TR/Agent.123 und WORM/VB.EL.1 gefunden, Neuinstallation nötig?
Hallo,
Ich habe gestern einen Routinescan mit Avira auf dem Laptop meiner Mutter durchgeführt, und es gab gleich 2 Funde sowie eine verdächtige Datei (von Avira als HEUR/Malware bezeichnet). Ich hatte allerdings vorher Avira nach den Anweisungen hier im Forum ("aggressive Einstellungen") eingestellt, vorher lief es mit den Standardeinstellungen und hatte wohl nie etwas gemeldet. Deshalb dachte ich auch zunächst an einen Fehlalarm und wollte die betreffenden Dateien bei jotti hochladen und überprüfen lassen. Ich habe sie also aus der Quarantäne in einen dafür erstellten Ordner wiederhergestellt um sie von dort aus hochzuladen, der Zugriff auf die Dateien wird jedoch verweigert (vermutlich von Avira? Allerdings auch noch, wenn ich den betreffenden Ordner bei Avira von der Suche ausnehme, und auch wenn ich im Administratorkonto arbeite. Wortlaut der Fehlermeldung in etwa: Sie haben keine Berechtigung auf die Datei zuzugreifen, wenden Sie sich an den Administrator oder Besitzer der Datei).
Naja, Ende der Geschichte ist, dass ich die Dateien erneut in die Quarantäne verschoben habe. Avira (also der Guard) ist danach noch mal auf eine Datei im Papierkorb angesprungen, wieder verdächtig in der Heuristik. Ist jetzt auch in der Quarantäne.
Hier die Erstfunde: Zitat:
D:\WIN\Keyboard\V_Keyboard.exe
[FUND] Enthält verdächtigen Code: HEUR/Malware
[HINWEIS] Der Fund wurde als verdächtig eingestuft.
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4baaefd0.qua' verschoben!
D:\AUTORUN.INF
[FUND] Ist das Trojanische Pferd TR/Agent.123
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5306c06d.qua' verschoben!
D:\sal.xls.exe
[FUND] Enthält Erkennungsmuster des Wurmes WORM/VB.EL.1
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '01419a99.qua' verschoben!
| Ich habe dann einen Scan mit Malwarebytes durchgeführt (laut dieser Anleitung, also mit Update vorher, etc.). Malwarebytes hat nichts gefunden.
Ich habe mich eigentlich schon mit dem Gedanken angefreundet den Rechner neu aufzusetzen (ist nicht viel drauf, ist also kein allzu großer Aufwand). Wenn es sich aber um Fehllarme handeln sollte, würde ich mir eine Neuinstallation natürlich gerne sparen (es ist zwar der Rechner meiner Mutter, aber das muss trotzdem ich machen, sie traut sich da nicht ran :)).
Das Problem ist, dass ich mir nicht sicher bin wie es im Falle einer Neuinstallation mit der Datensicherung (hauptsächlich Fotos, ein paar Office-Dukumente) aussieht? Infizieren diese Viren einen USB-Stick?
Ich dem Fall wäre das Problem ohnehin größer, da ein USB-Stick sowohl am Rechner von meinem Vater wie auch an dem meiner Mutter (um den es hier geht) benutzt wird. Es wären dann wohl beide Rechner infiziert?
Ich habe erst mal die Anleitungen hier befolgt und Defogger angewendet. Logfile ist diese hier, falls benötigt: Zitat:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:49 on 02/07/2011 (NJ3)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
| Probleme dabei: beim ersten mal "desable" entstand keine logfile, deshalb habe ich erneut auf "enable" und dann "desable" geklickt. Ach ja, und ein Neustart wurde nie angefordert.
Danach OTL:
OTL Logfile: Code:
OTL logfile created on: 02.07.2011 15:41:14 - Run 2
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Users\***\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
3,86 Gb Total Physical Memory | 2,17 Gb Available Physical Memory | 56,30% Memory free
7,71 Gb Paging File | 5,75 Gb Available in Paging File | 74,60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 29,30 Gb Total Space | 2,84 Gb Free Space | 9,70% Space Free | Partition Type: NTFS
Drive D: | 997,03 Mb Total Space | 495,26 Mb Free Space | 49,67% Space Free | Partition Type: FAT32
Drive F: | 259,02 Gb Total Space | 250,42 Gb Free Space | 96,68% Space Free | Partition Type: NTFS
Drive G: | 718,00 Mb Total Space | 686,63 Mb Free Space | 95,63% Space Free | Partition Type: NTFS
Computer Name: KJ3-PC | User Name: NJ3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\***\Desktop\Defogger.exe ()
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
========== Modules (SafeList) ==========
MOD - C:\Users\Hanne\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WiMAXAppSrv) -- C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe (Intel(R) Corporation)
SRV:64bit: - (DMAgent) -- C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe (Red Bend Ltd.)
SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Lbd) -- C:\Windows\SysNative\drivers\Lbd.sys (Lavasoft AB)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (bpusb) -- C:\Windows\SysNative\drivers\bpusb.sys (Intel Corporation)
DRV:64bit: - (bpmp) Intel(R) Centrino(R) -- C:\Windows\SysNative\drivers\bpmp.sys (Intel Corporation)
DRV:64bit: - (bpenum) -- C:\Windows\SysNative\drivers\bpenum.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (JME) JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits) -- C:\Windows\SysNative\drivers\JME.sys (JMicron Technology Corp.)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (btusbflt) -- C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (QIOMem) -- C:\Windows\SysNative\drivers\QIOMem.sys (TOSHIBA)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys ()
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 12 3B 09 B5 EB D5 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Sichere Suche"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.5
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.2.0.7165
FF - prefs.js..keyword.URL: "hxxp://es.search.yahoo.com/search?fr=mcafee&p="
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.02.26 18:19:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.06.29 19:05:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.05.03 17:22:05 | 000,000,000 | ---D | M]
[2011.02.20 14:40:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NJ3\AppData\Roaming\mozilla\Extensions
[2011.07.02 13:00:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NJ3\AppData\Roaming\mozilla\Firefox\Profiles\72x8gzyt.default\extensions
[2011.07.02 13:00:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NJ3\AppData\Roaming\mozilla\Firefox\Profiles\72x8gzyt.default\extensions\staged
[2011.07.01 19:44:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.02.21 13:11:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.05.03 17:21:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\NJ3\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\72X8GZYT.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.06.16 04:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.04.14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 08:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 08:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 08:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 08:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.02.23 10:54:45 | 000,002,027 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2010.01.01 08:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 08:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 21:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [GUCI_AVS] File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWirelessWiMAX] C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [set] File not found
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\NJ3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Process.exe - Shortcut.lnk = D:\WIN\Process\Process.exe (Quanta)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 80.58.61.250 80.58.61.254
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.04 04:46:46 | 000,004,486 | ---- | M] () - D:\AUTOEXEC.OLD -- [ FAT32 ]
O32 - AutoRun File - [2010.11.04 19:36:38 | 000,000,572 | ---- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2010.09.03 20:37:22 | 000,005,711 | ---- | M] () - D:\AUTOEXEC.BAK -- [ FAT32 ]
O33 - MountPoints2\{c52eae7c-c476-11df-aae0-20cf30963234}\Shell - "" = AutoRun
O33 - MountPoints2\{c52eae7c-c476-11df-aae0-20cf30963234}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.07.02 14:02:22 | 000,000,000 | ---D | C] -- C:\Users\NJ3\AppData\Roaming\Malwarebytes
[2011.07.02 14:02:12 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.07.02 14:02:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.07.02 14:02:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.07.02 14:02:06 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.07.02 14:02:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.06.29 19:31:56 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drvinst.exe
[2011.06.29 19:31:56 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\devrtl.dll
[2011.06.29 19:31:52 | 002,228,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssrch.dll
[2011.06.29 19:31:51 | 002,326,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tquery.dll
[2011.06.29 19:31:51 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tquery.dll
[2011.06.29 19:31:51 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssrch.dll
[2011.06.29 19:31:50 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssph.dll
[2011.06.29 19:31:50 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchProtocolHost.exe
[2011.06.29 19:31:49 | 000,779,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssvp.dll
[2011.06.29 19:31:49 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssvp.dll
[2011.06.29 19:31:49 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssph.dll
[2011.06.29 19:31:49 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mssphtb.dll
[2011.06.29 19:31:49 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SearchFilterHost.exe
[2011.06.29 19:31:49 | 000,075,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msscntrs.dll
[2011.06.29 19:31:48 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mssphtb.dll
[2011.06.29 19:31:48 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msscntrs.dll
[2011.06.29 19:28:10 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.06.29 19:28:10 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011.06.29 19:28:09 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011.06.29 19:28:09 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.06.29 19:28:09 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011.06.29 19:28:09 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.06.29 19:28:08 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.06.29 19:28:08 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.06.29 19:28:08 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011.06.29 19:28:08 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011.06.29 19:28:07 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011.06.29 19:28:07 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011.06.29 19:28:07 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011.06.29 19:28:07 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011.06.29 19:27:17 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2011.06.29 19:27:17 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1.dll
[2011.06.29 19:27:15 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2011.06.29 18:57:46 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.07.02 14:49:51 | 000,000,000 | ---- | M] () -- C:\Users\NJ3\defogger_reenable
[2011.07.02 14:02:12 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.07.02 12:59:03 | 000,017,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.02 12:59:03 | 000,017,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.02 12:47:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.02 12:47:41 | 3105,263,616 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.01 19:42:44 | 000,002,054 | ---- | M] () -- C:\Users\NJ3\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011.06.30 22:17:26 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.06.30 22:17:26 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.06.30 19:09:30 | 000,123,784 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.06.30 19:09:30 | 000,088,288 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.06.30 19:04:18 | 000,293,448 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.06.29 22:24:29 | 011,538,304 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.06.29 22:24:29 | 000,702,600 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2011.06.29 22:24:29 | 000,701,624 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat
[2011.06.29 22:24:29 | 000,699,362 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat
[2011.06.29 22:24:29 | 000,697,896 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2011.06.29 22:24:29 | 000,697,278 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2011.06.29 22:24:29 | 000,687,512 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat
[2011.06.29 22:24:29 | 000,652,006 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.06.29 22:24:29 | 000,640,350 | ---- | M] () -- C:\Windows\SysNative\perfh00E.dat
[2011.06.29 22:24:29 | 000,631,314 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2011.06.29 22:24:29 | 000,625,738 | ---- | M] () -- C:\Windows\SysNative\perfh01D.dat
[2011.06.29 22:24:29 | 000,624,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.06.29 22:24:29 | 000,559,940 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat
[2011.06.29 22:24:29 | 000,470,342 | ---- | M] () -- C:\Windows\SysNative\perfh006.dat
[2011.06.29 22:24:29 | 000,456,756 | ---- | M] () -- C:\Windows\SysNative\perfh014.dat
[2011.06.29 22:24:29 | 000,441,558 | ---- | M] () -- C:\Windows\SysNative\perfh00B.dat
[2011.06.29 22:24:29 | 000,361,692 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat
[2011.06.29 22:24:29 | 000,148,444 | ---- | M] () -- C:\Windows\SysNative\perfc00E.dat
[2011.06.29 22:24:29 | 000,137,196 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat
[2011.06.29 22:24:29 | 000,134,974 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2011.06.29 22:24:29 | 000,133,886 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat
[2011.06.29 22:24:29 | 000,133,074 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat
[2011.06.29 22:24:29 | 000,130,274 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2011.06.29 22:24:29 | 000,129,674 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.06.29 22:24:29 | 000,127,278 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2011.06.29 22:24:29 | 000,123,874 | ---- | M] () -- C:\Windows\SysNative\perfc01D.dat
[2011.06.29 22:24:29 | 000,121,922 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2011.06.29 22:24:29 | 000,106,522 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.06.29 22:24:29 | 000,089,570 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat
[2011.06.29 22:24:29 | 000,082,282 | ---- | M] () -- C:\Windows\SysNative\perfc00B.dat
[2011.06.29 22:24:29 | 000,079,938 | ---- | M] () -- C:\Windows\SysNative\perfc006.dat
[2011.06.29 22:24:29 | 000,077,230 | ---- | M] () -- C:\Windows\SysNative\perfc014.dat
[2011.06.29 22:24:29 | 000,069,228 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat
[2011.06.29 19:18:11 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.06.29 19:05:59 | 000,001,140 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.06.29 18:57:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.07.02 14:48:34 | 000,000,000 | ---- | C] () -- C:\Users\NJ3\defogger_reenable
[2011.07.02 14:02:12 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.02 16:10:29 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.05.02 16:10:29 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.04.03 18:09:30 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.25 23:25:03 | 000,165,525 | ---- | C] () -- C:\Windows\hpoins44.dat.temp
[2011.02.25 23:25:01 | 000,000,586 | ---- | C] () -- C:\Windows\hpomdl44.dat.temp
[2011.02.25 23:05:39 | 000,165,751 | ---- | C] () -- C:\Windows\hpoins44.dat
[2010.09.20 05:20:53 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.09.20 03:20:30 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.09.13 19:02:54 | 000,003,972 | ---- | C] () -- C:\Windows\SysWow64\drivers\PciBus.sys
[2010.09.13 08:58:23 | 000,000,017 | ---- | C] () -- C:\Users\NJ3\AppData\Local\resmon.resmoncfg
[2010.09.11 11:18:25 | 000,002,307 | ---- | C] () -- C:\Windows\SysWow64\GUCI_AVS.ini
[2010.09.11 11:18:25 | 000,000,641 | ---- | C] () -- C:\Windows\Remover.ini
[2010.09.11 10:58:19 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll
[2010.09.11 10:58:19 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll
[2010.09.11 10:58:18 | 000,870,560 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2010.09.11 10:58:18 | 000,104,636 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2010.09.11 10:58:16 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2010.09.11 10:58:03 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2009.08.18 23:49:41 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
[2009.07.14 05:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 02:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 02:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 00:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.13 23:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 21:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.11 09:30:02 | 000,000,586 | ---- | C] () -- C:\Windows\hpomdl44.dat
[2009.06.10 21:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
========== LOP Check ==========
[2011.03.18 20:43:26 | 000,000,000 | ---D | M] -- C:\Users\NJ3\AppData\Roaming\Canneverbe Limited
[2011.02.27 19:55:57 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
--- --- ---
Ich hoffe, jemand kann mir helfen. Vielen Dank schon mal! :) |
