Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Backdoor.Win32.Gootkit.jd

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 22.08.2010, 19:51   #1
Doorgunner82
 
Backdoor.Win32.Gootkit.jd - Icon16

Backdoor.Win32.Gootkit.jd



Hallo und guten Abend!

Durch eine kleine aber feine Unachtsamkeit hat sich der Backdoor Backdoor.Win32.Gootkit.jd auf einem PC eines Freundes eingeschlichen.

Kaspersky hat diesen bis Ende letzter Woche zB nicht erkannt. Erst nach der Zusendung der .scr-Datei, welche als .jpg getarnt war (79756345_272688588_DSC0014084920.JPG.scr), wurde er am Folgetag ins Update aufgenommen.

Ich bin gerade mit der Auswertung der HijackThis-Logfile beschäftigt.
Würde aber doch gerne diese hier posten, mehrere Augen-Prinzip.
Evtl fängt sich ja nochmal jemand deses Viech ein und kann sich hier Hilfe holen.

Bin auch über Ideen zur Reinigung dankbar ;-)

Hier das Logfile:

Rot markiert habe ich erstmal die Einträge, die ich schon als Übeltäter entlarvt habe
Bei den blauen gehe ich stark von nem Schädling aus.
HiJackthis Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:46:07, on 22.08.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Acer\WR_PopUp\ProductReg.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Acer\WR_PopUp\AcerRegTool.exe
C:\Users\Public\S-2535-6853-2745\winrsvn.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Users\Public\U-2535-6853-8747\winusbmgr.exe
C:\Users\Admin\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Users\Admin\AppData\Local\Temp\Fth.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Admin\AppData\Local\Temp\0144928.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Admin\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) -  - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [Windows Boot Control] C:\Users\Public\S-2535-6853-2745\winrsvn.exe
O4 - HKCU\..\Run: [Windows USB Service] C:\Users\Public\U-2535-6853-8747\winusbmgr.exe
O4 - HKCU\..\Run: [XBV6RD5SZF] C:\Users\Admin\AppData\Local\Temp\Fth.exe
O4 - HKCU\..\Run: [MSNUpdateService] \Users\Admin\winsvncd.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

--
End of file - 11972 bytes
         
--- --- ---

Vielen Dank schon mal für ne Antwort

und allen einen schönen Rest-Sonntag

Gruss
Matthias

Geändert von Doorgunner82 (22.08.2010 um 19:59 Uhr)

Alt 23.08.2010, 18:26   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Backdoor.Win32.Gootkit.jd - Standard

Backdoor.Win32.Gootkit.jd



Hallo und

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lies die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.



Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.
__________________

__________________

Alt 26.08.2010, 15:27   #3
Doorgunner82
 
Backdoor.Win32.Gootkit.jd - Standard

Backdoor.Win32.Gootkit.jd



Hallo!
Danke schon mal für die Hilfe!

Hier das Logfile nach Malwarebytes durch OTL:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 26.08.2010 13:31:46 - Run 1
OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\Admin\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type =
NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 64,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,99 Gb Total Space | 65,55 Gb Free Space | 14,37% Space Free |
Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ADMIN-PC
Current User Name: Admin
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Admin\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Common Files\Apple\Mobile Device
Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky
Lab ZAO)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
(Kaspersky Lab ZAO)
PRC - C:\Programme\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
PRC - C:\Users\Admin\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerTray.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft
Corporation)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Programme\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(NewTech Infosystems, Inc.)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech
Infosystems, Inc.)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Programme\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
PRC - C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech
Infosystems, Inc.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Admin\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Programme\Acer\Acer PowerSmart Manager\SysHook.dll (Acer Incorporated)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD -
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
(Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (GoogleDesktopManager-051210-111108) -- C:\Program Files\Google\Google Desktop
Search\GoogleDesktop.exe (Google)
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
(TeamViewer GmbH)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device
Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security
2011\avp.exe (Kaspersky Lab ZAO)
SRV - (WPFFontCache_v0400) --
C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft
Corporation)
SRV - (clr_optimization_v4.0.30319_32) --
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft
Corporation)
SRV - (ePowerSvc) -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer
Incorporated)
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement
Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (MWLService) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Acer Backup
Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (CLHNService) -- C:\Programme\Acer Arcade
Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now
5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now
5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (fssfltr) -- C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) --
C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek
Semiconductor Corp.)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis
Incorporated.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.)
DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (k57nd60x) Broadcom NetLink (TM) -- C:\Windows\System32\drivers\k57nd60x.sys
(Broadcom Corporation)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems
Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated
Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (NSCIRDA) -- C:\Windows\System32\drivers\nscirda.sys (National Semiconductor
Corporation)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology
Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology
Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) --
C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative
Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings:
"ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings:
"ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,Default_Page_URL =
hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1009&m=aspire_7735
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Internet
Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..\URLSearchHook:  - Reg
Error: Key error. File not found
IE - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..\URLSearchHook:
{855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
(ICQ)
IE -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\Software\Microsoft\Windows\CurrentVersion\Internet
Settings: "ProxyEnable" = 0
IE -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\Software\Microsoft\Windows\CurrentVersion\Internet
Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage:
"hxxp://www.bonprix.de/bp/Young-Fashion-1-5625-shop.htm?id=1505159672635684902-0-4c45eb20&directLandmark=topleiste&directLandmarkP=%26name%3DsubSort%26subsortiment%3D17"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.6
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems:
{635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.0.1.20090924050608
FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:11.0.0.232
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.0.232
FF - prefs.js..keyword.URL:
"hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
FF -
HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}:
C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.03.11 18:15:50
| 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program
Files\Mozilla Firefox\components [2010.07.09 11:26:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program
Files\Mozilla Firefox\plugins [2010.06.26 10:54:49 | 000,000,000 | ---D | M]
FF -
HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}:
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2010.08.22
14:09:35 | 000,000,000 | ---D | M]
 
[2009.12.22 23:54:12 | 000,000,000 | ---D | M] --
C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2010.08.25 20:58:54 | 000,000,000 | ---D | M] --
C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\5softoch.default\extensions
[2009.12.25 15:16:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant)
--
C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\5softoch.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.12.26 16:43:11 | 000,002,171 | ---- | M] () --
C:\Users\Admin\AppData\Roaming\Mozilla\FireFox\Profiles\5softoch.default\searchplugins\bing.xml
[2010.08.22 13:54:32 | 000,000,961 | ---- | M] () --
C:\Users\Admin\AppData\Roaming\Mozilla\FireFox\Profiles\5softoch.default\searchplugins\icqplugin-1.xml
[2010.06.26 10:55:09 | 000,000,961 | ---- | M] () --
C:\Users\Admin\AppData\Roaming\Mozilla\FireFox\Profiles\5softoch.default\searchplugins\icqplugin-2.xml
[2010.07.09 11:27:58 | 000,000,961 | ---- | M] () --
C:\Users\Admin\AppData\Roaming\Mozilla\FireFox\Profiles\5softoch.default\searchplugins\icqplugin-3.xml
[2010.04.26 19:43:05 | 000,000,955 | ---- | M] () --
C:\Users\Admin\AppData\Roaming\Mozilla\FireFox\Profiles\5softoch.default\searchplugins\icqplugin.xml
[2010.08.22 14:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla
Firefox\extensions
[2009.12.22 23:53:33 | 000,000,000 | ---D | M] (Yahoo! Toolbar) --
C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.01.28 19:11:59 | 000,000,000 | ---D | M] (No name found) --
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.22 14:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla
Firefox\extensions\KavAntiBanner@Kaspersky.ru
[2010.08.22 14:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla
Firefox\extensions\linkfilter@kaspersky.ru
[2009.12.02 10:31:53 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla
Firefox\searchplugins\amazondotcom-de.xml
[2009.12.02 10:31:53 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla
Firefox\searchplugins\eBay-de.xml
[2009.12.02 10:31:53 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla
Firefox\searchplugins\leo_ende_de.xml
[2009.12.02 10:31:53 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla
Firefox\searchplugins\wikipedia-de.xml
[2009.12.02 10:31:53 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla
Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) -
C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) -
{3049C3E9-B461-4BC5-8870-4C09146192CA} -
C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
(RealPlayer)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky
Lab ZAO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -
C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -
C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
(Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) -
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft
shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} -
C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -
C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -
C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky
Lab ZAO)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) -
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows
Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} -
C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} -
C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..\Toolbar\WebBrowser:
(&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -
C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..\Toolbar\WebBrowser:
(Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -
C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart
Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [AmIcoSinglun] C:\Programme\AmIcoSingLun\AmIcoSinglun.exe
(AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade
Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security
2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Acer
Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade
Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Program
Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software
Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop
Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System
Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Programme\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Egis Technology Inc.)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade
Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek
Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek
Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI
Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common
Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll
(Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll
(Microsoft Corporation)
O4 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000..\Run: [ICQ] C:\Program
Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000..\Run: [MSNUpdateService]
\Users\Admin\winsvncd.exe ()
O4 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000..\Run: [ProductReg]
C:\Program Files\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000..\Run: [WindowsWelcomeCenter]
C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
EnableVirtualization = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
HideFastUserSwitching = 0
O7 -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:
NoChangeStartMenu = 1
O7 -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:
NoClose = 1
O7 -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:
NoLogOff = 1
O7 -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
DisableLockWorkstation = 1
O7 -
HKU\S-1-5-21-3413188452-1366790511-925618285-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:
DisableChangePassword = 1
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Program
Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Program
Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Program
Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Program
Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google
Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky
Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren -
C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600}
- C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft
Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n -
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows
Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} -
C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden -
{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft
Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky
Lab ZAO)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky
Lab ZAO)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} -
C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} -
C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] -
C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..Trusted Domains: localhost
([]http in Local intranet)
O15 - HKU\S-1-5-21-3413188452-1366790511-925618285-1000\..Trusted Ranges: GD ([http]
in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} -
C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft
Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} -
C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} -
c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll
(Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} -
C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft
Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -
C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} -
C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft
Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -
C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky
Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) -
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky
Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft
Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll -
C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Live Photo
Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Live
Photo Gallery\Windows Live Fotogalerie-Hintergrundbild.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -
C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.26 12:23:45 | 000,000,000 | ---D | C] --
C:\Users\Admin\AppData\Roaming\Malwarebytes
[2010.08.26 12:23:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) --
C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.26 12:23:30 | 000,020,952 | ---- | C] (Malwarebytes Corporation) --
C:\Windows\System32\drivers\mbam.sys
[2010.08.26 12:23:30 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes'
Anti-Malware
[2010.08.26 12:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.22 14:09:00 | 000,000,000 | ---D | C] -- C:\Programme\Kaspersky Lab
[2010.08.22 14:08:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2010.08.22 14:08:33 | 000,475,224 | ---- | C] (Kaspersky Lab) --
C:\Windows\System32\drivers\klif.sys
[2010.08.22 14:07:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup
Files
[2010.08.22 13:46:34 | 000,221,568 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\MpSigStub.exe
[2010.08.16 19:54:48 | 000,000,000 | ---D | C] --
C:\Users\Admin\AppData\Roaming\TeamViewer
[2010.08.16 19:54:35 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer
[2010.08.15 03:44:36 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010.08.11 17:38:09 | 001,638,912 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\mshtml.tlb
[2010.08.11 17:38:09 | 001,469,440 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\inetcpl.cpl
[2010.08.11 17:38:09 | 000,611,840 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\mstime.dll
[2010.08.11 17:38:09 | 000,599,040 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\msfeeds.dll
[2010.08.11 17:38:09 | 000,387,584 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\iedkcs32.dll
[2010.08.11 17:38:09 | 000,184,320 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\iepeers.dll
[2010.08.11 17:38:09 | 000,173,056 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\ie4uinit.exe
[2010.08.11 17:38:09 | 000,164,352 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\ieui.dll
[2010.08.11 17:38:09 | 000,133,632 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\ieUnatt.exe
[2010.08.11 17:38:09 | 000,109,056 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\iesysprep.dll
[2010.08.11 17:38:09 | 000,071,680 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\iesetup.dll
[2010.08.11 17:38:09 | 000,055,808 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\iernonce.dll
[2010.08.11 17:38:09 | 000,055,296 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\msfeedsbs.dll
[2010.08.11 17:38:09 | 000,025,600 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\jsproxy.dll
[2010.08.11 17:38:09 | 000,013,312 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\msfeedssync.exe
[2010.08.11 17:38:07 | 000,081,920 | ---- | C] (Radius Inc.) --
C:\Windows\System32\iccvid.dll
[2010.08.11 17:38:01 | 002,036,736 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\win32k.sys
[2010.08.11 17:37:59 | 000,036,352 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\rtutils.dll
[2010.08.11 17:37:56 | 003,598,216 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\ntkrnlpa.exe
[2010.08.11 17:37:55 | 003,545,992 | ---- | C] (Microsoft Corporation) --
C:\Windows\System32\ntoskrnl.exe
[2010.08.07 18:06:27 | 000,000,000 | ---D | C] -- C:\ProgramData\AirportMania
[2009.10.31 06:05:02 | 000,049,152 | ---- | C] ( ) --
C:\Windows\Interop.IWshRuntimeLibrary.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.26 13:39:02 | 002,359,296 | -HS- | M] () -- C:\Users\Admin\NTUSER.DAT
[2010.08.26 13:28:47 | 000,003,616 | -H-- | M] () --
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.26 13:28:47 | 000,003,616 | -H-- | M] () --
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.26 13:28:42 | 000,001,092 | ---- | M] () --
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.26 13:28:35 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.26 13:28:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.26 13:28:25 | 3215,908,864 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.26 12:42:27 | 000,524,288 | -HS- | M] () --
C:\Users\Admin\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.08.26 12:42:27 | 000,065,536 | -HS- | M] () --
C:\Users\Admin\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.08.26 12:42:25 | 002,006,831 | -H-- | M] () --
C:\Users\Admin\AppData\Local\IconCache.db
[2010.08.26 12:40:58 | 000,001,096 | ---- | M] () --
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.26 12:23:34 | 000,000,822 | ---- | M] () --
C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.25 18:30:53 | 000,113,933 | ---- | M] () --
C:\Windows\System32\drivers\klin.dat
[2010.08.25 18:30:53 | 000,097,549 | ---- | M] () --
C:\Windows\System32\drivers\klick.dat
[2010.08.22 14:08:33 | 000,475,224 | ---- | M] (Kaspersky Lab) --
C:\Windows\System32\drivers\klif.sys
[2010.08.22 13:45:08 | 001,445,310 | ---- | M] () --
C:\Windows\System32\PerfStringBackup.INI
[2010.08.22 13:45:08 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.22 13:45:08 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.22 13:45:08 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.22 13:45:08 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.22 13:41:31 | 000,105,472 | -HS- | M] () -- C:\Users\Admin\winsvncd.exe
[2010.08.22 13:40:40 | 000,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google
Chrome.lnk
[2010.08.22 13:37:49 | 000,296,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.16 19:54:42 | 000,000,959 | ---- | M] () --
C:\Users\Public\Desktop\TeamViewer 5.lnk
[2010.08.15 03:44:35 | 233,537,640 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.08.09 22:36:03 | 000,006,836 | ---- | M] () --
C:\Users\Admin\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2010.08.26 12:23:34 | 000,000,822 | ---- | C] () --
C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.22 14:10:52 | 000,113,933 | ---- | C] () --
C:\Windows\System32\drivers\klin.dat
[2010.08.22 14:10:52 | 000,097,549 | ---- | C] () --
C:\Windows\System32\drivers\klick.dat
[2010.08.22 13:41:31 | 000,105,472 | -HS- | C] () -- C:\Users\Admin\winsvncd.exe
[2010.08.22 13:41:31 | 000,000,000 | R--- | C] () --
C:\Users\Admin\AppData\Roaming\CN0E6.txt
[2010.08.16 19:54:42 | 000,000,959 | ---- | C] () --
C:\Users\Public\Desktop\TeamViewer 5.lnk
[2010.08.16 19:29:52 | 000,000,000 | R--- | C] () --
C:\Users\Admin\AppData\Roaming\h8N17.txt
[2010.08.16 19:29:50 | 000,000,000 | R--- | C] () --
C:\Users\Admin\AppData\Roaming\NMFKE.txt
[2010.08.15 03:44:05 | 233,537,640 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.03.20 13:08:00 | 000,000,000 | ---- | C] () --
C:\Users\Admin\AppData\Roaming\wklnhst.dat
[2010.01.06 23:05:55 | 000,006,836 | ---- | C] () --
C:\Users\Admin\AppData\Local\d3d9caps.dat
[2009.12.23 17:52:07 | 000,111,104 | ---- | C] () --
C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.09 14:51:47 | 000,003,276 | ---- | C] () --
C:\Users\Admin\AppData\Local\MyWinLockerInstaller.txt-20091209.log
[2009.12.09 14:47:13 | 000,000,074 | ---- | C] () -- C:\Windows\PidList.ini
[2009.10.31 05:52:28 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2009.10.31 05:52:28 | 000,011,264 | ---- | C] () -- C:\Windows\System32\atimuixx.dll
[2009.03.12 12:32:52 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2009.03.12 05:26:46 | 000,004,533 | ---- | C] () -- C:\ProgramData\ArcadeDeluxe2.log
[2009.02.11 22:03:58 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2009.02.11 22:03:58 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2009.02.11 22:03:57 | 000,000,060 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:814B9485
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:CDFF58FE
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:ABE89FFE
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:4F636E25
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:3064D21D
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:41099CE9
@Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:B623B5B8
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:CE0A077E
@Alternate Data Stream - 108 bytes -> C:\ProgramData\Temp:E1982A23
< End of report >
         
--- --- ---


Gruß
Matthias
__________________

Alt 26.08.2010, 19:31   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Backdoor.Win32.Gootkit.jd - Standard

Backdoor.Win32.Gootkit.jd



Du solltest zuerst den Vollscan mit Malwarebytes machen
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 26.08.2010, 23:23   #5
Doorgunner82
 
Backdoor.Win32.Gootkit.jd - Standard

Backdoor.Win32.Gootkit.jd



Sorry, der bericht des vollscans folgt. Habs grad gesehn ;-)


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4482

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18943

26.08.2010 12:39:30
mbam-log-2010-08-26 (12-39-30).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 133918
Laufzeit: 10 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschl?ssel: 3
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine b?sartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine b?sartigen Objekte gefunden)

Infizierte Registrierungsschl?ssel:
HKEY_CURRENT_USER\SOFTWARE\209K1I9HN8 (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\XBV6RD5SZF (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted
successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows boot control
(Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
(Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine b?sartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Admin\AppData\Local\Temp\B0Ec7Gl0Kl.log (Backdoor.Gootkit) -> Quarantined
and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\Gd6b1ekD6k.log (Backdoor.Gootkit) -> Quarantined
and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\Ftk.exe (Trojan.FraudPack.Gen) -> Quarantined and
deleted successfully.
C:\Users\Admin\AppData\Local\Temp\Fto.exe (Trojan.FraudPack.Gen) -> Quarantined and
deleted successfully.
C:\Users\Public\S-2535-6853-2745\winrsvn.exe (Trojan.Agent) -> Quarantined and
deleted successfully.


Alt 27.08.2010, 10:17   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Backdoor.Win32.Gootkit.jd - Standard

Backdoor.Win32.Gootkit.jd



Ich wollte einen Vollscan sehen!
__________________
--> Backdoor.Win32.Gootkit.jd

Antwort

Themen zu Backdoor.Win32.Gootkit.jd
.jpg.scr, 79756345_272688588_dsc0014084920.jpg.scr, adobe, agere systems, backdoor, backdoor.win32.gootkit.jd, bho, bonjour, canon, defender, desktop, explorer, firefox, google, hijack, internet, internet explorer, local\temp, locker, microsoft, mozilla, mywinlocker, popup, programdata, realtek, rundll, schädling, senden, software, system, temp, vista, windows



Ähnliche Themen: Backdoor.Win32.Gootkit.jd


  1. Kaspersky findet Backdoor.Win32.Zaccess, Trojan-Ransom.Win32.Gimeno, Trojan.Win32.Inject
    Log-Analyse und Auswertung - 01.02.2014 (17)
  2. Exploit.Script.Generic, Exploit.JS.Pdfka.gfa, Backdoor.Win32.ZAccess.ypw, Backdoor.Win32.ZAccess.yqi, Trojan.Win32.Miner.dw und weitere
    Log-Analyse und Auswertung - 02.10.2012 (7)
  3. Backdoor.Win32.ZAccess.mbg und Trojan.Win32.Small.bmph
    Log-Analyse und Auswertung - 10.07.2012 (28)
  4. Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef
    Log-Analyse und Auswertung - 04.05.2011 (32)
  5. Probleme beim Online-Banking: Trojan.Win32.Generic!BT, Win32.Backdoor.Papras/A und andere...
    Log-Analyse und Auswertung - 06.11.2010 (19)
  6. Backdoor:Win32/IRCbot.gen!M und Win32/Oficla.V
    Plagegeister aller Art und deren Bekämpfung - 27.10.2010 (1)
  7. Backdoor.Bot / Backdoor.Gootkit / Malware.Trace -> HiJackThis + Malwarebytes logfile
    Log-Analyse und Auswertung - 02.07.2010 (6)
  8. Backdoor.Win32.Rbot!IK und Win32.SuspectCrc!IK 1
    Plagegeister aller Art und deren Bekämpfung - 14.07.2009 (4)
  9. Backdoor.Win32.Agent.tpi und Packed.Win32.Black.a
    Plagegeister aller Art und deren Bekämpfung - 07.12.2008 (4)
  10. WIN32.Backdoor.Agent
    Log-Analyse und Auswertung - 05.12.2008 (0)
  11. eventuell noch trojaner? Trojan-PSW.Win32.Delf.cqp, Backdoor.Win32.Poison.jmo
    Log-Analyse und Auswertung - 21.11.2008 (0)
  12. win32.backdoor.graybird
    Plagegeister aller Art und deren Bekämpfung - 17.03.2008 (7)
  13. Backdoor.Win32.VB.bco
    Plagegeister aller Art und deren Bekämpfung - 30.07.2007 (12)
  14. Trojan.Win32.Sphinx.a+Backdoor.Win32.agent.zq+HJT-log
    Plagegeister aller Art und deren Bekämpfung - 01.12.2006 (1)
  15. Backdoor.Win32.SdBot.axq
    Plagegeister aller Art und deren Bekämpfung - 02.11.2006 (5)
  16. Backdoor.Win32.Haxdoor.gh
    Plagegeister aller Art und deren Bekämpfung - 10.02.2006 (4)
  17. Backdoor.Win32.Y3K.Rat.10
    Plagegeister aller Art und deren Bekämpfung - 15.04.2005 (11)

Zum Thema Backdoor.Win32.Gootkit.jd - Hallo und guten Abend! Durch eine kleine aber feine Unachtsamkeit hat sich der Backdoor Backdoor.Win32.Gootkit.jd auf einem PC eines Freundes eingeschlichen. Kaspersky hat diesen bis Ende letzter Woche zB nicht - Backdoor.Win32.Gootkit.jd...
Archiv
Du betrachtest: Backdoor.Win32.Gootkit.jd auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.