Trojaner-Board - Zunächst Security Sphere 2012 --> beseitigt nun (noch) BOO/TDss.D

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Zunächst Security Sphere 2012 --> beseitigt nun (noch) BOO/TDss.D (https://www.trojaner-board.de/104236-zunaechst-security-sphere-2012-beseitigt-noch-boo-tdss-d.html)

Zunächst Security Sphere 2012 --> beseitigt nun (noch) BOO/TDss.D

Hallo liebes Trojaner-Board-Team,

ich bin ganz neu hier und mein erster Beitrag ist auch gleich ein Problem...

Zunächst hatte ich auf einmal ein Tool namens "Security Sphere 2012" bei mir auf dem Rechner, welches nach jedem Neustart "aufpoppte". Ich konnte es aber mittels der Anleitung http://www.trojaner-board.de/103761-...entfernen.html entfernen. Top!

Ernüchterung machte sich jedoch recht zügig breit: Avira kam mit folgender Viruswarnung: "Masterbootsektor HD0"; unerwünschtes Programm "BOO/TDss.D". Ein Löschen war/ist nicht möglich.

Nach weiteren Recherchen im Internet und u. a. dem vergeblichen Versuch das Programm tdsskiller.exe zu starten, wende ich mich mit meinem Problem letztlich doch persönlich an euch.

Folgende Informationen könnten noch nützlich sein:

- Malwarebytes habe ich für das Entfernen von Security Sphere benötigt, allerdings findet das Programm immer wieder Infizierungen. Das letzte Logfile ist beigefügt.
- in unregelmäßigen Abständen "pinkt" automatisch die Aufforderung hoch, dass ich doch bitte den iExplorer installieren möchte. Gerade aktuell mit der Aufforderung firefox (mein eigentlicher browser) zu installieren. Habe ich immer abgelehnt (hängt wohl auch mit dem Virus zusammen).

Ich habe eure Punkte zum Erstellen eines Themas befolgt (bzw. befolgen wollen). Folgende Abweichungen sind aufgetreten:

- defogger hat mich nicht zu einem Neustart aufgefordert (denke unproblematisch)
- ich habe ein 32-Bit-System und daher auch den Punkt 3 befolgt. Beim Start habe ich allerdings die beigefügte Fehlermeldung erhalten.
Darüber hinaus habe ich ein Bild der Auswahl des Gmer-Programms beigefügt; auf dieser Basis wurde der Scan durchgeführt.
Als Ergebnis kam nur: "GMER has not found system modification". Logfile ist leer.

Für eure Unterstützung bedanke ich mich ganz herzlich im Voraus!

Viele Grüße
Tim

OLT.txt

Code:

OTL logfile created on: 10/17/2011 1:16:36 PM - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\skrti011\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.18 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 65.14% Memory free

6.35 Gb Paging File | 5.09 Gb Available in Paging File | 80.17% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 565.07 Gb Total Space | 43.97 Gb Free Space | 7.78% Space Free | Partition Type: NTFS

Drive D: | 30.00 Gb Total Space | 9.61 Gb Free Space | 32.05% Space Free | Partition Type: NTFS

 

Computer Name: SKRTI011-PC | User Name: skrti011 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011/10/17 13:10:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

PRC - [2011/10/17 10:51:34 | 000,192,000 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\04700\lvvm.exe

PRC - [2011/10/17 10:51:03 | 000,284,160 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\E0104\A5448.exe

PRC - [2011/10/17 09:56:02 | 000,176,640 | ---- | M] () -- C:\Program Files\Internet Explorer\48DE\B7C.exe

PRC - [2011/06/28 18:14:54 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011/06/24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/04/28 21:10:35 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010/11/20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010/11/04 23:01:27 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010/09/14 05:46:26 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

PRC - [2010/07/27 08:05:14 | 001,620,584 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2010/06/21 22:53:44 | 000,436,264 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\WButton.exe

PRC - [2010/06/02 16:42:18 | 001,481,320 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe

PRC - [2010/05/10 21:28:50 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2010/05/10 21:28:50 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010/04/27 10:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010/03/04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009/12/14 20:25:00 | 000,200,704 | ---- | M] (Wistron) -- C:\Program Files\Launch Manager\HotkeyApp.exe

PRC - [2009/12/12 00:18:16 | 000,348,960 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\OSD.exe

PRC - [2009/12/03 01:37:30 | 002,684,200 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\Power2Go\Power2GoExpressServer.exe

PRC - [2009/11/07 12:46:52 | 000,020,480 | ---- | M] (X10) -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

PRC - [2009/10/23 02:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\WisLMSvc.exe

PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011/10/17 10:51:34 | 000,192,000 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\04700\lvvm.exe

MOD - [2011/10/17 10:51:03 | 000,284,160 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\E0104\A5448.exe

MOD - [2011/10/17 09:56:02 | 000,176,640 | ---- | M] () -- C:\Program Files\Internet Explorer\48DE\B7C.exe

MOD - [2011/10/15 09:06:07 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll

MOD - [2011/10/15 09:06:07 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\31fce331fded94dd06627603f6fe4562\Accessibility.ni.dll

MOD - [2011/10/15 09:05:06 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll

MOD - [2011/10/15 09:04:37 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll

MOD - [2011/10/15 09:04:28 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2010/11/13 02:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010/07/26 16:27:00 | 000,010,856 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll

MOD - [2010/02/12 16:20:04 | 000,031,840 | ---- | M] () -- C:\Program Files\Cyberlink\Shared files\RichVideops.dll

MOD - [2009/11/25 01:58:42 | 001,031,976 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\Language\DEU\P2GRC.dll

MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll

MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll

MOD - [2009/11/02 23:20:02 | 000,144,680 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLVistaAudioMixer.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011/06/28 18:14:54 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/04/28 21:10:35 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/03/15 05:41:49 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010/09/14 05:46:26 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

SRV - [2010/09/14 05:46:16 | 000,508,264 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

SRV - [2010/07/27 08:05:14 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010/05/10 21:28:50 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010/05/10 21:28:50 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010/03/04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2009/11/07 12:46:52 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- (x10nets)

SRV - [2009/10/23 02:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011/06/28 18:14:55 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/06/28 18:14:55 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010/09/14 05:46:26 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)

DRV - [2010/09/14 05:46:22 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)

DRV - [2010/09/14 05:46:18 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)

DRV - [2010/09/14 05:46:14 | 000,577,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)

DRV - [2010/07/26 16:27:00 | 010,325,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010/07/26 16:27:00 | 000,019,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvpciflt.sys -- (nvpciflt)

DRV - [2010/06/21 09:14:36 | 000,246,272 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)

DRV - [2010/05/24 15:46:34 | 000,193,056 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2010/05/10 21:28:49 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\HECI.sys -- (HECI) Intel(R)

DRV - [2010/04/27 09:28:46 | 000,146,568 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)

DRV - [2010/04/27 09:27:50 | 000,064,904 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)

DRV - [2010/04/01 10:13:38 | 001,009,184 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)

DRV - [2010/03/16 22:30:36 | 000,482,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_DWA.SYS -- (DWA)

DRV - [2010/03/16 22:30:12 | 000,791,040 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_HWA.SYS -- (hwa)

DRV - [2010/03/16 18:49:00 | 000,140,800 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_RCI.SYS -- (HWARadio)

DRV - [2010/03/04 17:53:08 | 000,067,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010/02/26 23:01:22 | 000,132,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)

DRV - [2009/08/13 08:39:40 | 000,786,400 | ---- | M] (DiBcom SA) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mod7700.sys -- (mod7700)

DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009/05/13 21:47:30 | 000,027,160 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)

DRV - [2009/05/13 21:26:26 | 000,013,720 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)

DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://medion.msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://medion.msn.com

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:57616

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.51

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 57616

FF - prefs.js..network.proxy.type: 1

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/17 00:08:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/23 21:43:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/23 19:24:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/17 00:08:52 | 000,000,000 | ---D | M]

 

[2010/10/30 17:27:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\skrti011\AppData\Roaming\mozilla\Extensions

[2010/10/30 17:27:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\skrti011\AppData\Roaming\mozilla\Firefox\Profiles\cskd47h4.default\extensions

[2010/12/30 10:46:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2010/12/30 10:46:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2011/02/17 00:08:52 | 000,000,000 | ---D | M] (HP Smart Web Printing) -- C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3

[2010/10/27 07:44:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010/10/27 07:44:13 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2010/10/27 07:44:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2010/10/27 07:44:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2010/10/27 07:44:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

Hosts file not found

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [B7C.exe] C:\Program Files\Internet Explorer\48DE\B7C.exe ()

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)

O4 - HKLM..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe" File not found

O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron Corp.)

O4 - HKCU..\Run: [B7C.exe] C:\Users\skrti011\AppData\Roaming\Microsoft\48DE\B7C.exe ()

F3 - HKCU WinNT: Load - (C:\Users\skrti011\AppData\Roaming\04700\lvvm.exe) -C:\Users\skrti011\AppData\Roaming\04700\lvvm.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{91734A2F-C336-4BE9-8362-AA7479B0E354}: DhcpNameServer = 10.120.136.116

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB5CB38F-18CC-4EB4-8415-2AAD680E5D04}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - AppInit_DLLs: (C:\Windows\system32\nvinit.dll) -C:\Windows\System32\nvinit.dll (NVIDIA Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKCU Winlogon: Shell - (C:\Users\skrti011\AppData\Roaming\E0104\A5448.exe) -C:\Users\skrti011\AppData\Roaming\E0104\A5448.exe ()

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell\AutoRun\command - "" = E:\web.exe html\INDEX.HTM

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011/02/11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2011.10.17 13:10:56 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

[2011.10.17 12:21:09 | 003,313,664 | ---- | C] (Avira GmbH) -- C:\Users\skrti011\Desktop\bootwizard.exe

[2011.10.17 11:53:26 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTH.scr

[2011.10.17 11:26:06 | 001,559,344 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\hans.exe

[2011.10.17 11:16:45 | 001,559,344 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\tdsskiller.exe

[2011.10.17 10:34:28 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\Malwarebytes

[2011.10.17 10:34:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.10.17 10:34:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.10.17 10:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011.10.17 09:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\04700

[2011.10.17 09:48:32 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\skrti011\Desktop\herbert2.exe

[2011.10.16 19:04:58 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\04700

[2011.10.16 19:04:37 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011.10.16 19:04:33 | 000,000,000 | ---D | C] -- C:\ProgramData\cE01300MgKfO01300

[2011.10.11 19:54:32 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Local\{9D38B318-B402-40B0-8E22-5A80034D019C}

[2011.10.01 20:00:04 | 000,000,000 | ---D | C] -- C:\Users\skrti011\Documents\Yvonne

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.17 13:18:30 | 000,176,640 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\iexplore.exe

[2011.10.17 13:10:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

[2011.10.17 13:09:46 | 000,000,000 | ---- | M] () -- C:\Users\skrti011\defogger_reenable

[2011.10.17 13:06:59 | 000,050,477 | ---- | M] () -- C:\Users\skrti011\Desktop\Defogger.exe

[2011.10.17 12:51:50 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.10.17 12:51:50 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.10.17 12:50:59 | 000,654,610 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.10.17 12:50:59 | 000,616,452 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.10.17 12:50:59 | 000,130,192 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.10.17 12:50:59 | 000,106,574 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.10.17 12:43:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.10.17 12:43:52 | 2558,595,072 | -HS- | M] () -- C:\hiberfil.sys

[2011.10.17 12:21:16 | 003,313,664 | ---- | M] (Avira GmbH) -- C:\Users\skrti011\Desktop\bootwizard.exe

[2011.10.17 11:47:22 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTH.scr

[2011.10.17 11:24:58 | 001,559,344 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\hans.exe

[2011.10.17 11:16:52 | 001,559,344 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\tdsskiller.exe

[2011.10.17 10:34:10 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.10.17 10:32:22 | 000,000,150 | ---- | M] () -- C:\Users\skrti011\Desktop\rk-proxy.reg

[2011.10.17 10:32:02 | 000,000,130 | ---- | M] () -- C:\Users\skrti011\Desktop\hosts-perm.bat

[2011.10.17 09:49:12 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\skrti011\Desktop\herbert2.exe

[2011.10.17 09:44:26 | 001,008,092 | ---- | M] () -- C:\Users\skrti011\Desktop\martin.com

[2011.10.15 09:42:31 | 000,197,877 | ---- | M] () -- C:\Users\skrti011\Desktop\in-zeiten-des-abnehmenden-lichts.png

[2011.10.15 09:39:52 | 000,254,284 | ---- | M] () -- C:\Users\skrti011\Desktop\abgruende.png

[2011.10.15 09:03:29 | 000,290,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.10.01 19:44:28 | 000,006,934 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\.freeciv-client-rc-2.2

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011/02/11 19:10:50 | 000,874,048 | ---- | C] () -- C:\Windows\System32\igkrng575.bin

[2011.10.17 13:09:46 | 000,000,000 | ---- | C] () -- C:\Users\skrti011\defogger_reenable

[2011.10.17 13:06:59 | 000,050,477 | ---- | C] () -- C:\Users\skrti011\Desktop\Defogger.exe

[2011.10.17 12:45:09 | 000,176,640 | ---- | C] () -- C:\Users\skrti011\AppData\Roaming\iexplore.exe

[2011.10.17 10:34:10 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.10.17 10:32:00 | 000,000,130 | ---- | C] () -- C:\Users\skrti011\Desktop\hosts-perm.bat

[2011.10.17 09:57:51 | 000,000,150 | ---- | C] () -- C:\Users\skrti011\Desktop\rk-proxy.reg

[2011.10.17 09:45:59 | 001,008,092 | ---- | C] () -- C:\Users\skrti011\Desktop\martin.com

[2011.10.15 09:42:30 | 000,197,877 | ---- | C] () -- C:\Users\skrti011\Desktop\in-zeiten-des-abnehmenden-lichts.png

[2011.10.15 09:39:51 | 000,254,284 | ---- | C] () -- C:\Users\skrti011\Desktop\abgruende.png

[2011.02.17 00:03:55 | 000,256,258 | ---- | C] () -- C:\Windows\hpwins24.dat

[2010/08/09 15:26:45 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe

[2010/08/09 06:37:40 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin

[2010/08/09 06:37:39 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin

[2010/08/09 06:37:38 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010/07/27 08:56:50 | 000,408,168 | ---- | C] () -- C:\Windows\System32\easyUpdatusAPIU.dll

[2010/07/27 08:56:50 | 000,352,325 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin

[2010/05/12 15:13:56 | 000,654,610 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2010/05/12 15:13:56 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2010/05/12 15:13:56 | 000,130,192 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2010/05/12 15:13:56 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2010/03/16 22:30:36 | 000,482,304 | ---- | C] () -- C:\Windows\System32\drivers\WSR_DWA.SYS

[2010/03/16 22:30:12 | 000,791,040 | ---- | C] () -- C:\Windows\System32\drivers\WSR_HWA.SYS

[2010/03/16 18:49:00 | 000,140,800 | ---- | C] () -- C:\Windows\System32\drivers\WSR_RCI.SYS

[2010.12.30 10:49:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010.11.05 21:14:08 | 000,006,934 | ---- | C] () -- C:\Users\skrti011\AppData\Roaming\.freeciv-client-rc-2.2

[2010.08.14 00:50:46 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2010.08.14 00:50:45 | 000,149,504 | ---- | C] () -- C:\Windows\unwise32_setup.exe

[2010.08.09 14:23:48 | 000,072,017 | ---- | C] () -- C:\Windows\System32\Uninstall ALDI SÜD Mah Jong.exe

[2009/07/14 06:33:53 | 000,290,040 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009/07/14 04:05:48 | 000,616,452 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009/07/14 04:05:48 | 000,106,574 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.11.06 11:53:13 | 000,001,832 | ---- | C] () -- C:\Windows\hpwmdl24.dat

[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006/04/21 11:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll

 
 ========== LOP Check ==========

 

[2010.10.30 16:51:55 | 000,000,000 | -HSD | M] -- C:\Users\skrti011\AppData\Roaming\.#

[2010.11.05 21:12:35 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\.freeciv

[2011.10.17 10:51:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\04700

[2010.10.31 13:36:00 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Ashampoo

[2010.11.05 19:08:14 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\BitTorrent

[2011.10.17 10:51:03 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011.08.16 21:02:32 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Juniper Networks

[2011.01.30 14:02:03 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Lexware

[2011.10.11 20:23:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\SoftGrid Client

[2010.10.30 17:43:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\TP

[2011.10.03 11:41:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2010.11.20 19:19:57 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2010.12.20 08:22:18 | 000,000,000 | ---D | M] -- C:\Backup Ext. Festplatte

[2011.03.21 19:17:09 | 000,000,000 | ---D | M] -- C:\Backup USB-Stick DFS 21.03.2011

[2011.10.15 01:34:25 | 000,000,000 | -H-D | M] -- C:\Config.Msi

[2010.10.30 16:09:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.09.03 13:19:23 | 000,000,000 | ---D | M] -- C:\Filme

[2010.08.09 06:44:54 | 000,000,000 | ---D | M] -- C:\Intel

[2011.10.17 10:34:06 | 000,000,000 | R--D | M] -- C:\Program Files

[2011.10.17 10:34:10 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2011.03.05 18:23:39 | 000,000,000 | ---D | M] -- C:\Programme

[2010.10.30 16:09:25 | 000,000,000 | -HSD | M] -- C:\Recovery

[2011.08.10 21:39:06 | 000,000,000 | ---D | M] -- C:\redcoon

[2011.10.03 11:49:18 | 000,000,000 | ---D | M] -- C:\spiele

[2011.10.17 13:18:18 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2010.10.30 16:17:06 | 000,000,000 | R--D | M] -- C:\Users

[2011.10.17 09:54:41 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.manifest /3 >

 

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe

[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\procs\explorer.exe

[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\procs\explorer.exe

[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\procs\explorer.exe

[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\procs\explorer.exe

[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\procs\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe

[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\h\explorer.exe

[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\h\explorer.exe

[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\h\explorer.exe

[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\h\explorer.exe

[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\h\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

 
 < MD5 for: REGEDIT.EXE  >

[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe

[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\userinit.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\winlogon.exe

[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-14 23:34:26
 

< End of report >

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hi Arne,

also ich hab den vollständigen Scan mit Malwarebytes durchgeführt.

Ergebnis:

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 7967
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

18.10.2011 03:15:13

mbam-log-2011-10-18 (03-15-13).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Durchsuchte Objekte: 446493

Laufzeit: 1 Stunde(n), 41 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 3

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 4

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 30
 

Infizierte Speicherprozesse:

c:\program files\internet explorer\48DE\B7C.exe (Backdoor.Bot) -> 1420 -> Failed to unload process.

c:\Users\skrti011\AppData\Roaming\E0104\A5448.exe (Backdoor.Bot) -> 4192 -> Failed to unload process.

c:\Users\skrti011\AppData\Roaming\04700\lvvm.exe (Backdoor.Bot) -> 4580 -> Failed to unload process.
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B7C.exe (Backdoor.Bot) -> Value: B7C.exe -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B7C.exe (Backdoor.Bot) -> Value: B7C.exe -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Backdoor.CycBot) -> Value: Load -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Backdoor.Bot) -> Bad: (C:\Users\skrti011\AppData\Roaming\04700\lvvm.exe) Good: () -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\program files\internet explorer\48DE\B7C.exe (Backdoor.Bot) -> Delete on reboot.

c:\Users\skrti011\AppData\Roaming\E0104\A5448.exe (Backdoor.Bot) -> Delete on reboot.

c:\Users\skrti011\AppData\Roaming\04700\lvvm.exe (Backdoor.Bot) -> Delete on reboot.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\B7C.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\iexplore.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\2D18.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\3496.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\4308.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\4C6A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\61AE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\7C29.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\8777.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\8C95.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\CD2D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\D538.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\skrti011\AppData\Roaming\microsoft\48DE\EDE6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\backup ext. festplatte\fun- other stuff\winter.exe (JokeApp.EmailCollector) -> Quarantined and deleted successfully.

c:\backup ext. festplatte\thomas daten\Privat\Thomas\pantsoff.exe (PUP.PSWFinder) -> Quarantined and deleted successfully.

c:\program files\04700\lvvm.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\1B5C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\3246.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\3A80.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\8833.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\96D2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\BD94.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\BE2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\E34C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\F7E5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\FA84.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\internet explorer\48DE\FB10.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Die älteren Logfiles sind im Anhang beigefügt.

Der Online-Scan war leider nicht möglich, da eine Online-Verbindung nach dem Vollscan nicht mehr hergestellt werden konnte: "Proxy-Server verweigert die Verbindung. Überprüfen Sie bitte, ob die Proxy-Einstellungen korrekt sind".

Ich hoffe, ich hab das System nicht total zerschossen. Verseucht hab ich´s ja scheinbar ganz ordentlich... :wtf:

Gruß
Tim

Zitat:

Der Online-Scan war leider nicht möglich, da eine Online-Verbindung nach dem Vollscan nicht mehr hergestellt werden konnte: "Proxy-Server verweigert die Verbindung. Überprüfen Sie bitte, ob die Proxy-Einstellungen korrekt sind".

Bitte beachten => http://www.trojaner-board.de/94344-p...n-pruefen.html

Hi Arne,

danke für den Tip. Allerdings konnte ich anschließend immer noch nicht mit firefox online gehen. Habe den Scan nun mit dem IE gemacht.

Hier der log.txt vom OnlineScanner:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-18 08:28:34

# local_time=2011-10-18 10:28:34 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 302880 55501882 198059 0

# compatibility_mode=5893 16776574 100 94 12357193 70596217 0 0

# compatibility_mode=8192 67108863 100 0 476 476 0 0

# scanned=146587

# found=5

# cleaned=0

# scan_time=4709

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\AppData\Roaming\java.exe        a variant of Win32/Kryptik.UAA trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-18 11:21:51

# local_time=2011-10-19 01:21:51 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 307631 55506633 202810 0

# compatibility_mode=5893 16776574 100 94 12361944 70600968 0 0

# compatibility_mode=8192 67108863 100 0 5227 5227 0 0

# scanned=390075

# found=7

# cleaned=0

# scan_time=10355

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\AppData\Roaming\java.exe        a variant of Win32/Kryptik.UAA trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

F:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

F:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

Ich musste den Scan ein zweites Mal starten. War etwas erschrocken von Softonic, da ich dies für einen seriösen Anbieter hielt und hab die zwei Dateien direkt gelöscht! Hoffe das ist kein Problem für die weitere "Reinigung" (ist mir leider erst danach gekommen).

Viele Grüße
Tim

Mach bitte ein neues OTL-Log:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hi Arne,

hier der neue Scan mit OTL:

Code:

OTL logfile created on: 10/19/2011 6:34:00 PM - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\skrti011\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.18 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 61.37% Memory free

6.35 Gb Paging File | 4.98 Gb Available in Paging File | 78.39% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 565.07 Gb Total Space | 395.40 Gb Free Space | 69.97% Space Free | Partition Type: NTFS

Drive D: | 30.00 Gb Total Space | 9.61 Gb Free Space | 32.05% Space Free | Partition Type: NTFS

Drive F: | 931.40 Gb Total Space | 208.83 Gb Free Space | 22.42% Space Free | Partition Type: FAT32

Drive G: | 1.86 Gb Total Space | 1.86 Gb Free Space | 99.74% Space Free | Partition Type: FAT

 

Computer Name: SKRTI011-PC | User Name: skrti011 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011/10/17 13:10:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

PRC - [2011/06/28 18:14:54 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011/06/24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/04/28 21:10:35 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010/11/20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010/11/04 23:01:27 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010/09/14 05:46:26 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

PRC - [2010/09/14 05:46:16 | 000,508,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

PRC - [2010/07/27 08:05:14 | 001,620,584 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

PRC - [2010/06/21 22:53:44 | 000,436,264 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\WButton.exe

PRC - [2010/06/02 16:42:18 | 001,481,320 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe

PRC - [2010/05/10 21:28:50 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

PRC - [2010/05/10 21:28:50 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

PRC - [2010/04/27 10:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

PRC - [2010/03/04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009/12/14 20:25:00 | 000,200,704 | ---- | M] (Wistron) -- C:\Program Files\Launch Manager\HotkeyApp.exe

PRC - [2009/12/12 00:18:16 | 000,348,960 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\OSD.exe

PRC - [2009/12/03 01:37:30 | 002,684,200 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\Power2Go\Power2GoExpressServer.exe

PRC - [2009/11/07 12:46:52 | 000,020,480 | ---- | M] (X10) -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

PRC - [2009/10/23 02:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) -- C:\Program Files\Launch Manager\WisLMSvc.exe

PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011/10/15 09:06:07 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll

MOD - [2011/10/15 09:06:07 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\31fce331fded94dd06627603f6fe4562\Accessibility.ni.dll

MOD - [2011/10/15 09:05:06 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll

MOD - [2011/10/15 09:04:37 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll

MOD - [2011/10/15 09:04:28 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2010/11/13 02:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010/07/26 16:27:00 | 000,010,856 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll

MOD - [2010/02/12 16:20:04 | 000,031,840 | ---- | M] () -- C:\Program Files\Cyberlink\Shared files\RichVideops.dll

MOD - [2009/11/25 01:58:42 | 001,031,976 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\Language\DEU\P2GRC.dll

MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll

MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll

MOD - [2009/11/02 23:20:02 | 000,144,680 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLVistaAudioMixer.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011/06/28 18:14:54 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/04/28 21:10:35 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/03/15 05:41:49 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010/09/14 05:46:26 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)

SRV - [2010/09/14 05:46:16 | 000,508,264 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)

SRV - [2010/07/27 08:05:14 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)

SRV - [2010/05/10 21:28:50 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010/05/10 21:28:50 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010/03/04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2009/11/07 12:46:52 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- (x10nets)

SRV - [2009/10/23 02:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc)

SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011/06/28 18:14:55 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/06/28 18:14:55 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010/09/14 05:46:26 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)

DRV - [2010/09/14 05:46:22 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)

DRV - [2010/09/14 05:46:18 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)

DRV - [2010/09/14 05:46:14 | 000,577,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)

DRV - [2010/07/26 16:27:00 | 010,325,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010/07/26 16:27:00 | 000,019,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvpciflt.sys -- (nvpciflt)

DRV - [2010/06/21 09:14:36 | 000,246,272 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)

DRV - [2010/05/24 15:46:34 | 000,193,056 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2010/05/10 21:28:49 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\HECI.sys -- (HECI) Intel(R)

DRV - [2010/04/27 09:28:46 | 000,146,568 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)

DRV - [2010/04/27 09:27:50 | 000,064,904 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)

DRV - [2010/04/01 10:13:38 | 001,009,184 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)

DRV - [2010/03/16 22:30:36 | 000,482,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_DWA.SYS -- (DWA)

DRV - [2010/03/16 22:30:12 | 000,791,040 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_HWA.SYS -- (hwa)

DRV - [2010/03/16 18:49:00 | 000,140,800 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSR_RCI.SYS -- (HWARadio)

DRV - [2010/03/04 17:53:08 | 000,067,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010/02/26 23:01:22 | 000,132,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)

DRV - [2009/08/13 08:39:40 | 000,786,400 | ---- | M] (DiBcom SA) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mod7700.sys -- (mod7700)

DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2009/05/13 21:47:30 | 000,027,160 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)

DRV - [2009/05/13 21:26:26 | 000,013,720 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)

DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://medion.msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://medion.msn.com

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:57616

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.51

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 57616

FF - prefs.js..network.proxy.type: 1

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/17 00:08:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/23 21:43:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/23 19:24:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/17 00:08:52 | 000,000,000 | ---D | M]

 

[2010/10/30 17:27:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\skrti011\AppData\Roaming\mozilla\Extensions

[2010/10/30 17:27:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\skrti011\AppData\Roaming\mozilla\Firefox\Profiles\cskd47h4.default\extensions

[2010/12/30 10:46:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2010/12/30 10:46:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2011/02/17 00:08:52 | 000,000,000 | ---D | M] (HP Smart Web Printing) -- C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3

[2010/10/27 07:44:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010/10/27 07:44:13 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2010/10/27 07:44:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2010/10/27 07:44:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2010/10/27 07:44:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

Hosts file not found

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)

O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)

O4 - HKLM..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe" File not found

O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron Corp.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{91734A2F-C336-4BE9-8362-AA7479B0E354}: DhcpNameServer = 10.120.136.116

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB5CB38F-18CC-4EB4-8415-2AAD680E5D04}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20 - AppInit_DLLs: (C:\Windows\system32\nvinit.dll) -C:\Windows\System32\nvinit.dll (NVIDIA Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell\AutoRun\command - "" = E:\web.exe html\INDEX.HTM

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: BsScanner - Service

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: BsScanner - Service

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011/10/18 21:02:30 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011/10/17 13:10:56 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

[2011/10/17 12:21:09 | 003,313,664 | ---- | C] (Avira GmbH) -- C:\Users\skrti011\Desktop\bootwizard.exe

[2011/10/17 11:53:26 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTH.scr

[2011/10/17 11:26:06 | 001,559,344 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\hans.exe

[2011/10/17 11:16:45 | 001,559,344 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\tdsskiller.exe

[2011/10/17 10:34:28 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\Malwarebytes

[2011/10/17 10:34:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011/10/17 10:34:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011/10/17 10:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2011/10/17 09:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\04700

[2011/10/17 09:48:32 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\skrti011\Desktop\herbert2.exe

[2011/10/16 19:04:58 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\04700

[2011/10/16 19:04:37 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011/10/16 19:04:33 | 000,000,000 | ---D | C] -- C:\ProgramData\cE01300MgKfO01300

[2011/10/11 19:54:32 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Local\{9D38B318-B402-40B0-8E22-5A80034D019C}

[2011/10/01 20:00:04 | 000,000,000 | ---D | C] -- C:\Users\skrti011\Documents\Yvonne

[2011/02/11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011/10/19 16:17:22 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011/10/19 16:17:22 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011/10/19 16:14:14 | 000,654,610 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011/10/19 16:14:14 | 000,616,452 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011/10/19 16:14:14 | 000,130,192 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011/10/19 16:14:14 | 000,106,574 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011/10/19 16:09:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011/10/19 16:09:51 | 2558,595,072 | -HS- | M] () -- C:\hiberfil.sys

[2011/10/18 02:16:14 | 000,176,640 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\java.exe

[2011/10/17 17:11:28 | 404,883,045 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2011/10/17 14:32:22 | 000,035,575 | ---- | M] () -- C:\Users\skrti011\Desktop\Logfiles + Bilder.zip

[2011/10/17 13:35:52 | 000,018,744 | ---- | M] () -- C:\Users\skrti011\Desktop\Auswahloption Gmer.JPG

[2011/10/17 13:34:10 | 000,022,716 | ---- | M] () -- C:\Users\skrti011\Desktop\Fehlermeldung Start GMER.JPG

[2011/10/17 13:26:36 | 000,302,592 | ---- | M] () -- C:\Users\skrti011\Desktop\c2npy4x.exe

[2011/10/17 13:10:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTL.exe

[2011/10/17 13:09:46 | 000,000,000 | ---- | M] () -- C:\Users\skrti011\defogger_reenable

[2011/10/17 13:06:59 | 000,050,477 | ---- | M] () -- C:\Users\skrti011\Desktop\Defogger.exe

[2011/10/17 12:21:16 | 003,313,664 | ---- | M] (Avira GmbH) -- C:\Users\skrti011\Desktop\bootwizard.exe

[2011/10/17 11:47:22 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Users\skrti011\Desktop\OTH.scr

[2011/10/17 11:24:58 | 001,559,344 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\hans.exe

[2011/10/17 11:16:52 | 001,559,344 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\skrti011\Desktop\tdsskiller.exe

[2011/10/17 10:34:10 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/10/17 10:32:22 | 000,000,150 | ---- | M] () -- C:\Users\skrti011\Desktop\rk-proxy.reg

[2011/10/17 10:32:02 | 000,000,130 | ---- | M] () -- C:\Users\skrti011\Desktop\hosts-perm.bat

[2011/10/17 09:49:12 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\skrti011\Desktop\herbert2.exe

[2011/10/17 09:44:26 | 001,008,092 | ---- | M] () -- C:\Users\skrti011\Desktop\martin.com

[2011/10/15 09:42:31 | 000,197,877 | ---- | M] () -- C:\Users\skrti011\Desktop\in-zeiten-des-abnehmenden-lichts.png

[2011/10/15 09:39:52 | 000,254,284 | ---- | M] () -- C:\Users\skrti011\Desktop\abgruende.png

[2011/10/15 09:03:29 | 000,290,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011/10/01 19:44:28 | 000,006,934 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\.freeciv-client-rc-2.2

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011/10/18 02:16:14 | 000,176,640 | ---- | C] () -- C:\Users\skrti011\AppData\Roaming\java.exe

[2011/10/17 14:32:22 | 000,035,575 | ---- | C] () -- C:\Users\skrti011\Desktop\Logfiles + Bilder.zip

[2011/10/17 13:35:52 | 000,018,744 | ---- | C] () -- C:\Users\skrti011\Desktop\Auswahloption Gmer.JPG

[2011/10/17 13:34:10 | 000,022,716 | ---- | C] () -- C:\Users\skrti011\Desktop\Fehlermeldung Start GMER.JPG

[2011/10/17 13:28:05 | 000,302,592 | ---- | C] () -- C:\Users\skrti011\Desktop\c2npy4x.exe

[2011/10/17 13:09:46 | 000,000,000 | ---- | C] () -- C:\Users\skrti011\defogger_reenable

[2011/10/17 13:06:59 | 000,050,477 | ---- | C] () -- C:\Users\skrti011\Desktop\Defogger.exe

[2011/10/17 10:34:10 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011/10/17 10:32:00 | 000,000,130 | ---- | C] () -- C:\Users\skrti011\Desktop\hosts-perm.bat

[2011/10/17 09:57:51 | 000,000,150 | ---- | C] () -- C:\Users\skrti011\Desktop\rk-proxy.reg

[2011/10/17 09:45:59 | 001,008,092 | ---- | C] () -- C:\Users\skrti011\Desktop\martin.com

[2011/10/15 09:42:30 | 000,197,877 | ---- | C] () -- C:\Users\skrti011\Desktop\in-zeiten-des-abnehmenden-lichts.png

[2011/10/15 09:39:51 | 000,254,284 | ---- | C] () -- C:\Users\skrti011\Desktop\abgruende.png

[2011/02/17 00:03:55 | 000,256,258 | ---- | C] () -- C:\Windows\hpwins24.dat

[2011/02/11 19:10:50 | 000,874,048 | ---- | C] () -- C:\Windows\System32\igkrng575.bin

[2010/12/30 10:49:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010/11/05 21:14:08 | 000,006,934 | ---- | C] () -- C:\Users\skrti011\AppData\Roaming\.freeciv-client-rc-2.2

[2010/08/14 00:50:46 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe

[2010/08/14 00:50:45 | 000,149,504 | ---- | C] () -- C:\Windows\unwise32_setup.exe

[2010/08/09 15:26:45 | 000,451,072 | ---- | C] () -- C:\Windows\System32\ISSRemoveSP.exe

[2010/08/09 14:23:48 | 000,072,017 | ---- | C] () -- C:\Windows\System32\Uninstall ALDI SÜD Mah Jong.exe

[2010/08/09 06:37:40 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin

[2010/08/09 06:37:39 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin

[2010/08/09 06:37:38 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010/07/27 08:56:50 | 000,408,168 | ---- | C] () -- C:\Windows\System32\easyUpdatusAPIU.dll

[2010/07/27 08:56:50 | 000,352,325 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin

[2010/05/12 15:13:56 | 000,654,610 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2010/05/12 15:13:56 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2010/05/12 15:13:56 | 000,130,192 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2010/05/12 15:13:56 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2010/03/16 22:30:36 | 000,482,304 | ---- | C] () -- C:\Windows\System32\drivers\WSR_DWA.SYS

[2010/03/16 22:30:12 | 000,791,040 | ---- | C] () -- C:\Windows\System32\drivers\WSR_HWA.SYS

[2010/03/16 18:49:00 | 000,140,800 | ---- | C] () -- C:\Windows\System32\drivers\WSR_RCI.SYS

[2009/11/06 11:53:13 | 000,001,832 | ---- | C] () -- C:\Windows\hpwmdl24.dat

[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009/07/14 06:33:53 | 000,290,040 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009/07/14 04:05:48 | 000,616,452 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009/07/14 04:05:48 | 000,106,574 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2006/04/21 11:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll

 
 ========== LOP Check ==========

 

[2010/10/30 16:51:55 | 000,000,000 | -HSD | M] -- C:\Users\skrti011\AppData\Roaming\.#

[2010/11/05 21:12:35 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\.freeciv

[2011/10/18 03:18:43 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\04700

[2010/10/31 13:36:00 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Ashampoo

[2010/11/05 19:08:14 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\BitTorrent

[2011/10/18 03:18:43 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011/08/16 21:02:32 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Juniper Networks

[2011/01/30 14:02:03 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Lexware

[2011/10/11 20:23:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\SoftGrid Client

[2010/10/30 17:43:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\TP

[2011/10/03 11:41:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010/10/30 16:51:55 | 000,000,000 | -HSD | M] -- C:\Users\skrti011\AppData\Roaming\.#

[2010/11/05 21:12:35 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\.freeciv

[2011/10/18 03:18:43 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\04700

[2011/09/11 15:38:07 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Adobe

[2010/12/20 09:59:55 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Apple Computer

[2010/10/31 13:36:00 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Ashampoo

[2011/05/11 22:50:47 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Avira

[2010/11/05 19:08:14 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\BitTorrent

[2011/02/05 21:26:05 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\CyberLink

[2011/09/03 00:10:51 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\dvdcss

[2011/10/18 03:18:43 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011/05/14 13:03:36 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\HP

[2010/10/30 16:17:18 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Identities

[2011/01/30 14:02:57 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\InstallShield

[2011/08/16 21:02:32 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Juniper Networks

[2011/01/30 14:02:03 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Lexware

[2010/10/30 16:29:16 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Macromedia

[2011/10/17 10:34:28 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Malwarebytes

[2009/07/14 09:48:18 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Media Center Programs

[2011/10/16 19:04:37 | 000,000,000 | --SD | M] -- C:\Users\skrti011\AppData\Roaming\Microsoft

[2010/10/30 17:27:26 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Mozilla

[2011/04/05 15:39:41 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\Skype

[2011/04/05 08:24:41 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\skypePM

[2011/10/11 20:23:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\SoftGrid Client

[2010/10/30 17:43:34 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\TP

[2011/09/02 21:37:55 | 000,000,000 | ---D | M] -- C:\Users\skrti011\AppData\Roaming\vlc

 
 < %APPDATA%\*.exe /s >

[2011/10/18 02:16:14 | 000,176,640 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\java.exe

[2011/06/23 08:23:52 | 000,298,056 | ---- | M] (Juniper Networks) -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe

[2011/06/23 08:23:54 | 000,050,112 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\uninstall.exe

[2011/06/22 09:13:10 | 000,148,848 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\dsmmf.exe

[2011/06/22 09:13:30 | 000,280,512 | ---- | M] (Juniper Networks, Inc.) -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\JuniperCompMgrInstaller.exe

[2011/06/22 09:13:10 | 000,570,736 | ---- | M] (Juniper Networks, Inc.) -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClient.exe

[2011/06/22 09:12:38 | 000,345,912 | ---- | M] (Juniper Networks, Inc.) -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClientOCX.exe

[2011/06/22 09:05:32 | 000,233,872 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupXP.exe

[2011/06/22 09:13:32 | 000,056,432 | ---- | M] (Juniper Networks, Inc.) -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\uninstall.exe

[2011/08/16 21:02:33 | 000,168,304 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\x86_Microsoft.VC80.CRTP_8.0.50727.762.exe

[2011/08/16 21:02:32 | 000,298,352 | ---- | M] () -- C:\Users\skrti011\AppData\Roaming\Juniper Networks\Setup Client\x86_Microsoft.VC80.CRTR_8.0.50727.762.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2008/06/06 23:03:52 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2010/03/04 04:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\drivers\iaStor.sys

[2010/03/04 04:33:26 | 000,435,736 | ---- | M] (Intel Corporation) MD5=26541A068572F650A2FA490726FE81BE -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e8a55be84650e755\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\userinit.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\userinit.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\userinit.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\userinit.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX0\winlogon.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX1\winlogon.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX2\winlogon.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX3\winlogon.exe

[2009/05/26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\skrti011\AppData\Local\Temp\RarSFX4\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2011.06.01 11:10:45 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll

[2011.06.01 11:10:45 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll

[2009.07.14 03:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\LocationApi.dll
 

< End of report >

Gruß
Tim

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://medion.msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.aldi.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://medion.msn.com

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:57

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"

FF - prefs.js..browser.startup.homepage: "www.google.de"

FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.51

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 57616

FF - prefs.js..network.proxy.type: 1

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\Shell\AutoRun\command - "" = E:\web.exe html\INDEX.HTM

[2011/10/16 19:04:58 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\04700

[2011/10/16 19:04:37 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Roaming\E0104

[2011/10/16 19:04:33 | 000,000,000 | ---D | C] -- C:\ProgramData\cE01300MgKfO01300

[2011/10/11 19:54:32 | 000,000,000 | ---D | C] -- C:\Users\skrti011\AppData\Local\{9D38B318-B402-40B0-8E22-5A80034D019C}

[2010/10/30 16:51:55 | 000,000,000 | -HSD | M] -- C:\Users\skrti011\AppData\Roaming\.#

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hi Arne,

also der Fix verlief ganz gut, bis mich die Meldung "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet. Speichern Sie jetzt Ihre Daten." etwas überraschte. Allerdings war der Fix schneller und hat mich zum Neustart aufgefordert.

Ergebnis: die Firusmeldung von Avira "BOO/TDss.D" ist weg und ich komme auch mit Firefox wieder online.

Hier noch das fix.txt:

Code:

All processes killed

========== OTL ==========

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchDefaultBranded| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Prefs.js: "Wikipedia (de)" removed from browser.search.selectedEngine

Prefs.js: "www.google.de" removed from browser.startup.homepage

Prefs.js: smartwebprinting@hp.com:4.51 removed from extensions.enabledItems

Prefs.js: "127.0.0.1" removed from network.proxy.http

Prefs.js: 57616 removed from network.proxy.http_port

Prefs.js: 1 removed from network.proxy.type

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{675d2ed8-e479-11df-b508-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{675d2ed8-e479-11df-b508-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{675d2ed8-e479-11df-b508-806e6f6e6963}\ not found.

File E:\web.exe html\INDEX.HTM not found.

C:\Users\skrti011\AppData\Roaming\04700 folder moved successfully.

C:\Users\skrti011\AppData\Roaming\E0104 folder moved successfully.

Folder C:\ProgramData\cE01300MgKfO01300\ not found.

C:\Users\skrti011\AppData\Local\{9D38B318-B402-40B0-8E22-5A80034D019C} folder moved successfully.

C:\Users\skrti011\AppData\Roaming\.# folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

User: skrti011

->Temp folder emptied: 111244775 bytes

->Temporary Internet Files folder emptied: 42678091 bytes

->Java cache emptied: 1063665 bytes

->FireFox cache emptied: 37574770 bytes

->Flash cache emptied: 60458 bytes

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 63269211 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 244.00 mb

 

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 10192011_200242
 

Files\Folders moved on Reboot...

C:\Users\skrti011\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.

C:\Users\skrti011\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N9F4GGXM\ac3[5].htm moved successfully.
 

Registry entries deleted on Reboot...

So far: vielen Dank :daumenhoc
Gruß
Tim

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hi Arne,

leider lässt sich das Tool nicht starten. Hab´s jetzt mehrfach versucht. Zwei mal kam mittlerweile auch ein Blue-Screen und er hat selbst nen Neustart durchgeführt. Mittlerweile (nach dem 3. Neustart) ist auch die Viruswarnung über "BOO/TDss.D" von Avira wieder da.

Was muss ich tun, um den TDSSKiller starten zu können? Als Admin hat´s auch net gefunzt...

Gruß
Tim

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Win7 (32-Bit) installiert?
Wenn nicht: Schau mal hier => RescueDisc-Win7-32-Bit

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Win7-Installations-DVD (32-Bit) hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der dieser DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Führe im normalen Windowsmodus MBRcheck bzw. aswmbr (je nachdem welches Tool ich dir vorhin aufgab) und wenn es geht GMER nochmals aus und poste die neuen Logs.

Hi Arne,

hab nur die eine 32bit-Version. Lad mir grad die iso und werde so vorgehen wie von dir beschrieben. Allerdings sprichst du von

Zitat:

MBRcheck bzw. aswmbr (je nachdem welches Tool ich dir vorhin aufgab)

hast mir jedoch vorher das Tool tdsskiller "aufgegeben".

Bitte gib mir nochmal kurz Feedback, was ich im Anschluss an die Aktivitäten und den Neustart machen soll.

Danke dir und viele Grüße
Tim

Zitat:

hast mir jedoch vorher das Tool tdsskiller "aufgegeben".

Achso, sry, der Baustein wurde für eine andere Reihenfolge optimiert :D
Mach bitte mit aswMBR das neue Log:

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Kein Ding, solange nachfragen erlaubt ist :)

Also der Scan mit aswMBR ergab Folgendes:

Code:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software

Run date: 2011-10-20 20:32:28

-----------------------------

20:32:28.852    OS Version: Windows 6.1.7601 Service Pack 1

20:32:28.852    Number of processors: 4 586 0x2505

20:32:28.852    ComputerName: SKRTI011-PC  UserName: skrti011

20:32:47.666    Initialize success

20:36:15.841    AVAST engine defs: 11102002

20:47:59.466    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:47:59.482    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

20:47:59.840    Disk 0 MBR read successfully

20:47:59.840    Disk 0 MBR scan

20:47:59.872    Disk 0 Windows 7 default MBR code

20:47:59.872    Disk 0 scanning sectors +1250260992

20:47:59.950    Disk 0 scanning C:\Windows\system32\drivers

20:48:09.980    Service scanning

20:48:11.026    Modules scanning

20:48:20.089    Disk 0 trace - called modules:

20:48:20.105    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

20:48:20.105    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87f7f030]

20:48:20.120    3 CLASSPNP.SYS[8c1aa59e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863dd028]

20:48:21.150    AVAST engine scan C:\Windows

20:48:23.396    AVAST engine scan C:\Windows\system32

20:50:05.920    AVAST engine scan C:\Windows\system32\drivers

20:50:16.404    AVAST engine scan C:\Users\skrti011

20:50:35.765    File: C:\Users\skrti011\AppData\Roaming\java.exe  **INFECTED** Win32:Downloader-KXI [Trj]

20:53:01.376    AVAST engine scan C:\ProgramData

20:56:15.846    Scan finished successfully

20:57:36.062    Disk 0 MBR has been saved successfully to "C:\Users\skrti011\Desktop\MBR.dat"

20:57:36.077    The log file has been saved successfully to "C:\Users\skrti011\Desktop\aswMBR.txt"

Gruß
Tim

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hi Arne,

ich hab Antivir deaktiviert und er bringt mir trotzdem die folgende Meldung (vgl. jpg).

:confused:

Danke und Gruß
Tim

Wenn AntiVir deaktiviert ist (geschlossener Regenschirm) kannst du diese meldung ignorieren

Hi Arne,

okay, hab jetzt die Meldung ignoriert und den Combofix-Log beigefügt.

Was mich nur gewundert hat, dass er u. a. auch die Datei hosts.txt gelöscht hat, obwohl ich die eigentlich ja beim Entfernen von Security Sphere 2012 ersetzt hatte. Hab ich da was falsch gemacht?

Combofix-Log:

Code:

ComboFix 11-10-20.05 - skrti011 20.10.2011  21:41:09.1.4 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3253.2070 [GMT 2:00]

ausgeführt von:: c:\users\skrti011\Desktop\ComboFix.exe

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\skrti011\AppData\Roaming\Java.exe

c:\windows\system32\drivers\etc\hosts.txt

c:\windows\system32\start.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-09-20 bis 2011-10-20  ))))))))))))))))))))))))))))))

.

.

2011-10-20 17:57 . 2011-10-20 18:05        --------        d-----w-        c:\users\skrti011\AppData\Roaming\ImgBurn

2011-10-19 18:02 . 2011-10-19 18:02        --------        d-----w-        C:\_OTL

2011-10-18 19:02 . 2011-10-18 19:02        --------        d-----w-        c:\program files\ESET

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\users\skrti011\AppData\Roaming\Malwarebytes

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\programdata\Malwarebytes

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-10-17 07:56 . 2011-10-18 01:15        --------        d-----w-        c:\program files\04700

2011-10-16 17:04 . 2011-10-17 08:41        --------        d-----w-        c:\programdata\cE01300MgKfO01300

2011-10-14 15:54 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\system32\psisdecd.dll

2011-10-14 15:54 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\system32\psisrndr.ax

2011-10-14 15:54 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2011-10-14 15:54 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\system32\oleacc.dll

2011-10-14 15:54 . 2011-09-06 02:28        2334720        ----a-w-        c:\windows\system32\win32k.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-15 07:05 . 2011-06-11 07:57        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-06-02 9222760]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-06-02 1481320]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]

"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2009-12-11 348960]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-06-21 436264]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-12-10 1594664]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\nvinit.dll

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 DisplayLinkUsbPort;DisplayLink USB Device;c:\windows\system32\DRIVERS\DisplayLinkUsbPort_5.3.24903.0.sys [x]

R3 DWA;Wireless USB Device Adapter;c:\windows\system32\DRIVERS\WSR_DWA.SYS [2010-03-16 482304]

R3 hwa;Wireless USB Host Adapter;c:\windows\system32\DRIVERS\WSR_HWA.SYS [2010-03-16 791040]

R3 HWARadio;Wireless USB Host Radio;c:\windows\system32\DRIVERS\WSR_RCI.SYS [2010-03-16 140800]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 193056]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-15 1343400]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-07-26 19656]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-07-27 1620584]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-05-10 2320920]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 246272]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-03-04 67624]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 64904]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 146568]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-23 118560]

S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 13720]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - ASWMBR

*Deregistered* - aswMBR

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\skrti011\AppData\Roaming\Mozilla\Firefox\Profiles\cskd47h4.default\

FF - prefs.js: browser.search.selectedEngine - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-LMgrOSD - c:\program files\Launch Manager\OSDCtrl.exe

SafeBoot-BsScanner

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-10-20  21:48:53

ComboFix-quarantined-files.txt  2011-10-20 19:48

.

Vor Suchlauf: 10 Verzeichnis(se), 424.035.266.560 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 424.031.514.624 Bytes frei

.

- - End Of File - - 14FF371ED6AC9C3FF838CCADA1EDA8DC

Gruß
Tim

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Folder::

c:\program files\04700

c:\programdata\cE01300MgKfO01300

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hi Arne,

hier das Log vom gescripteten Combofix:

Code:

ComboFix 11-10-20.05 - skrti011 20.10.2011  22:10:12.2.4 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3253.2080 [GMT 2:00]

ausgeführt von:: c:\users\skrti011\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\skrti011\Desktop\CFScript.txt

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\04700

c:\programdata\cE01300MgKfO01300

c:\programdata\cE01300MgKfO01300\cE01300MgKfO01300

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-09-20 bis 2011-10-20  ))))))))))))))))))))))))))))))

.

.

2011-10-20 20:18 . 2011-10-20 20:18        --------        d-----w-        c:\users\skrti011\AppData\Local\temp

2011-10-20 20:18 . 2011-10-20 20:18        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2011-10-20 20:18 . 2011-10-20 20:18        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-10-20 17:57 . 2011-10-20 18:05        --------        d-----w-        c:\users\skrti011\AppData\Roaming\ImgBurn

2011-10-19 18:02 . 2011-10-19 18:02        --------        d-----w-        C:\_OTL

2011-10-18 19:02 . 2011-10-18 19:02        --------        d-----w-        c:\program files\ESET

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\users\skrti011\AppData\Roaming\Malwarebytes

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\programdata\Malwarebytes

2011-10-17 08:34 . 2011-10-17 08:34        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-10-14 15:54 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\system32\psisdecd.dll

2011-10-14 15:54 . 2011-08-17 04:19        75776        ----a-w-        c:\windows\system32\psisrndr.ax

2011-10-14 15:54 . 2011-08-27 04:26        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2011-10-14 15:54 . 2011-08-27 04:26        233472        ----a-w-        c:\windows\system32\oleacc.dll

2011-10-14 15:54 . 2011-09-06 02:28        2334720        ----a-w-        c:\windows\system32\win32k.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-15 07:05 . 2011-06-11 07:57        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-06-02 9222760]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-06-02 1481320]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]

"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2009-12-11 348960]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-06-21 436264]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-12-10 1594664]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\nvinit.dll

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 DisplayLinkUsbPort;DisplayLink USB Device;c:\windows\system32\DRIVERS\DisplayLinkUsbPort_5.3.24903.0.sys [x]

R3 DWA;Wireless USB Device Adapter;c:\windows\system32\DRIVERS\WSR_DWA.SYS [2010-03-16 482304]

R3 hwa;Wireless USB Host Adapter;c:\windows\system32\DRIVERS\WSR_HWA.SYS [2010-03-16 791040]

R3 HWARadio;Wireless USB Host Radio;c:\windows\system32\DRIVERS\WSR_RCI.SYS [2010-03-16 140800]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 193056]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-15 1343400]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-07-26 19656]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-07-27 1620584]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-05-10 2320920]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 246272]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-03-04 67624]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 64904]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 146568]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-23 118560]

S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 13720]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\skrti011\AppData\Roaming\Mozilla\Firefox\Profiles\cskd47h4.default\

FF - prefs.js: browser.search.selectedEngine - 

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-10-20  22:19:51

ComboFix-quarantined-files.txt  2011-10-20 20:19

ComboFix2.txt  2011-10-20 19:48

.

Vor Suchlauf: 13 Verzeichnis(se), 423.997.939.712 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 423.943.405.568 Bytes frei

.

- - End Of File - - EEEB3CDF1DF190B279D6687BCD8B45F8

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Hi Arne,

so, ich bin dann jetzt durch mit den drei Scans.

GMER.log:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2011-10-21 17:41:01

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1

Running: 4xrmtejk.exe; Driver: C:\Users\skrti011\AppData\Local\Temp\pwrorkow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT    916C8F36                                                                                           ZwCreateSection

SSDT    916C8F3B                                                                                           ZwSetContextThread

SSDT    916C8ED7                                                                                           ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text   ntkrnlpa.exe!ZwSaveKey + 13D1                                                                      82E93349 1 Byte  [06]

.text   ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                             82ECCD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text   ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                82ED3EAC 1 Byte  [36]

.text   ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                82ED3EAC 4 Bytes  [36, 8F, 6C, 91]

.text   ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                82ED424C 4 Bytes  [3B, 8F, 6C, 91]

.text   ntkrnlpa.exe!KeRemoveQueueEx + 166F                                                                82ED4324 4 Bytes  [D7, 8E, 6C, 91]

PAGE    spsys.sys!?SPRevision@@3PADA + 4F90                                                                B02F4000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]

PAGE    spsys.sys!?SPRevision@@3PADA + 50B3                                                                B02F4123 629 Bytes  [F5, 2E, B0, FE, 05, 34, F5, ...]

PAGE    spsys.sys!?SPRevision@@3PADA + 5329                                                                B02F4399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]

PAGE    spsys.sys!?SPRevision@@3PADA + 538F                                                                B02F43FF 148 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]

PAGE    spsys.sys!?SPRevision@@3PADA + 543B                                                                B02F44AB 2228 Bytes  [8B, FF, 55, 8B, EC, FF, 75, ...]

PAGE    ...                                                                                                
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                    [73C12437] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]               [73BF5600] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]              [73BF56BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                     [73C124B2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]           [73C08514] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]             [73C04CC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]            [73C0506F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]           [73C05144] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]  [73C06671] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]            [73C0826B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]       [73C087BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]     [73C0901B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]           [73C0E1BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT     C:\Windows\Explorer.EXE[3448] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]               [73C04BFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Threads - GMER 1.0.15 ----
 

Thread  System [4:1156]                                                                                    B0301F2E
 

---- EOF - GMER 1.0.15 ----

OSAM.log

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 17:54:50 on 21.10.2011
 

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.13
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\skrti011\AppData\Local\Temp\catchme.sys  (File not found)

"DisplayLink USB Device" (DisplayLinkUsbPort) - ? - C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_5.3.24903.0.sys  (File not found)

"MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\Windows\system32\drivers\mbamswissarmy.sys  (File not found)

"pwrorkow" (pwrorkow) - ? - C:\Users\skrti011\AppData\Local\Temp\pwrorkow.sys  (Hidden registry entry, rootkit activity | File not found)

"Sftfs" (Sftfs) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftfslh.sys

"Sftplay" (Sftplay) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftplaylh.sys

"Sftredir" (Sftredir) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftredirlh.sys

"Sftvol" (Sftvol) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftvollh.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"Wireless USB Device Adapter" (DWA) - ? - C:\Windows\System32\DRIVERS\WSR_DWA.SYS

"Wireless USB Host Adapter" (hwa) - ? - C:\Windows\System32\DRIVERS\WSR_HWA.SYS

"Wireless USB Host Radio" (HWARadio) - ? - C:\Windows\System32\DRIVERS\WSR_RCI.SYS
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL

{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C} "NvAppShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll

{E97DEC16-A50D-49bb-AE24-CF682282E08D} "OpenGLShExt Class" - "NVIDIA Corporation" - C:\Windows\system32\nv3dappshext.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\winrar\rarext.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Program Files\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{F27237D7-93C8-44C2-AC6E-D6057B9A918F} "JuniperSetupClientControl Class" - "Juniper Networks, Inc." - C:\Windows\Downloaded Program Files\JuniperSetupClient.ocx / https://juniper.net/dana-cached/sc/JuniperSetupClient.cab

{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle" - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LexwareInfoService" - "Haufe-Lexware GmbH & Co. KG" - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart

"LMgrVolOSD" - "Wistron Corp." - "C:\Program Files\Launch Manager\OSD.exe"

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"NUSB3MON" - "Renesas Electronics Corporation" - "C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"Wbutton" - "Wistron Corp." - "C:\Program Files\Launch Manager\Wbutton.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Application Virtualization Client" (sftlist) - "Microsoft Corporation" - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

"Application Virtualization Service Agent" (sftvsa) - "Microsoft Corporation" - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Client Virtualization Handler" (cvhsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll

"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL

"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

aswMBR.log:

Code:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software

Run date: 2011-10-21 18:02:55

-----------------------------

18:02:55.931    OS Version: Windows 6.1.7601 Service Pack 1

18:02:55.931    Number of processors: 4 586 0x2505

18:02:55.931    ComputerName: SKRTI011-PC  UserName: skrti011

18:03:14.760    Initialize success

18:06:32.113    AVAST engine defs: 11102100

18:10:46.908    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

18:10:46.908    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3

18:10:46.955    Disk 0 MBR read successfully

18:10:46.955    Disk 0 MBR scan

18:10:46.986    Disk 0 Windows 7 default MBR code

18:10:47.064    Disk 0 scanning sectors +1250260992

18:10:47.517    Disk 0 scanning C:\Windows\system32\drivers

18:12:31.133    Service scanning

18:12:32.131    Modules scanning

18:15:05.211    Disk 0 trace - called modules:

18:15:05.289    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 

18:15:05.289    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87f7fa90]

18:15:05.304    3 CLASSPNP.SYS[8c18659e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x863db028]

18:15:06.365    AVAST engine scan C:\Windows

18:18:19.636    AVAST engine scan C:\Windows\system32

18:39:45.827    AVAST engine scan C:\Windows\system32\drivers

18:44:33.760    Disk 0 MBR has been saved successfully to "C:\Users\skrti011\Desktop\MBR.dat"

18:44:33.776    The log file has been saved successfully to "C:\Users\skrti011\Desktop\aswMBR2.txt"

Viele Grüße
Tim

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hi Arne,

also die Vollscans haben etwas gedauert, aber hier die Ergebnisse:

Malwarebytes log:

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 7999
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

22.10.2011 19:11:40

mbam-log-2011-10-22 (19-11-40).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|G:\|H:\|)

Durchsuchte Objekte: 559977

Laufzeit: 1 Stunde(n), 31 Minute(n), 22 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Qoobox\quarantine\C\Users\skrti011\AppData\Roaming\java.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.

SUPERAntiSpyware log: Es handelt sich um eine aktuellere Version als im Tutorial beschrieben. Ich konnte die Funde nur direkt löschen (sie sind jetzt allerdings noch "zurückholbar"), oder als unbedenktlich behandeln. Ich habe mich für Ersteres entschieden. Wenn ich damit Dateien gelöscht haben sollte, die zwingend benötigt werden, sag mir bitte bescheid :)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 10/23/2011 at 04:07 AM
 

Application Version : 5.0.1134
 

Core Rules Database Version : 7837

Trace Rules Database Version: 5649
 

Scan type       : Complete Scan

Total Scan Time : 08:37:54
 

Operating System Information

Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 862

Memory threats detected   : 0

Registry items scanned    : 40394

Registry threats detected : 0

File items scanned        : 278843

File threats detected     : 76
 

Adware.Tracking Cookie

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\skrti011@adx.chip[2].txt [ /adx.chip ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\skrti011@stat.aldi[1].txt [ /stat.aldi ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\skrti011@stat.aldi[3].txt [ /stat.aldi ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\BY6XC0ZZ.txt [ /imrworldwide.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\SF9K6LR7.txt [ /www.googleadservices.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\F2I3MKIU.txt [ /ad.yieldmanager.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\DAF9Q4X6.txt [ /bs.serving-sys.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\9P9MGVTW.txt [ /2o7.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\24XTTQ54.txt [ /smartadserver.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\KO6VHTYA.txt [ /invitemedia.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\CW1Y1570.txt [ /ads.pubmatic.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\JWYGDQ6N.txt [ /atdmt.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\H1GLBH7Z.txt [ /ad.adition.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\CN0HECZN.txt [ /adxpose.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\9EV37Y2C.txt [ /ad2.adfarm1.adition.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\K0ISJ90A.txt [ /media6degrees.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\YKKKY5IB.txt [ /ads.lzjl.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\MF7PBI3Y.txt [ /mediaplex.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\55A4HTJE.txt [ /ads.247activemedia.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\EEFZ9L3T.txt [ /specificclick.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\D0YPX6HB.txt [ /ww251.smartadserver.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\ZNLMKRKH.txt [ /myroitracking.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\LSLUOB0E.txt [ /webmasterplan.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\DBA7R0VI.txt [ /serving-sys.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\NWPATC3X.txt [ /adfarm1.adition.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\WXKPM81J.txt [ /adtech.de ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\RQ0QF8QA.txt [ /revsci.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\0ZI87XWA.txt [ /ad.ad-srv.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\17HW78MD.txt [ /doubleclick.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\NFZKKK5K.txt [ /apmebf.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\SU79FCZC.txt [ /clicksor.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\VMLJDEU9.txt [ /zanox.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\1WLF2PSG.txt [ /ad.zanox.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\0UBO3D5G.txt [ /ad3.adfarm1.adition.com ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\05E93ALN.txt [ /fastclick.net ]

        C:\Users\skrti011\AppData\Roaming\Microsoft\Windows\Cookies\U6GYWXDF.txt [ /mm.chitika.net ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\8LRQNQOU.txt [ Cookie:skrti011@adsonar.com/adserving ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@stat.aldi[2].txt [ Cookie:skrti011@stat.aldi.com/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@mediaplex[1].txt [ Cookie:skrti011@mediaplex.com/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@statse.webtrendslive[2].txt [ Cookie:skrti011@statse.webtrendslive.com/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@apmebf[1].txt [ Cookie:skrti011@apmebf.com/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@interclick[1].txt [ Cookie:skrti011@interclick.com/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@adx.chip[2].txt [ Cookie:skrti011@adx.chip.de/ ]

        C:\USERS\SKRTI011\AppData\Roaming\Microsoft\Windows\Cookies\Low\skrti011@fastclick[1].txt [ Cookie:skrti011@fastclick.net/ ]

        C:\USERS\SKRTI011\Cookies\skrti011@stat.aldi[3].txt [ Cookie:skrti011@stat.aldi.com/ ]

        C:\USERS\SKRTI011\Cookies\skrti011@stat.aldi[1].txt [ Cookie:skrti011@stat.aldi.com/dcsfq2jxwixy5f1mioa8p9lnl_5x1d ]

        C:\USERS\SKRTI011\Cookies\SF9K6LR7.txt [ Cookie:skrti011@www.googleadservices.com/pagead/conversion/996761568/ ]

        C:\USERS\SKRTI011\Cookies\DAF9Q4X6.txt [ Cookie:skrti011@bs.serving-sys.com/ ]

        C:\USERS\SKRTI011\Cookies\24XTTQ54.txt [ Cookie:skrti011@smartadserver.com/ ]

        C:\USERS\SKRTI011\Cookies\H1GLBH7Z.txt [ Cookie:skrti011@ad.adition.net/ ]

        C:\USERS\SKRTI011\Cookies\CN0HECZN.txt [ Cookie:skrti011@adxpose.com/ ]

        C:\USERS\SKRTI011\Cookies\K0ISJ90A.txt [ Cookie:skrti011@media6degrees.com/ ]

        C:\USERS\SKRTI011\Cookies\8LRQNQOU.txt [ Cookie:skrti011@adsonar.com/adserving ]

        C:\USERS\SKRTI011\Cookies\MF7PBI3Y.txt [ Cookie:skrti011@mediaplex.com/ ]

        C:\USERS\SKRTI011\Cookies\55A4HTJE.txt [ Cookie:skrti011@ads.247activemedia.com/ ]

        C:\USERS\SKRTI011\Cookies\EEFZ9L3T.txt [ Cookie:skrti011@specificclick.net/ ]

        C:\USERS\SKRTI011\Cookies\D0YPX6HB.txt [ Cookie:skrti011@ww251.smartadserver.com/ ]

        C:\USERS\SKRTI011\Cookies\ZNLMKRKH.txt [ Cookie:skrti011@myroitracking.com/ ]

        C:\USERS\SKRTI011\Cookies\DBA7R0VI.txt [ Cookie:skrti011@serving-sys.com/ ]

        C:\USERS\SKRTI011\Cookies\WXKPM81J.txt [ Cookie:skrti011@adtech.de/ ]

        C:\USERS\SKRTI011\Cookies\RQ0QF8QA.txt [ Cookie:skrti011@revsci.net/ ]

        C:\USERS\SKRTI011\Cookies\NFZKKK5K.txt [ Cookie:skrti011@apmebf.com/ ]

        C:\USERS\SKRTI011\Cookies\SU79FCZC.txt [ Cookie:skrti011@clicksor.com/ ]

        C:\USERS\SKRTI011\Cookies\skrti011@adx.chip[2].txt [ Cookie:skrti011@adx.chip.de/ ]

        C:\USERS\SKRTI011\Cookies\VMLJDEU9.txt [ Cookie:skrti011@zanox.com/ ]

        C:\USERS\SKRTI011\Cookies\1WLF2PSG.txt [ Cookie:skrti011@ad.zanox.com/ ]

        C:\USERS\SKRTI011\Cookies\0UBO3D5G.txt [ Cookie:skrti011@ad3.adfarm1.adition.com/ ]

        C:\USERS\SKRTI011\Cookies\05E93ALN.txt [ Cookie:skrti011@fastclick.net/ ]

        C:\USERS\SKRTI011\Cookies\U6GYWXDF.txt [ Cookie:skrti011@mm.chitika.net/ ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@2O7[2].TXT [ /2O7 ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@ATDMT[2].TXT [ /ATDMT ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@MSNPORTAL.112.2O7[1].TXT [ /MSNPORTAL.112.2O7 ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@AD1.ADFARM1.ADITION[1].TXT [ /AD1.ADFARM1.ADITION ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]

        C:\USERS\SKRTI011\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\SKRTI011@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]

Eset log:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-18 08:28:34

# local_time=2011-10-18 10:28:34 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 302880 55501882 198059 0

# compatibility_mode=5893 16776574 100 94 12357193 70596217 0 0

# compatibility_mode=8192 67108863 100 0 476 476 0 0

# scanned=146587

# found=5

# cleaned=0

# scan_time=4709

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\AppData\Roaming\java.exe        a variant of Win32/Kryptik.UAA trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-18 11:21:51

# local_time=2011-10-19 01:21:51 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 307631 55506633 202810 0

# compatibility_mode=5893 16776574 100 94 12361944 70600968 0 0

# compatibility_mode=8192 67108863 100 0 5227 5227 0 0

# scanned=390075

# found=7

# cleaned=0

# scan_time=10355

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\AppData\Roaming\java.exe        a variant of Win32/Kryptik.UAA trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\skrti011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

F:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

F:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-19 03:21:49

# local_time=2011-10-19 05:21:49 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 373153 55572155 268332 0

# compatibility_mode=5893 16776574 100 94 12427466 70666490 0 0

# compatibility_mode=8192 67108863 100 0 70749 70749 0 0

# scanned=70419

# found=2

# cleaned=0

# scan_time=2410

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=4ff945c72cd9f44ab9ace0b0ddad452d

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-10-23 06:10:34

# local_time=2011-10-23 08:10:34 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16775165 100 94 677775 55876777 106976 0

# compatibility_mode=5893 16776574 100 94 12732088 70971112 0 0

# compatibility_mode=8192 67108863 100 0 375371 375371 0 0

# scanned=391460

# found=4

# cleaned=0

# scan_time=10313

C:\Backup Ext. Festplatte\Fun- other stuff\ferrariscreensaver.exe        Win32/Adware.Gator.Trickler application (unable to clean)        00000000000000000000000000000000        I

C:\Backup Ext. Festplatte\Fun- other stuff\gun.exe        probably a variant of Win32/Agent.EFDSENW trojan (unable to clean)        00000000000000000000000000000000        I

H:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_age-of-empires.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

H:\Backup Laptop 17.10.2011\Downloads\SoftonicDownloader_fuer_simutrans.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

Soll/Kann ich die gefundenen Dateien manuell löschen und dann geht keine Gefahr mehr von Ihnen aus?

Vielen Dank weiterhin!

Grüße
Tim

Nur Cookies, ein Überrest bei Malwarebytes und ältere Sachen im ESET-Log. Ob du die noch brauchst, musst du wissen.
Rechner soweit wieder im Lot?

Hi Arne,

an dieser Stelle noch einmal VIELEN DANK!!! Also der Rechner läuft, soweit ich das überblicken kann, wieder rund. Ein paar abschließende Fragen hätte ich noch:

Bestehen gem. der Scans auch keine Infektionen (mehr) auf den ext. Datenträgern?
soll ich mit defrogger wieder "reaktivieren"?
welche der in unserem Prozess installierten Programme kannst du mir empfehlen zu behalten?
besonders: SUPERAntiSpyware hab ich jetzt permanent in der Taskleiste. Das Programm "beißt" sich nicht mit meinem Virenscanner?
Ich hatte unter den Eset.log geschrieben

Zitat:

Soll/Kann ich die gefundenen Dateien manuell löschen und dann geht keine Gefahr mehr von Ihnen aus?

Kann ich die vier Dateien also händisch einfach raushauen? vgl. ganz unten im logfile.

Nochmal vielen Dank! :taenzer: :daumenhoc

Gruß
Tim

Zitat:

Bestehen gem. der Scans auch keine Infektionen (mehr) auf den ext. Datenträgern?

Wurden denn ALLE immer mitgescannt?

Zitat:

soll ich mit defrogger wieder "reaktivieren"?

ja kannste machen

Zitat:

besonders: SUPERAntiSpyware hab ich jetzt permanent in der Taskleiste. Das Programm "beißt" sich nicht mit meinem Virenscanner?

SUPERAntiSpyware deinstallieren

Zitat:

Ich hatte unter den Eset.log geschrieben

kann gelöscht werden

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Hi Arne,

danke für die letzten Tips.

Zitat:

Wurden denn ALLE immer mitgescannt?

Jub, das hab ich gemacht :)

Die letzten Hinweise werd ich auch noch befolgen, dann sollte alles wieder im Lot sein. Danke dir nochmal recht herzlich!!! :dankeschoen:

Viele Grüße
Tim