06:08 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2010.08.01 22:05:42 | 000,000,000 | ---D | C] -- C:\Programme\Java [2010.08.01 21:18:36 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.08.01 21:18:35 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.08.01 21:18:35 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.08.01 21:08:35 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Eigene Dateien\mbam-setup_146.exe [2010.08.01 19:25:48 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft ========== Files - Modified Within 90 Days ========== [2010.08.08 20:08:49 | 000,293,376 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.com [2010.08.08 14:15:13 | 000,513,534 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.08.08 14:15:13 | 000,494,916 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.08.08 14:15:13 | 000,104,728 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.08.08 14:15:13 | 000,091,370 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.08.08 14:15:13 | 000,005,006 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.08.08 14:14:06 | 000,059,392 | ---- | M] (SOFTWIN S.R.L.) -- C:\WINDOWS\ExplorerSrv.exe [2010.08.08 14:11:06 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.08.08 14:11:06 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.08.08 14:11:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.08.07 09:50:04 | 000,114,085 | ---- | M] () -- C:\infected.7z [2010.08.07 04:01:59 | 008,650,752 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\ntuser.dat [2010.08.07 04:01:59 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\ntuser.ini [2010.08.06 10:56:44 | 003,815,943 | R--- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Combo.com [2010.08.05 19:29:35 | 000,000,294 | RHS- | M] () -- C:\boot.ini [2010.08.05 12:41:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010.08.05 12:40:54 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010.08.05 12:40:44 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.bak [2010.08.04 18:01:53 | 000,354,304 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.exe [2010.08.04 11:37:23 | 000,000,626 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\NTREGOPT.lnk [2010.08.04 11:37:23 | 000,000,607 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\ERUNT.lnk [2010.08.04 11:28:50 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Gmer.zip [2010.08.04 11:24:44 | 000,000,430 | ---- | M] () -- C:\WINDOWS\win.ini [2010.08.04 11:24:44 | 000,000,223 | ---- | M] () -- C:\Boot.bak [2010.08.04 11:13:16 | 000,410,784 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Load.exe [2010.08.04 11:06:07 | 000,141,312 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MBRCheck.exe [2010.08.02 16:38:51 | 000,059,392 | R--- | M] () -- C:\WINDOWS\System32\streamhlp.dll [2010.08.02 02:38:11 | 003,139,829 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Eigene Dateien\pinfect.zip [2010.08.02 02:32:42 | 000,000,000 | ---- | M] () -- C:\23990098.$$$ [2010.08.02 01:35:25 | 000,000,054 | ---- | M] () -- C:\WINDOWS\Lic.xxx [2010.08.02 01:31:27 | 000,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe [2010.08.02 01:21:28 | 001,438,780 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\avg.csv [2010.08.01 21:08:35 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Eigene Dateien\mbam-setup_146.exe [2010.08.01 20:07:41 | 000,238,080 | ---- | M] () -- C:\utorrentXP.exe [2010.08.01 19:28:59 | 000,632,320 | ---- | M] () -- C:\CDmage1-01-5.exe [2010.07.18 22:49:25 | 000,167,424 | ---- | M] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.18 06:07:56 | 000,552,960 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe ========== Files Created - No Company Name ========== [2010.08.08 20:08:48 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.com [2010.08.07 09:50:04 | 000,114,085 | ---- | C] () -- C:\infected.7z [2010.08.06 10:56:44 | 003,815,943 | R--- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Combo.com [2010.08.05 12:40:45 | 000,013,646 | ---- | C] () -- C:\WINDOWS\System32\wpa.bak [2010.08.05 12:23:44 | 000,000,223 | ---- | C] () -- C:\Boot.bak [2010.08.05 12:23:41 | 000,262,448 | ---- | C] () -- C:\cmldr [2010.08.05 12:20:20 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010.08.05 12:20:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010.08.05 12:20:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010.08.05 12:20:20 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010.08.05 12:20:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010.08.04 11:56:03 | 000,354,304 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.exe [2010.08.04 11:37:23 | 000,000,626 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\NTREGOPT.lnk [2010.08.04 11:37:23 | 000,000,607 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\ERUNT.lnk [2010.08.04 11:28:50 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Gmer.zip [2010.08.04 11:13:15 | 000,410,784 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\Load.exe [2010.08.04 11:05:54 | 000,141,312 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\MBRCheck.exe [2010.08.02 16:38:45 | 000,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll [2010.08.02 02:38:11 | 003,139,829 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Eigene Dateien\pinfect.zip [2010.08.02 02:32:42 | 000,000,000 | ---- | C] () -- C:\23990098.$$$ [2010.08.02 01:31:39 | 000,000,054 | ---- | C] () -- C:\WINDOWS\Lic.xxx [2010.08.02 01:31:28 | 000,000,522 | ---- | C] () -- C:\WINDOWS\System32\Microsoft.VC80.CRT.manifest [2010.08.02 00:49:15 | 001,438,780 | ---- | C] () -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\avg.csv [2010.03.01 22:51:29 | 000,018,090 | ---- | C] () -- C:\WINDOWS\System32\drivers\iMON_PAD.sys [2009.10.16 00:58:38 | 000,000,312 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2009.08.23 20:48:56 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2009.08.23 18:11:00 | 000,000,164 | ---- | C] () -- C:\WINDOWS\Cmicnfgp.ini.cfl [2009.08.23 18:10:36 | 000,003,465 | ---- | C] () -- C:\WINDOWS\Cmicnfgp.ini.cfg [2009.08.23 18:10:26 | 000,000,522 | ---- | C] () -- C:\WINDOWS\cmudaxp.ini [2009.08.23 15:27:39 | 000,000,053 | ---- | C] () -- C:\WINDOWS\System32\cmasiop.ini [2009.08.16 19:29:35 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009.08.16 19:29:35 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009.08.16 19:06:43 | 000,000,090 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2009.08.16 18:00:09 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll [2009.08.16 17:04:57 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\AmdK8.sys [2009.08.16 17:04:15 | 000,004,721 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009.08.16 17:04:12 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2006.02.28 14:00:00 | 000,162,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\netbt.sys ========== LOP Check ========== [2009.10.03 14:30:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Azureus [2009.08.30 12:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\CMUV [2009.08.16 19:21:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\DAEMON Tools Lite [2010.08.01 23:03:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\F-Secure [2009.08.16 23:26:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\InterVideo [2010.08.02 01:31:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\MicroWorld [2010.08.04 11:27:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\SlySoft [2010.03.02 20:06:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\SOUNDGRAPH [2009.08.16 22:27:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Team MediaPortal [2010.08.01 19:37:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Temp [2009.08.16 19:56:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Amazon [2009.08.16 17:26:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\ASUS [2010.07.11 19:59:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Azureus [2010.08.01 19:26:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\BitTorrent [2009.12.30 04:25:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Canneverbe_Limited [2010.02.05 23:21:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\DAEMON Tools Lite [2009.08.16 17:58:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Leadertech [2009.11.29 13:10:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\OpenOffice.org [2009.08.17 18:37:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Opera [2010.03.02 21:27:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\SOUNDGRAPH [2009.12.31 22:23:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\Strokes 4.0 [2010.08.02 17:34:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\TrojanHunter [2010.01.15 01:00:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Anwendungsdaten\uTorrent ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2010.08.02 02:32:42 | 000,000,000 | ---- | M] () -- C:\23990098.$$$ [2009.01.19 21:10:55 | 001,372,464 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\8-12_xp32-64_xcode_72274.exe [2009.02.24 21:32:31 | 054,267,808 | ---- | M] (InterVideo ) -- C:\9.0B014.119-67214.DVD9.Plus.BD.from.9.0B014.48.UP.iUpgrade.exe [2009.06.24 20:06:02 | 054,420,872 | ---- | M] (InterVideo ) -- C:\9.0B014.132-74098.DVD9.Plus.BD.from.9.0B014.48.UP.iUpgrade.exe [2009.07.20 20:02:08 | 052,797,536 | ---- | M] (InterVideo ) -- C:\9.0B014.137-81377.DVD9.Plus.DVD.from.9.0B014.65.UP.iUpgrade.exe [2009.08.23 17:51:00 | 000,922,113 | ---- | M] () -- C:\A780FullHD(1.50)Win.zip [2009.07.07 18:39:30 | 003,559,856 | ---- | M] (Audiograbber Deutschland) -- C:\agsetup183se.exe [2009.01.22 21:45:56 | 000,006,464 | ---- | M] () -- C:\AnyDVD & AnyDVD HD 6[1].5.1.9 Beta [mininova].torrent [2009.01.22 20:49:16 | 000,002,138 | ---- | M] () -- C:\AnyDVD___AnyDVD_HD_6.5.1.8_Final[MULTI][key].4667971.TPB.torrent [2009.12.04 19:33:55 | 000,003,428 | ---- | M] () -- C:\AnyDVD___AnyDVD_HD_v6.6.0.3_FINAL___Reg_By_ChattChitto.5157902.TPB.torrent [2009.01.17 23:26:45 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2009.01.18 22:52:50 | 002,018,243 | ---- | M] () -- C:\AutoHotkey104706_Install.exe [2009.01.18 21:56:27 | 008,352,136 | ---- | M] (AutoIt Team) -- C:\autoit-v3-setup.exe [2009.03.23 19:02:30 | 030,143,040 | ---- | M] () -- C:\avira_antivir_personal_de.exe [2009.01.24 16:24:44 | 000,045,233 | ---- | M] () -- C:\Battlestar[1].Galactica.S04E12.720p.HDTV.x264-CTU.[eztv] [mininova].torrent [2010.08.04 11:24:44 | 000,000,223 | ---- | M] () -- C:\Boot.bak [2010.08.05 19:29:35 | 000,000,294 | RHS- | M] () -- C:\boot.ini [2006.02.28 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin [2009.04.15 19:45:09 | 000,028,272 | ---- | M] () -- C:\Caprica.S01E00.Pilot.DVDRip.XviD-REWARD.[eztv].torrent [2009.04.15 19:47:16 | 000,016,247 | ---- | M] () -- C:\Caprica[1].S01E00.EXTRAS.DVDRip.XviD-iNGOT [mininova].torrent [2009.07.31 18:09:45 | 003,278,552 | ---- | M] (Piriform Ltd) -- C:\ccsetup222.exe [2009.01.25 16:20:28 | 003,183,182 | ---- | M] (Canneverbe Limited ) -- C:\cdbxp_setup_4.2.3.1110.exe [2010.08.01 19:28:59 | 000,632,320 | ---- | M] () -- C:\CDmage1-01-5.exe [2004.08.03 23:00:10 | 000,262,448 | ---- | M] () -- C:\cmldr [2010.08.05 12:43:34 | 000,015,265 | ---- | M] () -- C:\ComboFix.txt [2009.01.17 23:26:45 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2009.01.27 20:36:06 | 000,141,714 | ---- | M] () -- C:\CoreVorbis_1[1].0b6_20031215[Codec-Download.de].exe [2009.03.14 20:35:54 | 000,034,997 | ---- | M] () -- C:\CyberLink_PowerDVD_Ultra_v9.0.1501_Multilingual.4753468.TPB.torrent [2009.12.11 01:23:41 | 000,000,000 | ---- | M] () -- C:\Diagnostics.txt [2009.08.23 15:35:57 | 096,921,976 | ---- | M] (Microsoft Corporation) -- C:\directx_mar2009_redist.exe [2009.01.27 20:21:15 | 019,333,112 | ---- | M] (DivX, Inc.) -- C:\DivXInstaller.exe [2009.01.18 17:46:12 | 000,209,405 | ---- | M] () -- C:\dvbfix.zip [2009.04.07 22:50:41 | 052,599,664 | ---- | M] (InterVideo ) -- C:\DVD9.0.14.91_63207_Plus_iUpgrade.exe [2009.02.03 21:06:39 | 000,145,528 | ---- | M] () -- C:\DXVAChecker_1.10.1.0.zip [2009.01.18 19:32:47 | 003,967,642 | ---- | M] (ffdshow ) -- C:\ffdshow_beta6_rev2527_20081219.exe [2009.03.07 00:09:29 | 004,653,240 | ---- | M] () -- C:\flashget196en.exe [2009.07.09 21:15:56 | 000,411,509 | ---- | M] () -- C:\GSpot270a.zip [2009.04.07 20:29:52 | 000,000,000 | ---- | M] () -- C:\HDDVD.txt [2010.08.07 09:50:04 | 000,114,085 | ---- | M] () -- C:\infected.7z [2009.01.17 23:26:45 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2009.02.05 20:49:03 | 000,045,239 | ---- | M] () -- C:\Knight[1].Rider.2008.S01E14.720p.HDTV.X264-DIMENSION.[eztv] [mininova].torrent [2009.07.07 18:38:44 | 000,547,819 | ---- | M] () -- C:\lame3.98.zip [2009.04.12 23:13:32 | 002,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\mbam-setup.exe [2009.01.07 22:22:43 | 019,953,789 | ---- | M] () -- C:\mediaportal-svn-01-07-2009--22-21-Rev21306.rar [2009.01.18 17:00:42 | 000,020,356 | ---- | M] () -- C:\MediaPortal.imo [2009.04.11 12:52:25 | 030,561,799 | ---- | M] (Team MediaPortal) -- C:\MediaPortal_1.0.1_Setup.exe [2009.01.07 23:17:06 | 017,647,847 | ---- | M] (Team MediaPortal) -- C:\MediaPortal_weekly-snapshot.exe [2009.01.17 23:26:45 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2009.04.08 19:20:24 | 000,018,148 | ---- | M] () -- C:\msi_extractor_latest.zip [2009.01.18 23:56:23 | 000,373,435 | ---- | M] () -- C:\MultiShortcut.rar [2008.04.13 22:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2008.04.14 00:01:56 | 000,251,712 | RHS- | M] () -- C:\ntldr [2009.01.27 20:33:05 | 000,141,274 | ---- | M] () -- C:\ogg_vorbis_audio_codec.zip [2010.08.07 02:17:32 | 000,004,138 | ---- | M] () -- C:\OTL.Txt [2010.08.07 09:54:23 | 000,007,446 | ---- | M] () -- C:\OTLFixlog08072010_035240.log [2010.07.18 06:07:56 | 000,552,960 | R--- | M] (OldTimer Tools) -- C:\OTLPE.exe [2010.08.08 14:11:00 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys [2009.06.21 19:06:38 | 024,449,920 | ---- | M] (PC Tools ) -- C:\sdsetup.exe [2009.01.22 21:12:09 | 004,116,928 | ---- | M] () -- C:\SetupAnyDVD6518.exe [2009.01.22 21:18:19 | 004,121,496 | ---- | M] () -- C:\SetupAnyDVD6519.exe [2008.07.19 17:17:02 | 000,016,589 | ---- | M] () -- C:\ShortCuter_plugin.rar [2009.07.30 00:59:01 | 000,000,002 | ---- | M] () -- C:\SMPCount.txt [2009.07.09 21:33:59 | 028,752,673 | ---- | M] (eRightSoft ) -- C:\SUPERsetup_36.exe [2009.01.22 23:02:34 | 002,207,280 | ---- | M] (C. Ghisler & Co.) -- C:\tcmd704a.exe [2009.04.11 13:33:27 | 000,045,058 | ---- | M] () -- C:\Terminator.The.Sarah.Connor.Chronicles.S02E22.720p.HDTV.x264-CTU.[eztv].torrent [2009.04.12 23:02:33 | 000,012,239 | ---- | M] () -- C:\TotalMedia_Theatre_v3.0.1.120_Platinum_incl._crack.4842831.TPB.torrent [2009.01.07 23:19:04 | 002,326,092 | ---- | M] (Team MediaPortal) -- C:\TV-Server_weekly-snapshot.exe [2009.04.08 19:07:26 | 005,073,078 | ---- | M] () -- C:\uniextract16_noinst.rar [2010.08.01 20:07:41 | 000,238,080 | ---- | M] () -- C:\utorrentXP.exe [2009.06.25 00:45:58 | 004,132,360 | ---- | M] (Microsoft Corporation) -- C:\vcredist_x86.exe [2009.08.16 23:20:38 | 000,490,944 | ---- | M] () -- C:\vcredist_x86.log [2009.06.29 19:05:42 | 000,089,815 | ---- | M] () -- C:\Virtuality.Pilot.720p.HDTV.X264-DIMENSION.[eztv].torrent [2009.06.28 15:09:16 | 000,000,298 | ---- | M] () -- C:\Virtuality.Pilot.720p.HDTV.X264-DIMENSION.[eztv].[INFO]_[mininova].torrent [2009.02.01 14:18:06 | 016,320,472 | ---- | M] () -- C:\vlc-0.9.8a-win32.exe [2009.06.25 00:26:08 | 000,734,160 | ---- | M] () -- C:\VobSub_2.23.exe [2009.01.18 19:30:29 | 000,391,083 | ---- | M] () -- C:\vsfilter.2.37_nt.exe [2009.06.28 19:47:38 | 004,042,444 | ---- | M] (e-merge GmbH) -- C:\wace269i.exe [2009.04.13 14:34:07 | 000,011,875 | ---- | M] () -- C:\x-Demonoid.com-x_ArcSoft_TotalMedia_Theater_BlurayHDDVD_Player_2_1_6_130.torrent < %systemroot%\system32\*.wt > < %systemroot%\system32\*.ruy > < %systemroot%\Fonts\*.com > [2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont [2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2009.08.16 16:32:37 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll [2008.07.06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.11.04 17:45:14 | 000,479,232 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2009.08.16 18:16:52 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2009.08.16 18:16:51 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2009.08.16 18:16:51 | 000,462,848 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\system32\user32.dll /md5 > [2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.04.14 07:52:34 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll < %systemroot%\system32\ws2help.dll /md5 > [2008.04.14 07:52:34 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > gmer G_MER 1.0.15.15281 - hxxp://www.gmer.net Rootkit scan 2010-08-08 16:32:17 Windows 5.1.2600 Service Pack 3 Running: gmer.com; Driver: C:\DOKUME~1\MPMEDI~1.000\LOKALE~1\Temp\uxtdypod.sys ---- Kernel code sections - GMER 1.0.15 ---- .rsrc C:\WINDOWS\system32\DRIVERS\AmdK8.sys entry point in ".rsrc" section [0xBA1C3014] .text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB539A000, 0x2131D7, 0xE8000020] init C:\WINDOWS\system32\drivers\iMON_PAD.sys entry point in "init" section [0xBA599CC0] C:\Programme\CyberLink\PowerDVD\000.fcl entry point in "" section [0xA577E41C] .clc C:\Programme\CyberLink\PowerDVD\000.fcl unknown last code section [0xA577F000, 0x1000, 0xE0000020] .text C:\Programme\CyberLink\PowerDVD8\000.fcl section is writeable [0xA5760000, 0x2892, 0xE8000020] .vmp2 C:\Programme\CyberLink\PowerDVD8\000.fcl entry point in ".vmp2" section [0xA5783050] ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system\HsMgr.exe[620] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\WINDOWS\system\HsMgr.exe[620] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\SOUNDGRAPH\iMON\iMON.exe[848] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 01E79160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\SOUNDGRAPH\iMON\iMON.exe[848] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 01E79080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.com[868] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Dokumente und Einstellungen\MP.MEDIAPC.000\Desktop\gmer.com[868] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes JMP 009C000A .text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtWriteVirtualMemory 7C91DFAE 5 Bytes JMP 0234000A .text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!KiUserExceptionDispatcher 7C91E47C 5 Bytes JMP 009B000C .text C:\WINDOWS\System32\svchost.exe[1104] USER32.dll!GetCursorPos 7E37974E 5 Bytes JMP 0101000A .text C:\WINDOWS\System32\svchost.exe[1104] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 0240000A .text C:\Programme\Internet Explorer\IEXPLORE.EXE[1360] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes JMP 00A1000A .text C:\Programme\Internet Explorer\IEXPLORE.EXE[1360] ntdll.dll!NtWriteVirtualMemory 7C91DFAE 5 Bytes JMP 00A2000A .text C:\Programme\Internet Explorer\IEXPLORE.EXE[1360] ntdll.dll!KiUserExceptionDispatcher 7C91E47C 5 Bytes JMP 00A0000C .text C:\Programme\Logitech\SetPoint\SetPoint.exe[1516] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 01219160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\Logitech\SetPoint\SetPoint.exe[1516] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 01219080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\DVBViewer TE2\SkystarIR.exe[1536] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\DVBViewer TE2\SkystarIR.exe[1536] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[1780] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[1780] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2380] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[2380] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\WINDOWS\system32\wscntfy.exe[3124] ole32.dll!CoCreateInstanceEx 774D0526 5 Bytes JMP 10009160 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) .text C:\WINDOWS\system32\wscntfy.exe[3124] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 10009080 C:\WINDOWS\system\HsSrv.dll (HsSrv Dynamic Link Library/C-Media Electronics Inc.) ---- Devices - GMER 1.0.15 ---- Device -> \Driver\atapi \Device\Harddisk0\DR0 89C48EC5 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBA 0x14 0xC6 0xE1 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBA 0x14 0xC6 0xE1 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBA 0x14 0xC6 0xE1 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBA 0x14 0xC6 0xE1 ... ---- Files - GMER 1.0.15 ---- File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057174.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057230.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057242.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057427.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057639.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0057899.exe (size mismatch) 120320/59392 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0058324.exe 137284 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0058342.exe 493568 bytes executable File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0058360.exe 384000 bytes File C:\System Volume Information\_restore{971DE40A-4E55-4597-BFA8-BDF42DC0E589}\RP12\A0058323.dll 124928 bytes executable File C:\WINDOWS\system32\DRIVERS\AmdK8.sys suspicious modification File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification ---- EOF - GMER 1.0.15 ---- --- --- --- Geändert von ich56 (08.08.2010 um 13:01 Uhr) |
|
08.08.2010, 13:38
| #36 |
| /// Selecta Jahrusso | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Irgendwo sitzt da ein Dropper -.- Alle Dateien sind wieder da. ABer geh mal lieber neu aufsetzen C:\TotalMedia_Theatre_v3.0.1.120_Platinum_incl._crack.4842831.TPB.torrent Dateien, die crack.exe, keygen.exe oder patch.exe sind zu 99,9% gefährliche Schädlinge, mit denen man nicht Spaßen sollte. Ausserdem sind diese illegal und somit beschränkt sich der Support auf Anleitung zum Neu aufsetzten
__________________ --> AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA |
|
08.08.2010, 13:49
| #37 |
| | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Hm, naja. Ok. Trotzdem danke für deine Hilfe. |
|
08.08.2010, 14:00
| #38 |
| /// Selecta Jahrusso | AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA Dieses Thema scheint erledigt und wird aus den Abos gelöscht. Solltest Du das Thema erneut benötigen, bitte eine PN an mich. Jeder andere möge bitte einen eigenen Thread starten.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
| Themen zu AVG 9 finden SHeuer.AQUM Dropper und Sheur.AQRA |
| antitrojan, antiviren, avg, avg free, bluescree, deaktiviert, dropper, free, hijack, hijack this, hijackthis, infiziert, lautstärke, log, malwarebytes, nichts, online, problem, programm, rsit, scan, scanner, sicherheitscenter, software, spybot, this, tracking, trojaner |
Textbox.
.
Linear-Darstellung
