Trojaner-Board - auch sirefef.o auf dem Computer

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - auch sirefef.o auf dem Computer (https://www.trojaner-board.de/104511-sirefef-o-computer.html)

osam log
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 11:23:20 on 31.10.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 7.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Sophos Limited" - C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll

"AppInit_DLLs" - "Sophos Limited" - C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - ? - sdnclean.exe  (File not found)
 

[Common]

-----( %SystemRoot%\Tasks )-----

"ParetoLogic Registration.job" - ? - C:\Program Files\Common Files\ParetoLogic\UUS2\UUS.dll

"ParetoLogic Update Version2.job" - ? - C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL

"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acsint" (acsint) - "Cisco Systems, Inc." - C:\Windows\System32\DRIVERS\acsint.sys

"acsmux" (acsmux) - "Cisco Systems, Inc." - C:\Windows\System32\DRIVERS\acsmux.sys

"catchme" (catchme) - ? - C:\Users\SE4A0~1.CHA\AppData\Local\Temp\catchme.sys  (File not found)

"fwlorfoc" (fwlorfoc) - ? - C:\Users\SE4A0~1.CHA\AppData\Local\Temp\fwlorfoc.sys  (Hidden registry entry, rootkit activity | File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\Windows\system32\drivers\mbamswissarmy.sys  (File not found)

"regi" (regi) - "InterVideo" - C:\Windows\system32\drivers\regi.sys

"sdcfilter" (sdcfilter) - "Sophos Plc" - C:\Windows\System32\DRIVERS\sdcfilter.sys

"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

{0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} "Veoh Web Player Video Finder" - "Veoh Networks Inc" - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\s.chaitidou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\s.chaitidou\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"NSUFloatingUI" - "Sony Corporation" - "C:\Program Files\Sony\Network Utility\LANUtil.exe"                                                                                                                                                                                                                      

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Acrobat Assistant 8.0" - "Adobe Systems Inc." - "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"                                                                                                                                                                                                                

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"Cisco AnyConnect Secure Mobility Agent for Windows" - "Cisco Systems, Inc." - "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\AdobePDF.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Cisco AnyConnect Secure Mobility Agent" (vpnagent) - "Cisco Systems, Inc." - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
 

[Winlogon]

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"Sophos Web Intelligence LSP" - "Sophos Limited" - C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

Und was ist mit aswMBR?

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-31 11:26:24
-----------------------------
11:26:24.705 OS Version: Windows 6.0.6002 Service Pack 2
11:26:24.705 Number of processors: 2 586 0x1706
11:26:24.720 ComputerName: SOUCHAITIDOU UserName: s.chaitidou
11:26:26.717 Initialize success
11:29:58.073 AVAST engine defs: 11103100
11:30:22.627 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
11:30:22.627 Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
11:30:22.627 Disk 1 \Device\Harddisk1\DR1 -> \Device\000000ac
11:30:22.643 Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
11:30:22.643 Disk 2 \Device\Harddisk2\DR2 -> \Device\000000ad
11:30:22.643 Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
11:30:22.970 Disk 0 MBR read successfully
11:30:22.970 Disk 0 MBR scan
11:30:22.970 Disk 0 Windows VISTA default MBR code
11:30:23.079 Disk 0 scanning sectors +625141760
11:30:23.891 Disk 0 scanning C:\Windows\system32\drivers
11:31:55.712 Service scanning
11:31:57.085 Modules scanning
11:33:42.338 Disk 0 trace - called modules:
11:33:42.447 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys PxHelp20.sys
11:33:42.463 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86976ac8]
11:33:42.479 3 CLASSPNP.SYS[8abaa8b3] -> nt!IofCallDriver -> [0x85ec9408]
11:33:42.479 5 acpi.sys[8068f6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84f95028]
11:33:43.945 AVAST engine scan C:\Windows
11:35:50.995 AVAST engine scan C:\Windows\system32
11:42:07.517 AVAST engine scan C:\Windows\system32\drivers
11:42:22.041 AVAST engine scan C:\Users\s.chaitidou
12:36:01.218 AVAST engine scan C:\ProgramData
12:44:35.301 Scan finished successfully
12:51:10.750 Disk 0 MBR has been saved successfully to "C:\Users\s.chaitidou\Desktop\MBR.dat"
12:51:10.766 The log file has been saved successfully to "C:\Users\s.chaitidou\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8046

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19154

31.10.2011 16:08:15
mbam-log-2011-10-31 (16-08-15).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 353628
Laufzeit: 2 Stunde(n), 12 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 10/31/2011 at 07:03 PM

Application Version : 5.0.1134

Core Rules Database Version : 7868
Trace Rules Database Version: 5680

Scan type : Complete Scan
Total Scan Time : 02:41:39

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)

Memory items scanned : 615
Memory threats detected : 0
Registry items scanned : 38684
Registry threats detected : 0
File items scanned : 178008
File threats detected : 91

Adware.Tracking Cookie
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@find.in[1].txt [ Cookie:s.chaitidou@find.in.gr/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@im.banner.t-online[1].txt [ Cookie:s.chaitidou@im.banner.t-online.de/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@www.google[2].txt [ Cookie:s.chaitidou@www.google.com/accounts ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\21VT1GE4.txt [ Cookie:s.chaitidou@accounts.google.com/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@adfarm1.adition[2].txt [ Cookie:s.chaitidou@adfarm1.adition.com/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q95JW9XO.txt [ Cookie:s.chaitidou@www.google.de/accounts ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@ad3.adfarm1.adition[2].txt [ Cookie:s.chaitidou@ad3.adfarm1.adition.com/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@tradedoubler[7].txt [ Cookie:s.chaitidou@tradedoubler.com/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\MB2OIJ16.txt [ Cookie:s.chaitidou@www.google.com/accounts ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\s.chaitidou@media6degrees[2].txt [ Cookie:s.chaitidou@media6degrees.com/ ]
C:\USERS\S.CHAITIDOU\AppData\Roaming\Microsoft\Windows\Cookies\Low\XX6MM764.txt [ Cookie:s.chaitidou@google.com/accounts/ ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADTECH[1].TXT [ /ADTECH ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD.DYNTRACKER[2].TXT [ /AD.DYNTRACKER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD.ADNET[2].TXT [ /AD.ADNET ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD.YIELDMANAGER[1].TXT [ /AD.YIELDMANAGER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD.ZANOX[2].TXT [ /AD.ZANOX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD1.ADFARM1.ADITION[1].TXT [ /AD1.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD1.ADFARM1.ADITION[2].TXT [ /AD1.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD1.ADFARM1.ADITION[4].TXT [ /AD1.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD2.ADFARM1.ADITION[1].TXT [ /AD2.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD2.ADFARM1.ADITION[2].TXT [ /AD2.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD2.ADFARM1.ADITION[3].TXT [ /AD2.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD3.ADFARM1.ADITION[1].TXT [ /AD3.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@AD4.ADFARM1.ADITION[1].TXT [ /AD4.ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADFARM1.ADITION[3].TXT [ /ADFARM1.ADITION ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADS.MED2CLICK[2].TXT [ /ADS.MED2CLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADS.BOERSE[2].TXT [ /ADS.BOERSE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADS.CREATIVE-SERVING[2].TXT [ /ADS.CREATIVE-SERVING ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADSERVER.DOCCHECK[1].TXT [ /ADSERVER.DOCCHECK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADSERVER.DOCCHECK[2].TXT [ /ADSERVER.DOCCHECK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADSERVER.DOCCHECK[3].TXT [ /ADSERVER.DOCCHECK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADSERVER.DOCCHECK[5].TXT [ /ADSERVER.DOCCHECK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADTECH[3].TXT [ /ADTECH ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADTECH[4].TXT [ /ADTECH ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ADTECH[5].TXT [ /ADTECH ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@APMEBF[1].TXT [ /APMEBF ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@COLLECTIVE-MEDIA[2].TXT [ /COLLECTIVE-MEDIA ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@EAS.APM.EMEDIATE[1].TXT [ /EAS.APM.EMEDIATE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@EAS.APM.EMEDIATE[3].TXT [ /EAS.APM.EMEDIATE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@EAS.APM.EMEDIATE[4].TXT [ /EAS.APM.EMEDIATE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@FASTCLICK[1].TXT [ /FASTCLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@FASTCLICK[2].TXT [ /FASTCLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@FASTCLICK[3].TXT [ /FASTCLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@HBXTRACKING.SUEDDEUTSCHE[2].TXT [ /HBXTRACKING.SUEDDEUTSCHE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@IM.BANNER.T-ONLINE[3].TXT [ /IM.BANNER.T-ONLINE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@KOMTRACK[1].TXT [ /KOMTRACK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@KOMTRACK[2].TXT [ /KOMTRACK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@MED2CLICK[1].TXT [ /MED2CLICK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@MEDIAPLEX[3].TXT [ /MEDIAPLEX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@MEDIAPLEX[1].TXT [ /MEDIAPLEX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@NEXTAG[1].TXT [ /NEXTAG ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@NEXTAG[2].TXT [ /NEXTAG ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@SERVING-SYS[1].TXT [ /SERVING-SYS ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRAFFICTRACK[1].TXT [ /TRAFFICTRACK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRACKING.QUISMA[1].TXT [ /TRACKING.QUISMA ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRACKING.QUISMA[2].TXT [ /TRACKING.QUISMA ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRADEDOUBLER[2].TXT [ /TRADEDOUBLER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRADEDOUBLER[3].TXT [ /TRADEDOUBLER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRADEDOUBLER[4].TXT [ /TRADEDOUBLER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRADEDOUBLER[5].TXT [ /TRADEDOUBLER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@TRAFFICTRACK[3].TXT [ /TRAFFICTRACK ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WEBMASTERPLAN[1].TXT [ /WEBMASTERPLAN ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WW251.SMARTADSERVER[1].TXT [ /WW251.SMARTADSERVER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WW251.SMARTADSERVER[2].TXT [ /WW251.SMARTADSERVER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WWW.ETRACKER[2].TXT [ /WWW.ETRACKER ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WWW.GOOGLEADSERVICES[1].TXT [ /WWW.GOOGLEADSERVICES ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WWW.GOOGLEADSERVICES[6].TXT [ /WWW.GOOGLEADSERVICES ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@WWW.GOOGLEADSERVICES[9].TXT [ /WWW.GOOGLEADSERVICES ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ZANOX[2].TXT [ /ZANOX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ZANOX-AFFILIATE[2].TXT [ /ZANOX-AFFILIATE ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ZANOX[1].TXT [ /ZANOX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ZANOX[3].TXT [ /ZANOX ]
C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\S.CHAITIDOU@ZANOX[4].TXT [ /ZANOX ]
accounts.youtube.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.getclicky.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.static.getclicky.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.sonyeurope.112.2o7.net [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.sonygs.112.2o7.net [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\S.CHAITIDOU\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UCS85HTW.DEFAULT\COOKIES.SQLITE ]

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7af2ea47af861742ba1d0ffc3aa5898d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-27 04:09:49
# local_time=2011-10-27 06:09:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 1663 157253446 0 0
# compatibility_mode=8192 67108863 100 0 213 213 0 0
# compatibility_mode=8449 16774142 33 2 1672 19622087 0 0
# scanned=298734
# found=13
# cleaned=0
# scan_time=11071
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Bonjour\mDNSResponder.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sony\VAIO Event Service\VESMgr.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sophos\AutoUpdate\ALsvc.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir a variant of Win32/Sirefef.CH trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\nvvsvc.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\xaudio.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\s.chaitidou\Downloads\SoftonicDownloader_fuer_daxa-chart.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=7af2ea47af861742ba1d0ffc3aa5898d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-31 08:30:59
# local_time=2011-10-31 09:30:59 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 37103 157617735 0 0
# compatibility_mode=8192 67108863 100 0 364502 364502 0 0
# compatibility_mode=8449 16774142 33 2 119120 19986376 0 0
# scanned=198780
# found=18
# cleaned=0
# scan_time=8051
C:\Qoobox\Quarantine\C\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Bonjour\mDNSResponder.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sony\VAIO Event Service\VESMgr.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sophos\AutoUpdate\ALsvc.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir a variant of Win32/Sirefef.CH trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\nvvsvc.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\netbt.sys.vir a variant of Win32/Rootkit.Kryptik.EQ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\netbt.sys.vir_ a variant of Win32/Rootkit.Kryptik.EQ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\xaudio.exe.vir Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X9C9WLXQ\index[1].htm JS/Kryptik.CZ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys a variant of Win32/Rootkit.Kryptik.EQ trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles.zip multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\10282011_121721\C_Program Files\Sony\VAIO Event Service\VESMgrSub.exe Win32/Patched.HN trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\10282011_121721\C_Users\s.chaitidou\Downloads\SoftonicDownloader_fuer_daxa-chart.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Code:

:Files

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5

C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

All processes killed
========== FILES ==========
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X9C9WLXQ folder moved successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAW3ECAA folder moved successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO1EUG7U folder moved successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0RYP44K folder moved successfully.
Folder move failed. C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 scheduled to be moved on reboot.
C:\Windows\winsxs\x86_microsoft-windows-netbt_31bf3856ad364e35_6.0.6002.18005_none_6250416df465f2b1\netbt.sys moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: s.chaitidou
->Temp folder emptied: 60212089 bytes
->Temporary Internet Files folder emptied: 52850340 bytes
->Java cache emptied: 97989 bytes
->FireFox cache emptied: 101089496 bytes
->Apple Safari cache emptied: 2297856 bytes
->Flash cache emptied: 58287 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 50699 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 207,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 11012011_081753

Files\Folders moved on Reboot...
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 folder moved successfully.

Registry entries deleted on Reboot...

Ok. Ansonsten nur Cookies. Die Überreste haben wir eben mit OTL unschädlich gemacht.
Rechner soweit wieder im Lot?

Nach soviel Medizin kein Wunder :-)

Beim wiederinstallieren vom Sophos gibt es probleme. von der alten installation ist noch eine Datei übrig unter c: Programme/sophos/sophos antivirus/ savservice.exe die sich nicht beseitigen lässt und das ist notwendig um die software wieder zu instellieren. Die kann ich auch manuell nicht löschen. Hast du da eine Idee? Ich dacht es könnte was mit der QUarantäne zu tun haben.

Code:

:Files

c:\Programme\sophos\sophos antivirus

:Commands

[emptytemp]

[resethosts]

All processes killed
========== FILES ==========
c:\Programme\sophos\Sophos Anti-Virus folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: s.chaitidou
->Temp folder emptied: 6807434 bytes
->Temporary Internet Files folder emptied: 14511810 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61469508 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1031 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 54009 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 79,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 11022011_103305

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Sophos müsste nun weg sein.
Bitte mal prüfen ob die Installation nun geht.

JA Super! Hat jetzt geklappt. Was noch anders ist am Rechner ist eine allgemein veränderte Schrifft, (also keine Windows Tahoma mehr) was mich aber wenig stört, und Probleme von Itunes die sich auch nach Reparatur nicht beheben lassen. Da müsste ich entl de- und neuinstallation versuchen. Was merkwürdig erscheint ist dass der Rechner ständigt beschäftig erscheint, die Festplatte arbeitet ununterbrochen und ich kann nicht verstehen welcher Prozess dafür verantwortlich ist. Hast du da eine Idee? Kann ich eigentliche die Programme die wir verwendet haben alle löschen? Welches würdest du empfehlen als Antimalwäre evtl zu behalten damit mit in Zukunft besser geschützt ist?