| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Deutsche Bank TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.10.2010, 17:11
| #31 |
 |  Deutsche Bank Trojaner hier aber der OTL log:OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.10.2010 18:05:14 - Run 2 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Burghard Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18943) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 122,86 Gb Total Space | 91,08 Gb Free Space | 74,14% Space Free | Partition Type: NTFS Drive D: | 26,18 Gb Total Space | 26,18 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: CAROLIN3-PC | User Name: carolin3 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Programme\Prevx\prevx.exe (Prevx) PRC - C:\Burghard\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10k_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Programme\Microsoft Security Essentials\msseces.exe (Microsoft Corporation) PRC - C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\Buhl finance\tax 2010 Professional\taxaktuell.exe () PRC - c:\Programme\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) PRC - C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) PRC - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.) ========== Modules (SafeList) ========== MOD - C:\Burghard\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (RoxLiveShare9) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe File not found SRV - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx) SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (hpqcxs08) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.) SRV - (hpqddsvc) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.) SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (catchme) -- C:\Users\carolin3\AppData\Local\Temp\catchme.sys File not found DRV - (pxrts) -- C:\Windows\System32\drivers\pxrts.sys (Prevx) DRV - (pxscan) -- C:\Windows\System32\drivers\pxscan.sys (Prevx) DRV - (pxkbf) -- C:\Windows\System32\drivers\pxkbf.sys (Prevx) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation) DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.) DRV - (netr28) -- C:\Windows\System32\drivers\netr28.sys (Ralink Technology, Corp.) DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.) DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc) DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.) DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 37 9C 55 D8 C8 6A CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.30 00:41:10 | 000,000,000 | ---D | M] [2010.02.01 13:27:36 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions [2010.02.01 13:27:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2008.12.30 00:41:59 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Firefox\Profiles\sfu17z5e.default\extensions [2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2008.12.30 00:40:25 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\Windows\System32\PxSecure.dll (Prevx) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [HP Software Update] C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [ScanSoft PDF Create! 4-reminder] C:\Program Files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.10.14 17:43:25 | 000,070,192 | ---- | C] (Prevx) -- C:\Windows\System32\PxSecure.dll [2010.10.14 17:43:24 | 000,074,624 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys [2010.10.14 17:43:24 | 000,030,320 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys [2010.10.14 17:43:23 | 000,024,400 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys [2010.10.14 17:43:23 | 000,000,000 | ---D | C] -- C:\Programme\Prevx [2010.10.14 17:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI [2010.10.14 10:19:56 | 000,000,000 | ---D | C] -- C:\Users\carolin3\DoctorWeb [2010.10.13 13:20:40 | 000,000,000 | ---D | C] -- C:\Windows\temp [2010.10.13 13:19:37 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2010.10.13 13:05:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2010.10.13 13:05:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2010.10.13 13:05:40 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2010.10.13 13:05:17 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2010.10.13 13:05:14 | 000,000,000 | ---D | C] -- C:\ComboFix [2010.10.13 13:04:28 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe [2010.10.13 13:01:00 | 000,000,000 | ---D | C] -- C:\Qoobox [2010.10.13 12:49:48 | 000,000,000 | ---D | C] -- C:\_OTL [2010.10.11 17:40:30 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Roaming\Malwarebytes [2010.10.11 17:40:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.10.11 17:40:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.10.11 17:40:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.10.11 17:40:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.09.29 00:59:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.09.26 18:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant [2010.09.15 08:25:12 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL [1996.11.18 23:15:46 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\IMPLODE.DLL ========== Files - Modified Within 30 Days ========== [2010.10.14 18:02:08 | 000,002,623 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Word.lnk [2010.10.14 17:43:25 | 000,070,192 | ---- | M] (Prevx) -- C:\Windows\System32\PxSecure.dll [2010.10.14 17:43:24 | 000,074,624 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys [2010.10.14 17:43:24 | 000,030,320 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys [2010.10.14 17:43:23 | 000,024,400 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys [2010.10.14 17:41:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.10.14 17:22:28 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.14 17:22:28 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.14 15:45:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.14 15:45:39 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.10.14 13:30:46 | 000,002,651 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Excel.lnk [2010.10.14 13:29:10 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2010.10.14 13:22:59 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.10.14 13:22:44 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.10.14 11:14:09 | 241,519,418 | ---- | M] () -- C:\Windows\MEMORY.DMP [2010.10.13 19:51:17 | 000,016,896 | ---- | M] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.13 18:07:22 | 000,000,940 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk [2010.10.11 20:14:07 | 000,248,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.10.11 17:40:23 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.30 14:44:55 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk ========== Files Created - No Company Name ========== [2010.10.14 11:14:09 | 241,519,418 | ---- | C] () -- C:\Windows\MEMORY.DMP [2010.10.13 13:05:40 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.10.13 13:05:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.10.13 13:05:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.10.13 13:05:40 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.10.13 13:05:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.10.11 17:40:23 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.30 14:44:55 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2010.05.31 16:15:41 | 000,000,032 | --S- | C] () -- C:\Users\carolin3\AppData\Local\770160558.dat [2009.09.27 10:30:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.12 21:16:57 | 000,007,916 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d9caps.dat [2009.03.04 11:43:24 | 000,000,182 | ---- | C] () -- C:\Windows\wininit.ini [2008.12.13 16:48:31 | 000,000,012 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\settings.xml [2008.12.13 16:48:30 | 000,000,235 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\devices.xml [2008.10.26 18:25:14 | 000,028,672 | ---- | C] () -- C:\Windows\System32\nnr.dll [2008.10.26 11:49:15 | 000,000,552 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d8caps.dat [2008.08.09 11:46:50 | 000,016,896 | ---- | C] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.07.28 13:12:14 | 000,000,924 | ---- | C] () -- C:\Windows\wiso.ini [2008.07.25 10:58:04 | 000,000,096 | ---- | C] () -- C:\Users\carolin3\AppData\Local\fusioncache.dat [2008.07.24 10:08:54 | 000,000,249 | ---- | C] () -- C:\Windows\BUHL.INI [2008.07.24 09:53:08 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [1998.05.11 00:00:00 | 000,748,160 | ---- | C] () -- C:\Windows\System32\CO2C40EN.DLL [1996.11.18 23:15:52 | 000,131,072 | ---- | C] () -- C:\Windows\System32\P2SODBC.DLL [1996.11.18 23:15:50 | 000,054,272 | ---- | C] () -- C:\Windows\System32\P2IRDAO.DLL [1996.11.18 23:15:50 | 000,050,176 | ---- | C] () -- C:\Windows\System32\P2CTDAO.DLL [1996.11.18 23:15:50 | 000,036,352 | ---- | C] () -- C:\Windows\System32\P2BBND.DLL < End of report > |
|
15.10.2010, 07:23
| #32 |
  | Deutsche Bank Trojaner Hi,
__________________es sind im RkU einige redirections drin (da werden wir die Files bei virustotal auf patches untersuchen lassen) und viele versteckte Files... Ein direktes Rootkit ist mir nicht aufgefallen, werde mich mal schlau machen bzw. einen anderen Kompetenzler bitten mal drüberzuschauen (vielleicht sehe ich den Wald vor lauter Bäumen ja nicht)... Fix für OTL:
 Code:
ATTFilter
:OTL
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
:Commands
[emptytemp]
[EMPTYFLASH]
[purity]
[Reboot]
Versuchen wir mal die Hiddenfiles loszuwerden... Anleitung & Download: http://www.trojaner-board.de/51464-a...-ccleaner.html Installation des cCleaners ohne die Toolbar! Benutzerdefinierte Installation wählen. Dann startest du den Rechner im normalen Modus neu. Screenshot von Prevx: Auf der rechten Seite findest Du eien Taste "Druck" auf der Tastatur, die erstellt ein Bildschirmfoto. Dann öffnest Du Paint (oder sonst ein Bildbearbeitungsprogramm) und machst dort "Einfügen", dann den Ausschnitt mit dem PrevX-Fenster ausschneiden und hier posten. Suche folgende Dateien und lasse sie bei virustotal untersuchen, bei Funden log posten (wobei ich denke die sind sauber): IEShims.dll (wahrscheinlich in dem Ordner: Program Files\Internet Explorer) ieframe.dll (wahrscheinlich in dem Ordner: C:\Windows\System32 Wie hängst Du am Internet, per Router oder direkt? chris
__________________ |
|
15.10.2010, 09:04
| #33 |
| | Deutsche Bank Trojaner hier der OTL log:
__________________All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: carolin3 ->Temp folder emptied: 29161486 bytes ->Temporary Internet Files folder emptied: 50539731 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 1551 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 151556 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 76,00 mb [EMPTYFLASH] User: All Users User: carolin3 ->Flash cache emptied: 0 bytes User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.15.2 log created on 10152010_095810 Files\Folders moved on Reboot... Registry entries deleted on Reboot... 595MB mit CC gelöscht.... screenshot von Prevx geht nicht, hier daher folgender Eintarg manuel...: icactvol.dll in c:/otl/movedfiles/10132010_124948/C_users die beiden Dateien wurden nicht mehr gefunden, vermutlich durch den CC entfernt... IEShims.dll ieframe.dll Hänge per WLAN am Internet... jetzt scheint wieder alles zu laufen, vielleicht ist jetzt alles bereinigt? |
|
15.10.2010, 09:59
| #34 |
| | Deutsche Bank Trojaner Hi, die Datei, die gefunden wurde von PrevX (icactvol.dll) ist der Banking-Trojaner, der laut einem parallel-Thread tatsächlich zumindest auch EBay-Passwörter mit "abgreift". Die Datei befindet sich im Backupverzeichnis von OTL, da wir sie dahin verschoben haben (sie ist da ungefährlich, wenn wir fertig sind müssen wir nur dran denken das _olt-Verzeichnis zu löschen) D. h. für uns, sobald wir eine Infektion dieser Art erkennen, müssen wir den User darauf hinweisen, sofort alle Passwörter von einem sauberen Rechner aus zu ändern... Ich warte noch auf das Feedback eines Kollegen bezüglich dem RuH-Logs, dann melde ich mich wieder... Und -wie gesagt- ist die Empfehlung Neuaufzusetzen nach dieser Infektion ... chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
15.10.2010, 12:56
| #35 |
| | Deutsche Bank Trojaner in Ordnung....Wie entfernen ich denn das olt-Verzeichnis mit dem Trojaner am Besten, oder soll ich noch warten? Gruss |
|
15.10.2010, 21:09
| #36 |
| | Deutsche Bank Trojaner Hi, nach Anregung vom Kollegen neuer Anlauf... temp. FileCleaner (TFC) Lade Dir TFC runter (http://filepony.de/download-tfc/) und speichere ihn auf dem Desktop. Falls Du noch nicht Deine Arbeit/offene Files gespeichert hast, jetzt durchführen, alle anderen Anwendungen schließen (sonst übernimmt TFC das inklusive Browser, speichert aber nicht!) Start jetzt die TFC.exe (Vista/Win7-User als Admin starten! [Rechtsklick und "Als Administrator ausführen"]). Beginne mit der Bereinigung durch "Start", nicht unterbrechen. TFC wird Dich auffordern den Rechner neu zu starten, das sofort machen. Lösche den alten Combofix und lade Dir Ihn neu runter (er wird jeden Tag neu zusammengebaut) http://download.bleepingcomputer.com/sUBs/ComboFix.exe und lass ihn laufen (ggf. im abgesicherten Modus)... Danach: Downloade Dir bitte Rorschach's Custom Scan.txt von GeeksToGo.com und speichere diese als Scan.txt dort, wo sich auch die OTL.exe befindet. Starte nun OTL und klicke in die Custom Scans/Fixes Box. Wähle nun die zuvor gedownloadete Scan.txt aus und klicke OK. Danach klicke in OTL auf Scan. Poste bitte die OTL.txt chris
__________________ --> Deutsche Bank Trojaner |
|
16.10.2010, 18:47
| #37 |
| | Deutsche Bank Trojaner hier schonmal der log von Combofix: ComboFix 10-10-15.04 - carolin3 16.10.2010 19:31:25.2.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.2165 [GMT 2:00] ausgeführt von:: c:\users\carolin3\Downloads\ComboFix.exe SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((( Dateien erstellt von 2010-09-16 bis 2010-10-16 )))))))))))))))))))))))))))))) . 2010-10-16 17:41 . 2010-10-16 17:41 -------- d-----w- c:\users\carolin3\AppData\Local\temp 2010-10-16 17:41 . 2010-10-16 17:41 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-10-15 21:29 . 2010-09-09 22:52 6084944 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A67CF9FA-F5DC-442C-B8DB-A92AB4178E4E}\mpengine.dll 2010-10-15 08:07 . 2010-10-15 08:08 -------- d-----w- C:\CCleaner 2010-10-14 21:54 . 2010-08-31 13:27 2038272 ----a-w- c:\windows\system32\win32k.sys 2010-10-14 21:48 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll 2010-10-14 21:48 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll 2010-10-14 21:48 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll 2010-10-14 15:43 . 2010-10-14 15:43 70192 ----a-w- c:\windows\system32\PxSecure.dll 2010-10-14 15:43 . 2010-10-14 15:43 74624 ----a-w- c:\windows\system32\drivers\pxrts.sys 2010-10-14 15:43 . 2010-10-14 15:43 30320 ----a-w- c:\windows\system32\drivers\pxscan.sys 2010-10-14 15:43 . 2010-10-14 15:43 24400 ----a-w- c:\windows\system32\drivers\pxkbf.sys 2010-10-14 15:43 . 2010-10-14 15:43 -------- d-----w- c:\program files\Prevx 2010-10-14 08:19 . 2010-10-14 08:19 -------- d-----w- c:\users\carolin3\DoctorWeb 2010-10-13 10:49 . 2010-10-16 17:03 -------- d-----w- C:\_OTL 2010-10-11 15:40 . 2010-10-11 15:40 -------- d-----w- c:\users\carolin3\AppData\Roaming\Malwarebytes 2010-10-11 15:40 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-10-11 15:40 . 2010-10-11 15:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-10-11 15:40 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-09-28 22:59 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll 2010-09-28 22:59 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-26 68856] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "ScanSoft PDF Create! 4-reminder"="c:\program files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe" [2006-11-16 35368] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-29 185872] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] " Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] t@x aktuell.lnk - c:\program files\Buhl finance\tax 2010 Professional\taxaktuell.exe [2010-1-22 558376] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 135664] R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2006-04-06 264704] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2010-10-14 30320] S0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\DRIVERS\Si3531.sys [2007-06-01 210736] S1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2010-10-14 74624] S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2010-10-14 6407728] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368] S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2007-11-21 327168] S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2010-10-14 24400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Inhalt des "geplante Tasks" Ordners 2010-10-16 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-24 10:10] 2010-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:31] 2010-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:31] . . ------- Zusätzlicher Suchlauf ------- . IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 . . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Zeit der Fertigstellung: 2010-10-16 19:45:04 ComboFix-quarantined-files.txt 2010-10-16 17:45 Vor Suchlauf: 18 Verzeichnis(se), 95.906.652.160 Bytes frei Nach Suchlauf: 19 Verzeichnis(se), 95.885.148.160 Bytes frei |
|
16.10.2010, 19:09
| #38 |
| | Deutsche Bank Trojaner und hier der log von OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 16.10.2010 19:58:44 - Run 3 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Burghard Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18975) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 122,86 Gb Total Space | 89,33 Gb Free Space | 72,71% Space Free | Partition Type: NTFS Drive D: | 26,18 Gb Total Space | 26,18 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: CAROLIN3-PC | User Name: carolin3 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Programme\Prevx\prevx.exe (Prevx) PRC - C:\Burghard\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10k_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.) PRC - c:\Programme\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Burghard\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msshsq.dll (Microsoft Corporation) MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation) MOD - C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation) MOD - C:\Windows\System32\SLC.dll (Microsoft Corporation) MOD - C:\Windows\System32\EhStorShell.dll (Microsoft Corporation) MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation) MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation) MOD - C:\Windows\System32\duser.dll (Microsoft Corporation) MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (RoxLiveShare9) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe File not found SRV - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx) SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (hpqcxs08) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.) SRV - (hpqddsvc) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.) SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (catchme) -- C:\Users\carolin3\AppData\Local\Temp\catchme.sys File not found DRV - (pxrts) -- C:\Windows\System32\drivers\pxrts.sys (Prevx) DRV - (pxscan) -- C:\Windows\System32\drivers\pxscan.sys (Prevx) DRV - (pxkbf) -- C:\Windows\System32\drivers\pxkbf.sys (Prevx) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation) DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.) DRV - (netr28) -- C:\Windows\System32\drivers\netr28.sys (Ralink Technology, Corp.) DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.) DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc) DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.) DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 37 9C 55 D8 C8 6A CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.30 00:41:10 | 000,000,000 | ---D | M] [2010.02.01 13:27:36 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions [2010.02.01 13:27:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2008.12.30 00:41:59 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Firefox\Profiles\sfu17z5e.default\extensions [2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2008.12.30 00:40:25 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\Windows\System32\PxSecure.dll (Prevx) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [HP Software Update] C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [ScanSoft PDF Create! 4-reminder] C:\Program Files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.10.16 19:45:07 | 000,000,000 | ---D | C] -- C:\Windows\temp [2010.10.16 19:45:07 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Local\temp [2010.10.16 19:44:04 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2010.10.16 19:28:08 | 000,000,000 | ---D | C] -- C:\ComboFix [2010.10.16 19:26:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe [2010.10.15 10:07:57 | 000,000,000 | ---D | C] -- C:\CCleaner [2010.10.14 23:55:57 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL [2010.10.14 23:55:35 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll [2010.10.14 23:55:17 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010.10.14 23:55:11 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.10.14 23:55:10 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.10.14 23:55:10 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.10.14 23:55:09 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010.10.14 23:55:08 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.10.14 23:55:08 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.10.14 23:55:07 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.10.14 23:55:07 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010.10.14 23:55:07 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.10.14 23:55:07 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010.10.14 23:55:07 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2010.10.14 23:55:07 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010.10.14 23:55:07 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010.10.14 23:55:07 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.10.14 23:55:07 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.10.14 23:55:06 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.10.14 23:55:06 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.10.14 23:55:04 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll [2010.10.14 23:55:02 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll [2010.10.14 23:54:48 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.10.14 23:48:46 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll [2010.10.14 23:48:40 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll [2010.10.14 17:43:25 | 000,070,192 | ---- | C] (Prevx) -- C:\Windows\System32\PxSecure.dll [2010.10.14 17:43:24 | 000,074,624 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys [2010.10.14 17:43:24 | 000,030,320 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys [2010.10.14 17:43:23 | 000,024,400 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys [2010.10.14 17:43:23 | 000,000,000 | ---D | C] -- C:\Programme\Prevx [2010.10.14 17:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI [2010.10.14 10:19:56 | 000,000,000 | ---D | C] -- C:\Users\carolin3\DoctorWeb [2010.10.13 13:05:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2010.10.13 13:05:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2010.10.13 13:05:40 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2010.10.13 13:05:17 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2010.10.13 13:01:00 | 000,000,000 | ---D | C] -- C:\Qoobox [2010.10.13 12:49:48 | 000,000,000 | ---D | C] -- C:\_OTL [2010.10.11 17:40:30 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Roaming\Malwarebytes [2010.10.11 17:40:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.10.11 17:40:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.10.11 17:40:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.10.11 17:40:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.09.29 00:59:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.09.26 18:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant [1996.11.18 23:15:46 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\IMPLODE.DLL ========== Files - Modified Within 30 Days ========== [2010.10.16 19:41:26 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.10.16 19:41:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.10.16 19:18:09 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2010.10.16 19:16:25 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.10.16 19:16:24 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.10.16 19:15:53 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.16 19:15:52 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.16 19:15:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.16 16:58:16 | 000,002,651 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Excel.lnk [2010.10.16 13:45:11 | 000,002,623 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Word.lnk [2010.10.15 09:11:11 | 000,248,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.10.14 17:43:25 | 000,070,192 | ---- | M] (Prevx) -- C:\Windows\System32\PxSecure.dll [2010.10.14 17:43:24 | 000,074,624 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys [2010.10.14 17:43:24 | 000,030,320 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys [2010.10.14 17:43:23 | 000,024,400 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys [2010.10.13 19:51:17 | 000,016,896 | ---- | M] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.10.13 18:07:22 | 000,000,940 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk [2010.10.11 17:40:23 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.30 14:44:55 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk ========== Files Created - No Company Name ========== [2010.10.13 13:05:40 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2010.10.13 13:05:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.10.13 13:05:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.10.13 13:05:40 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.10.13 13:05:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.10.11 17:40:23 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.30 14:44:55 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2010.05.31 16:15:41 | 000,000,032 | --S- | C] () -- C:\Users\carolin3\AppData\Local\770160558.dat [2009.09.27 10:30:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.12 21:16:57 | 000,007,916 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d9caps.dat [2009.03.04 11:43:24 | 000,000,182 | ---- | C] () -- C:\Windows\wininit.ini [2008.12.13 16:48:31 | 000,000,012 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\settings.xml [2008.12.13 16:48:30 | 000,000,235 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\devices.xml [2008.10.26 18:25:14 | 000,028,672 | ---- | C] () -- C:\Windows\System32\nnr.dll [2008.10.26 11:49:15 | 000,000,552 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d8caps.dat [2008.08.09 11:46:50 | 000,016,896 | ---- | C] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.07.28 13:12:14 | 000,000,924 | ---- | C] () -- C:\Windows\wiso.ini [2008.07.25 10:58:04 | 000,000,096 | ---- | C] () -- C:\Users\carolin3\AppData\Local\fusioncache.dat [2008.07.24 10:08:54 | 000,000,249 | ---- | C] () -- C:\Windows\BUHL.INI [2008.07.24 09:53:08 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [1998.05.11 00:00:00 | 000,748,160 | ---- | C] () -- C:\Windows\System32\CO2C40EN.DLL [1996.11.18 23:15:52 | 000,131,072 | ---- | C] () -- C:\Windows\System32\P2SODBC.DLL [1996.11.18 23:15:50 | 000,054,272 | ---- | C] () -- C:\Windows\System32\P2IRDAO.DLL [1996.11.18 23:15:50 | 000,050,176 | ---- | C] () -- C:\Windows\System32\P2CTDAO.DLL [1996.11.18 23:15:50 | 000,036,352 | ---- | C] () -- C:\Windows\System32\P2BBND.DLL ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2008.03.24 21:38:45 | 000,271,100 | ---- | M] () -- C:\10_FelixGabriel.pdf [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2003.04.02 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin [2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2008.07.23 13:05:04 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2010.10.16 19:45:05 | 000,007,833 | ---- | M] () -- C:\ComboFix.txt [2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2008.06.09 09:56:19 | 000,000,531 | ---- | M] () -- C:\hpfr3420 (1).xml [2007.03.26 15:23:21 | 000,001,002 | ---- | M] () -- C:\hpfr3420.log [2008.07.23 11:10:46 | 000,000,000 | ---- | M] () -- C:\hpfr3420.xml [2008.06.09 09:56:19 | 000,833,913 | ---- | M] () -- C:\hpfr3425 (1).log [2008.07.23 11:10:48 | 000,024,881 | ---- | M] () -- C:\hpfr3425.log [2007.09.02 12:30:20 | 000,001,088 | -H-- | M] () -- C:\hpothb07.dat [2007.09.02 12:30:20 | 000,010,711 | -H-- | M] () -- C:\hpothb07.tif [2006.11.23 23:40:38 | 000,000,558 | ---- | M] () -- C:\INSTALL.LOG [2008.03.07 17:24:05 | 000,000,426 | ---- | M] () -- C:\InstallHelper (1).log [2010.08.30 10:03:34 | 000,003,290 | ---- | M] () -- C:\InstallHelper.log [2009.11.06 13:41:10 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2008.03.19 17:04:32 | 007,171,614 | ---- | M] () -- C:\mgakat.pdf [2009.11.06 13:41:10 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.10.16 19:15:24 | 3533,373,440 | -HS- | M] () -- C:\pagefile.sys [2008.04.02 16:47:45 | 000,018,103 | ---- | M] () -- C:\PaketscheinServletInt [2008.05.19 08:07:50 | 000,024,927 | ---- | M] () -- C:\pdf [2010.10.14 11:13:11 | 000,056,578 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_14.10.2010_11.10.26_log.txt [2007.09.23 13:48:51 | 000,500,898 | ---- | M] () -- C:\vcredist_x86.log [2005.08.26 17:14:06 | 000,000,440 | ---- | M] () -- C:\Verknüpfung mit Eigene Dateien.lnk < %systemroot%\Fonts\*.com > [2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2010.03.06 13:25:54 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > [2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > [2008.01.19 09:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL [2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2008.08.10 10:24:47 | 000,000,174 | -HS- | M] () -- C:\Programme\desktop.ini < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > [2009.06.20 15:15:36 | 000,000,574 | -HS- | M] () -- C:\Users\carolin3\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > [2008.09.18 16:02:06 | 000,000,402 | -HS- | M] () -- C:\Users\carolin3\Favorites\desktop.ini < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > [2010.09.10 13:45:19 | 000,002,204 | ---- | M] () -- C:\ProgramData\hpzinstall.log [2009.06.20 16:14:46 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2010.10.16 19:16:24 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001 < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.exe > < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < %USERPROFILE%\Templates\*.tmp > < %SYSTEMDRIVE%\explorexxx.exe\*.* > < %Windir%\Installer\*.tmp > [4 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ] < %systemroot%\System32\*.xco > < %ProgramFiles%\system32\*.* > < %systemroot%\System32\windos\*.* > < %SystemRoot%\system32\sandbox\*.* > < %SystemRoot%\system32\*.amo > < %SystemRoot%\system32\Windows Live\*.* > < %ProgramFiles%\logs\*.* > < %ProgramFiles%\Bifrost\*.* > < %SystemRoot%\system32\*.goo > < %systemroot%\system32\IME\*.* > < %systemroot%\BackUp\*.* > < %systemroot%\system32\*.ico > [2006.09.18 23:31:55 | 000,107,620 | ---- | M] () -- C:\Windows\System32\acwizard.ico < %systemroot%\system\*.dat > < %systemroot%\system\*.exe > < %AppData%\Macromedia\Common\*.* > < %SYSTEMDRIVE%\dir\*.* /s > < %systemroot%\system32\ras\*.exe > < %SYSTEMDRIVE%\MFILES\*.* > < %SYSTEMDRIVE%\mDNSRespon.exe\*.* > < %systemroot%\system32\services\*.* > < %systemroot%\Spooler\*.* > < %ProgramFiles%\system32\*.* > < %systemroot%\system32\Setup\*.dll /x > < %systemroot%\system32\*.mine > < %SYSTEMDRIVE%\cleansweep.exe\*.* > < %systemroot%\system32\ras\*.dll > < %systemroot%\system32\ras\*.drv > < %systemroot%\*.iq > < %systemroot%\system32\XP\*.* > < %SYSTEMDRIVE%\Extracted\*.* > < %systemroot%\system32\windows\*.* > < %systemroot%\logs\*.* > < %SYSTEMDRIVE%\Win.Msi\*.* > < %systemroot%\regedit\*.* > < %systemroot%\system32\skype\*.* > < %AppData%\Adobe\dlluplwin25\*.* > < %UserProfile%\*.dat > [2010.10.16 20:05:38 | 003,407,872 | -HS- | M] () -- C:\Users\carolin3\ntuser.dat [2008.07.23 13:31:57 | 000,524,288 | -HS- | M] () -- C:\Users\carolin3\ntuser.dat_previous < %UserProfile%\*.dll > < %systemroot%\system32\*.sxo > < %SYSTEMDRIVE%\Gazma\*.* /s > < %systemroot%\system32\spynet\*.* > < %systemroot%\system32\System\*.* > < %appdata%\Microsoft\Windows\*.* > < %systemroot%\system32\WinDir\*.* > < %systemroot%\_\*.* > < %systemroot%\system32\windows32\*.* > < %ProgramFiles%\win\*.* > < %AppData%\Microsoft\CD Burning\*.* > < %systemroot%\*.cab > < %systemroot%\K.Backup\*.* > < %ProgramFiles%\Massenger\*.* > < %systemroot%\System32\*.doc > < %systemroot%\Office12\*.* > < %systemroot%\System32\Rundl32.exe\*.* > < %ProgramFiles%\yahoo.net\*.* > < %systemroot%\system32\*.igo > < %systemroot%\*.rew > < %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe > < %USERPROFILE%\.COMMgr\*.* > < %USERPROFILE%\Desktop\*.bat > < %PROGRAMFILES%\Common Files\Real\visualizations\*.* > [2008.12.30 00:41:08 | 000,043,008 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\Annabelle.rpv [2008.12.30 00:41:08 | 000,080,384 | ---- | M] () -- C:\Programme\Common Files\Real\Visualizations\CosmicBelt.rpv [2008.12.30 00:41:08 | 000,007,168 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\Fire.rpv [2008.12.30 00:41:08 | 000,007,680 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\FreqBands.rpv [2008.12.30 00:41:08 | 000,069,632 | ---- | M] () -- C:\Programme\Common Files\Real\Visualizations\Nebula.rpv < %PROGRAMFILES%\Internet Explorer\*.Jmp > < %PROGRAMFILES%\Windows NT\system\*.dll > < %systemroot%\system32\*.ext > < %systemroot%\system32\Com\*.cfg > < %systemroot%\system32\btz\*.* > < %systemroot%\system32\EMP\*.* > < %systemroot%\system32\expo\*.* > < %systemroot%\system32\inet2\*.* > < %systemroot%\system32\xrem\*.* > < %ProgramFiles%\Microsoft\*.* > < %systemroot%\usgwmt\*.* > < %ProgramFiles%\B\*.* > < %SYSTEMDRIVE%\lspp\*.* > < %systemroot%\Kral\*.* > < %SYSTEMDRIVE%\windowsdvd.exe\*.* > < %systemroot%\system32\*.ipo > < %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* > < %systemroot%\system32\*.mof > < %systemroot%\*.atm > < %systemroot%\system32\svhost\*.* > < %ProgramFiles%\system32\*.* > < %ProgramFiles%\Docmentt\*.* > < %systemroot%\Help\*.vbs > < %ProgramFiles%\Windows WinSxs\*.* /s > < %ProgramFiles%\Outlook Express\IDT\*.* /s > < %ProgramFiles%\Microsoft Office\365\*.* /s > < %ProgramFiles%\Windows Live\*.* > < %systemroot%\system32\win32\*.* > < %SYSTEMDRIVE%\RECYCLER\*.* > < %systemroot%\Fresh1\*.* > < %ProgramFiles%\Kekj\*.* /s > < %systemroot%\GDU\*.* > < %systemroot%\KA\*.* > < %systemroot%\R\*.* > < %systemroot%\system32\*.fyo > < %USERPROFILE%\System\*.* > < %systemroot%\Source\*.* > < %systemroot%\system32\ac\*.* > < %ProgramFiles%\MSDN\*.* > < %AppData%\AdobeUM\winvcldll54\*.* /s > < %ProgramFiles%\Internet Explorer\*.ico > < %systemroot%\system32\*.ojo > < %systemroot%\system32\d323s\*.* > < %systemroot%\system32\re\*.* > < %UserProfile%\Microsoft\*.dll > < %UserProfile%\Microsoft\*.log > < %systemroot%\Bios\*.* > < %ProgramFiles%\Spool\*.* > < %ProgramFiles%\promp3\*.* > < %SYSTEMDRIVE%\Driver\*.* /s > < %SYSTEMDRIVE%\inetserver.exe\*.* > < %systemroot%\java\trustlib\*.* > < %ProgramFiles%\Common Files\designer\*.exe > < %ProgramFiles%\*. > [2010.07.26 17:07:33 | 000,000,000 | ---D | M] -- C:\Programme\Adobe [2009.03.04 09:55:41 | 000,000,000 | ---D | M] -- C:\Programme\avmwlanstick [2008.07.29 09:21:33 | 000,000,000 | ---D | M] -- C:\Programme\BMWi [2010.01.22 10:47:20 | 000,000,000 | ---D | M] -- C:\Programme\Buhl finance [2010.10.16 19:36:24 | 000,000,000 | ---D | M] -- C:\Programme\Common Files [2008.04.25 05:40:50 | 000,000,000 | ---D | M] -- C:\Programme\CyberLink [2008.06.09 19:20:10 | 000,000,000 | ---D | M] -- C:\Programme\eBay [2008.06.10 17:57:36 | 000,000,000 | ---D | M] -- C:\Programme\FRITZ!Box [2008.06.10 17:58:20 | 000,000,000 | ---D | M] -- C:\Programme\FRITZ!DSL [2009.03.04 10:12:42 | 000,000,000 | ---D | M] -- C:\Programme\fun communications GmbH [2008.07.23 12:27:20 | 000,000,000 | -HSD | M] -- C:\Programme\Gemeinsame Dateien [2010.10.11 19:41:45 | 000,000,000 | ---D | M] -- C:\Programme\Google [2010.07.01 17:33:12 | 000,000,000 | ---D | M] -- C:\Programme\Hewlett-Packard [2008.04.25 05:48:14 | 000,000,000 | ---D | M] -- C:\Programme\HomeCinema [2010.07.01 17:31:49 | 000,000,000 | ---D | M] -- C:\Programme\HP [2010.10.11 20:08:03 | 000,000,000 | -H-D | M] -- C:\Programme\InstallShield Installation Information [2008.04.24 08:50:45 | 000,000,000 | ---D | M] -- C:\Programme\Intel [2010.10.15 09:08:18 | 000,000,000 | ---D | M] -- C:\Programme\Internet Explorer [2008.07.26 11:48:52 | 000,000,000 | ---D | M] -- C:\Programme\K-Lab [2008.04.25 04:59:21 | 000,000,000 | ---D | M] -- C:\Programme\Launch Manager [2008.06.10 17:08:02 | 000,000,000 | ---D | M] -- C:\Programme\Logitech [2010.10.11 17:40:24 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware [2008.06.10 17:08:02 | 000,000,000 | ---D | M] -- C:\Programme\MGI [2009.07.21 23:57:38 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft [2008.06.13 03:03:25 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft CAPICOM 2.1.0.2 [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Games [2008.06.10 17:08:15 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Office [2010.10.13 18:07:26 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Security Essentials [2010.06.26 03:02:22 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft.NET [2010.08.13 14:37:11 | 000,000,000 | ---D | M] -- C:\Programme\Movie Maker [2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\MSBuild [2010.01.17 15:14:37 | 000,000,000 | ---D | M] -- C:\Programme\MSECache [2008.06.13 03:01:18 | 000,000,000 | ---D | M] -- C:\Programme\MSXML 4.0 [2008.04.25 05:08:28 | 000,000,000 | ---D | M] -- C:\Programme\Nero [2009.08.06 17:16:14 | 000,000,000 | ---D | M] -- C:\Programme\NetObjects [2010.04.23 17:48:02 | 000,000,000 | ---D | M] -- C:\Programme\NVIDIA Corporation [2010.10.14 17:43:23 | 000,000,000 | ---D | M] -- C:\Programme\Prevx [2009.01.02 11:30:30 | 000,000,000 | ---D | M] -- C:\Programme\QuickTime [2008.12.30 00:40:57 | 000,000,000 | ---D | M] -- C:\Programme\Real [2008.04.24 11:33:09 | 000,000,000 | ---D | M] -- C:\Programme\Realtek [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Reference Assemblies [2009.09.30 12:26:37 | 000,000,000 | ---D | M] -- C:\Programme\Research In Motion [2008.06.09 19:43:01 | 000,000,000 | ---D | M] -- C:\Programme\ScanSoft [2008.04.25 04:46:52 | 000,000,000 | ---D | M] -- C:\Programme\Softex [2008.04.25 04:34:29 | 000,000,000 | ---D | M] -- C:\Programme\Synaptics [2006.11.02 15:01:55 | 000,000,000 | -H-D | M] -- C:\Programme\Uninstall Information [2010.03.06 13:33:36 | 000,000,000 | ---D | M] -- C:\Programme\Windows Calendar [2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Collaboration [2010.03.06 13:33:34 | 000,000,000 | ---D | M] -- C:\Programme\Windows Defender [2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Journal [2009.07.21 23:57:33 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live [2009.07.21 23:57:19 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live SkyDrive [2010.09.17 21:30:54 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mail [2010.10.15 09:08:19 | 000,000,000 | ---D | M] -- C:\Programme\Windows Media Player [2008.07.23 12:27:20 | 000,000,000 | ---D | M] -- C:\Programme\Windows NT [2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Photo Gallery [2010.03.08 10:51:57 | 000,000,000 | ---D | M] -- C:\Programme\Windows Portable Devices [2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Sidebar [2009.11.22 13:29:09 | 000,000,000 | ---D | M] -- C:\Programme\WinRAR < %systemroot%\system32\*.tso > < %ALLUSERSPROFILE%\Documents\Server\*.* > < %systemroot%\*.pif > [2006.09.18 23:43:58 | 000,000,707 | ---- | M] () -- C:\Windows\_default.pif < %systemroot%\system32\n7533\*.* > < %systemroot%\Us18336\*.* > < %systemroot%\system32\*.zip > < %systemroot%\system32\*.wgo > < %ProgramFiles%\Microsoft Office\OFFICE11\*.* > < %systemroot%\system32\dllcache\*.com > < %systemroot%\system32\dllchache\*.* > < %systemroot%\system32\038840\*.* > < %systemroot%\system32\13E92A\*.* > < %systemroot%\system32\1CB5AD\*.* > < %systemroot%\system32\52682A\*.* > < %USERPROFILE%\My Documents\*.htm > < %SYSTEMDRIVE%\Mr_CF\*.* > < %USERPROFILE%\My Documents\*.dll > < %USERPROFILE%\My Documents\*.ccc > < %systemroot%\system32\Sis\*.* > < %systemroot%\Microsft\*.* > < %SYSTEMDRIVE%\driverwinx.exe\*.* > < %systemroot%\BifroXx\*.* > < %SYSTEMDRIVE%\TSTP\*.* > < %systemroot%\winsn\*.* > < %ProgramFiles%\windata\*.* > < %SYSTEMDRIVE%\msixxxxxxx.exe\*.* > < %systemroot%\system32\*.sao > < %systemroot%\system32\*.iem > < %systemroot%\system32\*.mdd > < %systemroot%\system32\*.wlo > < %systemroot%\system32\*.skn > < %SYSTEMDRIVE%\Winup\*.* > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-15 07:07:25 < End of report > Ist damit alles wieder in Ordnung? mir sagt das leider nichts.... |
|
16.10.2010, 19:11
| #39 |
| | Deutsche Bank Trojaner .... und soll ich noch über OTL bereinigen??? Gruss Burg |
|
16.10.2010, 20:23
| #40 |
| | Deutsche Bank Trojaner Hi, mir ist nur ein arg großes, steinaltes Icon aufgefallen Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code:
ATTFilter C:\Windows\System32\acwizard.ico
chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
16.10.2010, 23:22
| #41 |
| | Deutsche Bank Trojaner File name: acwizard.ico Submission date: 2009-09-13 22:32:38 (UTC) Current status: finished Result: 0 /41 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result a-squared 4.5.0.24 2009.09.13 - AhnLab-V3 5.0.0.2 2009.09.13 - AntiVir 7.9.1.14 2009.09.11 - Antiy-AVL 2.0.3.7 2009.09.11 - Authentium 5.1.2.4 2009.09.13 - Avast 4.8.1351.0 2009.09.13 - AVG 8.5.0.412 2009.09.13 - BitDefender 7.2 2009.09.13 - CAT-QuickHeal 10.00 2009.09.12 - ClamAV 0.94.1 2009.09.13 - Comodo 2308 2009.09.13 - DrWeb 5.0.0.12182 2009.09.13 - eSafe 7.0.17.0 2009.09.13 - eTrust-Vet 31.6.6733 2009.09.11 - F-Prot 4.5.1.85 2009.09.13 - F-Secure 8.0.14470.0 2009.09.13 - Fortinet 3.120.0.0 2009.09.13 - GData 19 2009.09.13 - Ikarus T3.1.1.72.0 2009.09.13 - Jiangmin 11.0.800 2009.09.13 - K7AntiVirus 7.10.843 2009.09.12 - Kaspersky 7.0.0.125 2009.09.13 - McAfee 5740 2009.09.13 - McAfee+Artemis 5740 2009.09.13 - McAfee-GW-Edition 6.8.5 2009.09.13 - Microsoft 1.5005 2009.09.13 - NOD32 4422 2009.09.13 - Norman 6.01.09 2009.09.11 - nProtect 2009.1.8.0 2009.09.12 - Panda 10.0.2.2 2009.09.13 - PCTools 4.4.2.0 2009.09.11 - Prevx 3.0 2009.09.13 - Rising 21.46.61.00 2009.09.13 - Sophos 4.45.0 2009.09.13 - Sunbelt 3.2.1858.2 2009.09.13 - Symantec 1.4.4.12 2009.09.13 - TheHacker 6.3.4.4.402 2009.09.12 - TrendMicro 8.950.0.1094 2009.09.13 - VBA32 3.12.10.10 2009.09.13 - ViRobot 2009.9.12.1932 2009.09.12 - VirusBuster 4.6.5.0 2009.09.13 - Additional informationShow all MD5 : 7be52d9078078a5a8730eee4021a7b82 SHA1 : 8b7c5af14a17ce70934075d23ad6683fb6ecf1c2 SHA256: 30159b62a44712d9c567c56b187169eb898ee53a6aab693319911c09027facb9 ssdeep: 3072:lKfL4cccrGKFNe9209gItp/FghzyAJc6bPjmb1Q:lAMcccrGmNzLGpdg19bPym File size : 107620 bytes First seen: 2009-03-11 22:42:19 Last seen : 2009-09-13 22:32:38 Magic: MS Windows icon resource - 15 icons, 16-colors TrID: Windows Icon (57.2%) MPEG Video (42.7%) PEiD: - RDS: NSRL Reference Data Set Microsoft Installed Vista Ultimate, NSRL: acwizard.ico VT Community 0 This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis: MD5: 7be52d9078078a5a8730eee4021a7b82 Date first seen: 2009-03-11 22:42:19 (UTC) Date last seen: 2009-09-13 22:32:38 (UTC) Detection ratio: 0/41 What do you wish to do? dann scheints jetzt zu passen? weiss net obs von Belang ist, aber Microsoft Defender hat gestern Mittag plötzlich einen Trojaner gemeldet: win32/ursnif. Hab den dann löschen lassen... |
|
17.10.2010, 20:02
| #42 |
| | Deutsche Bank Trojaner Hi, wo und welcher Dateiname...? chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
17.10.2010, 21:34
| #43 |
| | Deutsche Bank Trojaner weiss ich nicjt, da steht nur Trojanspy:Win32/Ursnif Meinst Du denn, dass jetzt alles wieder ok ist? Gruss Burg Hallo, muss Euch nochmals nerven. Auf einmal wird meine Festplatte immer voller obwohl ich keine neuen Programme oder ähnliches speichere. Pro Tag ca. 1-2GB. Was könnte da los sein? Gruss Burg |
|
22.10.2010, 06:38
| #44 |
| | Deutsche Bank Trojaner Hi, prüfe hiermit wo der Speicher "verbraten" wird. JAM Software - Windows Freeware - Nützliche Tools für Windows Du kannst auch probehalber die Systemwiederherstellung ausschalten.. chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
| Themen zu Deutsche Bank Trojaner |
| abfrage, anti-malware, bösartige, dateien, deutsche, deutsche bank, ergebnis, explorer, folge, folgendes, hallo zusammen, malware, microsoft, minute, nicht mehr, programm, service, sobald, tan abfrage, tans, troja, trojane, trojaner, version, verzeichnisse, virenprogramm, vollständiger, zusammen |
Linear-Darstellung
