Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Verschlüsselungs Trojaner "Trojan.Inject1.2545" Wirklich gelöscht? (https://www.trojaner-board.de/114465-verschluesselungs-trojaner-trojan-inject1-2545-wirklich-geloescht.html)

Smil0don 30.04.2012 20:00
Verschlüsselungs Trojaner "Trojan.Inject1.2545" Wirklich gelöscht?
 
Hallo,
auf dem Rechner meiner Eltern hat sich ein Verschlüsselungs-Trojaner breit gemacht. Er wurde durch unvorsichtiges öffnen eines Emailanhanges installiert. Die Email war eine Telekom-Fake-Rechnungs-Email, mit einer "Rechnung.zip" im Anhang.
Nach normalen booten wurde dann ein Fenster angezeigt, auf dem man aufgefordert wurde 50 € in U-Cash zu überweisen.
Ich habe dann den Rechner im Abgesicherten Modus gestartet und OTL und Dr.Web laufen lassen. Die Dateien sind auch wieder entschlüsselt mit Hilfe des "matsnu1decrypt".

Ich habe OTL einmal vor und einmal nach Dr.Web durchlaufen lassen.
Dr.Web hat das hier gefunden:

bnmsdfgqwe.pre C:\Users\Daniela\AppData\Local\Temp Trojan.Inject1.2545 Gelöscht.
7fdc4855c0871c930385.exe c:\users\daniela\appdata\roaming\ektvynam Trojan.Inject1.2545 Gelöscht.

Hier sind die OTL Logs:

Davor:
OTL Logfile:
Code:
OTL logfile created on: 30.04.2012 19:46:11 - Run 2
OTL by OldTimer - Version 3.2.42.2    Folder = C:\Users\Daniela\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 66,55% Memory free
4,23 Gb Paging File | 3,72 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 241,73 Gb Total Space | 168,51 Gb Free Space | 69,71% Space Free | Partition Type: NTFS
Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32
 
Computer Name: SERVER | User Name: Daniela | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.30 19:44:05 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Daniela\Downloads\OTL.exe
PRC - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe
PRC - [2012.03.26 21:29:07 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.01.31 08:56:04 | 002,757,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Users\Daniela\AppData\Local\Temp\RarSFX0\presetup.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe
MOD - [2012.03.26 21:29:07 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.03.02 23:21:57 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2007.07.23 16:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.22 13:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Stopped] -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2008.01.21 04:25:56 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.09 15:24:52 | 000,163,424 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2011.08.04 10:20:38 | 000,103,112 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2011.08.04 10:20:36 | 000,118,104 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.10.21 01:51:30 | 001,217,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.07.23 16:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLADResM.SYS -- (DLADResM)
DRV - [2007.07.23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2007.07.23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2007.07.23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2007.07.23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2007.07.23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2007.07.23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2007.07.23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2007.07.23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007.07.23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006.12.08 11:33:21 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.sys -- (SSPORT)
DRV - [2006.12.08 11:33:20 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D F7 08 90 B6 0A CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.26 21:29:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.02.19 11:13:15 | 000,000,000 | ---D | M]
 
[2012.02.12 20:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Extensions
[2012.04.30 17:04:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Firefox\Profiles\z361o7uv.default\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\DANIELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z361O7UV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.26 21:29:07 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [C0871C93] C:\Users\Daniela\AppData\Roaming\Ektvynam\7FDC4855C0871C930385.exe (Pigna colada)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk = C:\Windows\Installer\{91120407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61D16CFC-AFD0-4CE4-87FB-D1D4BA29E75E}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.30 15:59:29 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Malwarebytes
[2012.04.30 15:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.30 13:36:45 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Ektvynam
[2012.04.30 01:39:18 | 000,203,064 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.29 09:39:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.04.29 09:39:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung
[2012.04.24 16:49:02 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\*****
[2012.04.11 10:50:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.04.11 10:50:56 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.04.11 10:50:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.04.11 10:50:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.04.11 10:50:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.04.11 10:50:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.04.11 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\SET
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.30 17:35:08 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\****
[2012.04.30 17:31:38 | 056,902,656 | ---- | M] () -- C:\Users\Daniela\Documents\Outlook.pst
[2012.04.30 17:30:42 | 000,620,956 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.30 17:30:42 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.30 17:30:42 | 000,123,276 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.30 17:30:42 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.30 15:59:26 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.30 15:58:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.30 15:01:36 | 000,069,087 | ---- | M] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.30 14:31:30 | 000,002,771 | ---- | M] () -- C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk
[2012.04.30 13:42:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.04.30 13:37:25 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\locked-****cpsm
[2012.04.30 08:34:30 | 000,002,637 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Word 2003.lnk
[2012.04.30 01:39:18 | 000,203,064 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.22 10:13:12 | 000,002,665 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Excel 2003.lnk
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.04.30 17:35:08 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.htm
[2012.04.30 17:33:45 | 003,185,851 | ---- | C] () -- C:\Users\Daniela\Desktop\1.JPG
[2012.04.30 16:25:56 | 000,069,087 | ---- | C] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 15:59:26 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.29 09:47:24 | 000,001,589 | ---- | C] () -- C:\Users\Daniela\Desktop\Windows Fax and Scan.lnk
[2012.04.29 09:39:03 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe
[2012.04.24 16:49:02 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\locked-****.cpsm
[2012.02.21 01:11:04 | 000,003,584 | ---- | C] () -- C:\Users\Daniela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 11:44:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.02.20 11:44:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.02.20 11:44:32 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.20 11:44:22 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.02.15 15:35:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.02.15 15:35:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2012.02.14 23:51:02 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.02.12 22:35:26 | 000,620,956 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.02.12 22:35:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.02.12 22:35:26 | 000,123,276 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.02.12 22:35:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.02.12 18:57:47 | 000,086,016 | R--- | C] () -- C:\Windows\WiaInst.exe
[2012.02.12 18:57:21 | 000,022,723 | ---- | C] () -- C:\Windows\System32\suge1l3.dll
[2012.02.12 15:40:06 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.02.12 15:26:06 | 000,000,234 | ---- | C] () -- C:\Windows\wininit.ini
[2012.02.12 15:17:43 | 000,217,088 | ---- | C] () -- C:\Windows\System32\ssminidriver.dll
[2012.02.12 15:17:43 | 000,027,136 | ---- | C] () -- C:\Windows\System32\ssimgfilter.dll
[2012.02.12 15:17:43 | 000,011,264 | ---- | C] () -- C:\Windows\System32\sssegfilter.dll
[2012.02.12 15:17:43 | 000,010,752 | ---- | C] () -- C:\Windows\System32\sserrhandler.dll
[2012.02.12 15:08:39 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2012.02.12 15:08:39 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2012.02.12 15:08:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll
[2012.02.12 14:51:32 | 000,000,680 | ---- | C] () -- C:\Users\Daniela\AppData\Local\d3d9caps.dat
 
========== LOP Check ==========
 
[2012.04.30 13:36:45 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\Ektvynam
[2012.02.15 15:35:06 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\FreePDF
[2012.04.30 14:31:58 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---


Danach:
OTL Logfile:
Code:
OTL logfile created on: 30.04.2012 20:37:37 - Run 3
OTL by OldTimer - Version 3.2.42.2    Folder = C:\Users\Daniela\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,46 Gb Available Physical Memory | 73,34% Memory free
4,23 Gb Paging File | 3,69 Gb Available in Paging File | 87,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 241,73 Gb Total Space | 168,34 Gb Free Space | 69,64% Space Free | Partition Type: NTFS
Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32
 
Computer Name: SERVER | User Name: Daniela | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.04.30 19:44:05 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Daniela\Downloads\OTL.exe
PRC - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe
PRC - [2012.03.26 21:29:07 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.01.31 08:56:04 | 002,757,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Users\Daniela\AppData\Local\Temp\RarSFX0\presetup.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe
MOD - [2012.03.26 21:29:07 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.03.02 23:21:57 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2007.07.23 16:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.22 13:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Stopped] -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2008.01.21 04:25:56 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.09 15:24:52 | 000,163,424 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2011.08.04 10:20:38 | 000,103,112 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2011.08.04 10:20:36 | 000,118,104 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.10.21 01:51:30 | 001,217,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.07.23 16:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLADResM.SYS -- (DLADResM)
DRV - [2007.07.23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2007.07.23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2007.07.23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2007.07.23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2007.07.23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2007.07.23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2007.07.23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2007.07.23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007.07.23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006.12.08 11:33:21 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.sys -- (SSPORT)
DRV - [2006.12.08 11:33:20 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D F7 08 90 B6 0A CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.26 21:29:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.02.19 11:13:15 | 000,000,000 | ---D | M]
 
[2012.02.12 20:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Extensions
[2012.04.30 17:04:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Firefox\Profiles\z361o7uv.default\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\DANIELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z361O7UV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.26 21:29:07 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk = C:\Windows\Installer\{91120407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61D16CFC-AFD0-4CE4-87FB-D1D4BA29E75E}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.30 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Daniela\DoctorWeb
[2012.04.30 15:59:29 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Malwarebytes
[2012.04.30 15:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.30 13:36:45 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Ektvynam
[2012.04.30 01:39:18 | 000,203,064 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.29 09:39:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.04.29 09:39:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung
[2012.04.24 16:49:02 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\***-Dateien
[2012.04.11 10:50:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.04.11 10:50:56 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.04.11 10:50:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.04.11 10:50:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.04.11 10:50:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.04.11 10:50:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.04.11 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\SET
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.30 20:33:51 | 000,000,182 | ---- | M] () -- C:\Users\Daniela\Desktop\DrWeb.csv
[2012.04.30 19:50:51 | 056,902,656 | ---- | M] () -- C:\Users\Daniela\Documents\Outlook.pst
[2012.04.30 17:35:08 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\****.htm
[2012.04.30 17:30:42 | 000,620,956 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.30 17:30:42 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.30 17:30:42 | 000,123,276 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.30 17:30:42 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.30 15:59:26 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.30 15:58:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.30 15:01:36 | 000,069,087 | ---- | M] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.30 14:31:30 | 000,002,771 | ---- | M] () -- C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk
[2012.04.30 13:42:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.04.30 13:37:25 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\locked-****.cpsm
[2012.04.30 08:34:30 | 000,002,637 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Word 2003.lnk
[2012.04.30 01:39:18 | 000,203,064 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.22 10:13:12 | 000,002,665 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Excel 2003.lnk
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.04.30 20:33:51 | 000,000,182 | ---- | C] () -- C:\Users\Daniela\Desktop\DrWeb.csv
[2012.04.30 17:35:08 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.htm
[2012.04.30 17:33:45 | 003,185,851 | ---- | C] () -- C:\Users\Daniela\Desktop\1.JPG
[2012.04.30 16:25:56 | 000,069,087 | ---- | C] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 15:59:26 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.29 09:47:24 | 000,001,589 | ---- | C] () -- C:\Users\Daniela\Desktop\Windows Fax and Scan.lnk
[2012.04.29 09:39:03 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe
[2012.04.24 16:49:02 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.cpsm
[2012.02.21 01:11:04 | 000,003,584 | ---- | C] () -- C:\Users\Daniela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 11:44:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.02.20 11:44:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.02.20 11:44:32 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.20 11:44:22 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.02.15 15:35:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.02.15 15:35:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2012.02.14 23:51:02 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.02.12 22:35:26 | 000,620,956 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.02.12 22:35:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.02.12 22:35:26 | 000,123,276 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.02.12 22:35:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.02.12 18:57:47 | 000,086,016 | R--- | C] () -- C:\Windows\WiaInst.exe
[2012.02.12 18:57:21 | 000,022,723 | ---- | C] () -- C:\Windows\System32\suge1l3.dll
[2012.02.12 15:40:06 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.02.12 15:26:06 | 000,000,234 | ---- | C] () -- C:\Windows\wininit.ini
[2012.02.12 15:17:43 | 000,217,088 | ---- | C] () -- C:\Windows\System32\ssminidriver.dll
[2012.02.12 15:17:43 | 000,027,136 | ---- | C] () -- C:\Windows\System32\ssimgfilter.dll
[2012.02.12 15:17:43 | 000,011,264 | ---- | C] () -- C:\Windows\System32\sssegfilter.dll
[2012.02.12 15:17:43 | 000,010,752 | ---- | C] () -- C:\Windows\System32\sserrhandler.dll
[2012.02.12 15:08:39 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2012.02.12 15:08:39 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2012.02.12 15:08:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll
[2012.02.12 14:51:32 | 000,000,680 | ---- | C] () -- C:\Users\Daniela\AppData\Local\d3d9caps.dat
 
========== LOP Check ==========
 
[2012.04.30 20:30:04 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\Ektvynam
[2012.02.15 15:35:06 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\FreePDF
[2012.04.30 14:31:58 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---


Meine Frage ist hier, bin ich jetzt auf der sicheren Seite? Ist dieser Trojaner jetzt entfernt?

Vielen Dank für eure Hilfe!

Grüße,
Smil0don

kira 30.04.2012 22:43
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung

2.
Hast Du OTL falsch installiert:
OTL muss auf dem Desktop gespechert werden!
Stell deine Browser so ein, dass er OTL auf dem Desktop speichern soll!
also entfernen und erneut herunterladen:
-> Lade OTL von Oldtimer herunter und speichere es auf Deinem Desktop.

Nach installation in der Log-Datei soll etwa so aussehen:
Zitat:
Folder = C:\Users\***\Desktop
3.
Systemscan mit OTL
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

4.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
  • Download den CCleaner - Installer herunter
  • Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
  • starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
  • ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

Smil0don 01.05.2012 13:04
Hallo,

schonmal vielen Dank für die Rückmeldung!
MAM habe ich schon durchlaufen lassen und es hat nichts gefunden. Nur Dr.Web hat den beschriebenen Trojaner gefunden.
Hier das OTL Log
Code:
OTL logfile created on: 01.05.2012 13:51:26 - Run 4
OTL by OldTimer - Version 3.2.42.2    Folder = C:\Users\Daniela\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,44% Memory free
4,21 Gb Paging File | 3,26 Gb Available in Paging File | 77,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 241,73 Gb Total Space | 165,33 Gb Free Space | 68,39% Space Free | Partition Type: NTFS
Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32
 
Computer Name: SERVER | User Name: Daniela | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Daniela\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Programme\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll ()
MOD - C:\Windows\System32\igfxTMM.dll ()
MOD - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ekrn) -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (eamonm) -- C:\Windows\System32\drivers\eamonm.sys (ESET)
DRV - (epfwwfpr) -- C:\Windows\System32\drivers\epfwwfpr.sys (ESET)
DRV - (ehdrv) -- C:\Windows\System32\drivers\ehdrv.sys (ESET)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (DLADResM) -- C:\Windows\System32\drivers\DLADResM.SYS (Roxio)
DRV - (DLABMFSM) -- C:\Windows\System32\drivers\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) -- C:\Windows\System32\drivers\DLAUDF_M.SYS (Roxio)
DRV - (DLAUDFAM) -- C:\Windows\System32\drivers\DLAUDFAM.SYS (Roxio)
DRV - (DLAOPIOM) -- C:\Windows\System32\drivers\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) -- C:\Windows\System32\drivers\DLABOIOM.SYS (Roxio)
DRV - (DLAPoolM) -- C:\Windows\System32\drivers\DLAPoolM.SYS (Roxio)
DRV - (DLAIFS_M) -- C:\Windows\System32\drivers\DLAIFS_M.SYS (Roxio)
DRV - (DLARTL_M) -- C:\Windows\System32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DLACDBHM) -- C:\Windows\System32\drivers\DLACDBHM.SYS (Roxio)
DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.sys (Samsung Electronics)
DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D F7 08 90 B6 0A CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.wetteronline.de/****.htm"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.26 21:29:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.02.19 11:13:15 | 000,000,000 | ---D | M]
 
[2012.02.12 20:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Extensions
[2012.04.30 17:04:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Firefox\Profiles\z361o7uv.default\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.28 21:55:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\DANIELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z361O7UV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.26 21:29:07 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk = C:\Windows\Installer\{91120407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61D16CFC-AFD0-4CE4-87FB-D1D4BA29E75E}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.01 13:50:26 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Daniela\Desktop\OTL.exe
[2012.04.30 21:16:39 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Local\ESET
[2012.04.30 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Daniela\DoctorWeb
[2012.04.30 15:59:29 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Malwarebytes
[2012.04.30 15:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.30 13:36:45 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Ektvynam
[2012.04.30 01:39:18 | 000,203,064 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.29 09:39:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2012.04.29 09:39:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung
[2012.04.24 16:49:02 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\****-Dateien
[2012.04.11 10:50:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.04.11 10:50:56 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.04.11 10:50:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.04.11 10:50:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.04.11 10:50:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.04.11 10:50:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.04.11 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\SET
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.01 13:50:28 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Daniela\Desktop\OTL.exe
[2012.05.01 13:48:45 | 062,997,504 | ---- | M] () -- C:\Users\Daniela\Documents\Outlook.pst
[2012.05.01 13:43:38 | 000,002,771 | ---- | M] () -- C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk
[2012.05.01 13:40:48 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.01 13:40:48 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.01 13:40:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.01 10:31:44 | 000,621,704 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.05.01 10:31:44 | 000,589,884 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.05.01 10:31:44 | 000,123,654 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.05.01 10:31:44 | 000,101,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.05.01 10:24:32 | 2135,916,544 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.30 20:33:51 | 000,000,182 | ---- | M] () -- C:\Users\Daniela\Desktop\DrWeb.csv
[2012.04.30 20:07:22 | 084,370,552 | ---- | M] () -- C:\Users\Daniela\Desktop\drweb-cureit.exe
[2012.04.30 17:35:08 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\****
[2012.04.30 15:59:26 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.30 15:01:36 | 000,069,087 | ---- | M] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 13:42:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.04.30 13:37:25 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\locked-****.cpsm
[2012.04.30 08:34:30 | 000,002,637 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Word 2003.lnk
[2012.04.30 01:39:18 | 000,203,064 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe
[2012.04.22 10:13:12 | 000,002,665 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Excel 2003.lnk
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.04.30 21:03:29 | 2135,916,544 | -HS- | C] () -- C:\hiberfil.sys
[2012.04.30 20:33:51 | 000,000,182 | ---- | C] () -- C:\Users\Daniela\Desktop\DrWeb.csv
[2012.04.30 20:03:28 | 084,370,552 | ---- | C] () -- C:\Users\Daniela\Desktop\drweb-cureit.exe
[2012.04.30 17:35:08 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****
[2012.04.30 16:25:56 | 000,069,087 | ---- | C] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip
[2012.04.30 15:59:26 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.04.29 09:47:24 | 000,001,589 | ---- | C] () -- C:\Users\Daniela\Desktop\Windows Fax and Scan.lnk
[2012.04.29 09:39:03 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe
[2012.04.24 16:49:02 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\locked-****.cpsm
[2012.02.21 01:11:04 | 000,003,584 | ---- | C] () -- C:\Users\Daniela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.20 11:44:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012.02.20 11:44:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012.02.20 11:44:32 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.20 11:44:22 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012.02.15 15:35:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.02.15 15:35:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2012.02.14 23:51:02 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.02.12 22:35:26 | 000,621,704 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.02.12 22:35:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.02.12 22:35:26 | 000,123,654 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.02.12 22:35:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.02.12 18:57:47 | 000,086,016 | R--- | C] () -- C:\Windows\WiaInst.exe
[2012.02.12 18:57:21 | 000,022,723 | ---- | C] () -- C:\Windows\System32\suge1l3.dll
[2012.02.12 15:40:06 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.02.12 15:26:06 | 000,000,234 | ---- | C] () -- C:\Windows\wininit.ini
[2012.02.12 15:17:43 | 000,217,088 | ---- | C] () -- C:\Windows\System32\ssminidriver.dll
[2012.02.12 15:17:43 | 000,027,136 | ---- | C] () -- C:\Windows\System32\ssimgfilter.dll
[2012.02.12 15:17:43 | 000,011,264 | ---- | C] () -- C:\Windows\System32\sssegfilter.dll
[2012.02.12 15:17:43 | 000,010,752 | ---- | C] () -- C:\Windows\System32\sserrhandler.dll
[2012.02.12 15:08:39 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2012.02.12 15:08:39 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2012.02.12 15:08:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll
[2012.02.12 14:51:32 | 000,000,680 | ---- | C] () -- C:\Users\Daniela\AppData\Local\d3d9caps.dat

< End of report >
Und hier Extras
Code:
OTL Extras logfile created on: 01.05.2012 13:51:26 - Run 4
OTL by OldTimer - Version 3.2.42.2    Folder = C:\Users\Daniela\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 60,44% Memory free
4,21 Gb Paging File | 3,26 Gb Available in Paging File | 77,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 241,73 Gb Total Space | 165,33 Gb Free Space | 68,39% Space Free | Partition Type: NTFS
Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32
 
Computer Name: SERVER | User Name: Daniela | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1714511E-5829-4C59-B075-6C9059C52944}" = rport=138 | protocol=17 | dir=out | app=system |
"{33774737-8BC3-46A9-ABCB-ADB7A0EDF704}" = rport=445 | protocol=6 | dir=out | app=system |
"{3747E5D1-DA07-4768-B286-D3DCD2339FBD}" = rport=139 | protocol=6 | dir=out | app=system |
"{544EA6EC-90C0-47AA-BF3D-043AB0BF076E}" = lport=137 | protocol=17 | dir=in | app=system |
"{6D9FD681-7FE5-4A60-875B-B472B804AB48}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{70E72647-177B-4169-8270-80111D6CA5B0}" = lport=139 | protocol=6 | dir=in | app=system |
"{8F935D26-BE10-49D5-960C-5461104E8F5E}" = lport=138 | protocol=17 | dir=in | app=system |
"{B4767AA6-1ED6-4C40-A6F4-596421A540A8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CA991351-CBBF-4C2D-B9C4-9E95BE954257}" = lport=445 | protocol=6 | dir=in | app=system |
"{D951C153-1C0D-4E99-BDFE-54C8C253520A}" = rport=137 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4B55CB8B-61AD-4784-81AA-F08FB9B0EDFC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{922E0A38-6868-405D-99C5-ADCDF6C69294}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B639A455-1CDD-4078-AE3A-7603CBA34484}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EC38FC3E-103B-42D5-A004-234D89530268}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{FF872023-6648-42AF-9A07-1E6F55FE7291}" = ESET NOD32 Antivirus
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.04" = GPL Ghostscript
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Samsung SCX-4200 Series" = Samsung SCX-4200 Series
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 30.04.2012 01:48:42 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 07:41:48 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 07:46:32 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 08:28:58 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 08:31:38 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 09:58:21 | Computer Name = Server | Source = EventSystem | ID = 4609
Description =
 
Error - 30.04.2012 09:58:31 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 15:03:53 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
Error - 30.04.2012 19:25:57 | Computer Name = Server | Source = Windows Search Service | ID = 3013
Description =
 
Error - 01.05.2012 04:24:49 | Computer Name = Server | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 05.03.2012 05:21:16 | Computer Name = Server | Source = HTTP | ID = 15016
Description =
 
Error - 05.03.2012 05:21:50 | Computer Name = Server | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 05.03.2012 11:22:32 | Computer Name = Server | Source = HTTP | ID = 15016
Description =
 
Error - 05.03.2012 11:23:03 | Computer Name = Server | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 05.03.2012 15:06:42 | Computer Name = Server | Source = HTTP | ID = 15016
Description =
 
Error - 05.03.2012 15:07:16 | Computer Name = Server | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 06.03.2012 12:20:00 | Computer Name = Server | Source = DCOM | ID = 10010
Description =
 
Error - 06.03.2012 12:27:47 | Computer Name = Server | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 06.03.2012 15:06:55 | Computer Name = Server | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 06.03.2012 16:27:21 | Computer Name = Server | Source = DCOM | ID = 10010
Description =
 
 
< End of report >
und hier das CCcleaner Log
Code:
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        01.03.2012                11.1.102.62
Adobe Reader X (10.1.2) - Deutsch        Adobe Systems Incorporated        14.02.2012                10.1.2
CCleaner        Piriform        30.04.2012        4,47MB        3.18
Compatibility Pack für 2007 Office System        Microsoft Corporation        24.02.2012        123,6MB        12.0.6514.5001
Dell Resource CD        Ihr Firmenname        11.02.2012        3,05MB        1.10.0000
ESET NOD32 Antivirus        ESET, spol. s r.o.        18.02.2012        61,4MB        5.0.95.0
FreePDF (Remove only)                14.02.2012        3,58MB       
GPL Ghostscript        Artifex Software Inc.        14.02.2012        31,6MB        9.04
Intel(R) Graphics Media Accelerator Driver                11.02.2012               
Java(TM) 6 Update 22        Oracle        27.03.2012        97,1MB        6.0.220
Malwarebytes Anti-Malware Version 1.61.0.1400        Malwarebytes Corporation        29.04.2012        11,7MB        1.61.0.1400
Microsoft .NET Framework 3.5 SP1        Microsoft Corporation        12.02.2012        27,8MB       
Microsoft Office Standard Edition 2003        Microsoft Corporation        24.02.2012        242MB        11.0.8173.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        27.03.2012        0,58MB        9.0.30729.4148
Mozilla Firefox 11.0 (x86 de)        Mozilla        25.03.2012        36,0MB        11.0
OpenOffice.org 3.3        OpenOffice.org        27.03.2012        413MB        3.3.9567
RedMon - Redirection Port Monitor                14.02.2012               
Roxio Activation Module        Roxio        11.02.2012        8,11MB        1.0
Roxio Creator Audio        Roxio        11.02.2012        1,13MB        3.5.0
Roxio Creator Copy        Roxio        11.02.2012        0,66MB        3.5.0
Roxio Creator Data        Roxio        11.02.2012        0,98MB        3.5.0
Roxio Creator DE        Roxio        11.02.2012        27,5MB        3.5.0
Roxio Creator Tools        Roxio        11.02.2012        0,36MB        3.5.0
Roxio Drag-to-Disc        Roxio        11.02.2012        9,22MB        9.1
Roxio Express Labeler 3        Roxio        11.02.2012        19,6MB        3.2.1
Roxio Update Manager        Roxio        11.02.2012        3,60MB        6.0.0
Samsung SCX-4200 Series        Samsung Electronics CO.,LTD        11.02.2012        90,6MB       
Sonic CinePlayer Decoder Pack        Sonic Solutions        11.02.2012        40,0MB        4.2.0
Alle Logs sind auch nochmal angehängt.
Sorry wegen den "Quotes" :heilig:

Schönen Feiertag noch.

Grüße,
Smil0don

kira 01.05.2012 22:07
Softwareliste mit CCleaner (install.txt ) hast Du nicht vollständig gepostet?

Java aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version 6 Update 31 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

Smil0don 03.05.2012 21:32
Eigentlich hab ich die komplette Liste gepostet.
Das zu überprüfen ist jetzt allerdings schwer, da ich erst nächstes WE wieder an den Rechner ran komme...

Wie sieht das mit dem System sonst aus?

kira 04.05.2012 06:35
Zitat:
Zitat von Smil0don (Beitrag 824130)
Eigentlich hab ich die komplette Liste gepostet.
das mit dem letzten Buchstaben "S"? wenn so ist dann ist gut :)

Systemreinigung und Prüfung:

1.
Windows Defender abschalten:
Neben 1 AV-Scanner und 1 Firewall garnix erst nötig und nicht Empfehlenswert aktiv laufen lassen, weil dadurch können sich in die Quere kommen. Bitte dich ihn so zu deaktivieren: -> Aktivieren und Deaktivieren von Windows Defender
► Nach einem Neustart (falls noch existirt) unter "Start-> ausführen-> "msconfig" (reinschreiben ohne ""-> OK -> Systemstart kontrolliere, ob mitläuft?! - ggf Häckhen rausnehmen
► Unter Dienste:
Start -> Ausführen -> "Services.msc" -> (reinschreiben ohne ""-> OK" - "Eigenschaften"-> Starttyp "Deaktiviert" auswählen

2.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht:
Code:
:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

:Files
C:\Users\Daniela\AppData\Roaming\Ektvynam
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]

2.
Java aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version 6 Update 32 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

3.
Tipps (unabhängig davon ob man den Internet Explorer benutzt oder nicht!):
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Wie kann ich den Cache im Internet Explorer leeren?

4.
reinige dein System mit CCleaner:
  • "CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

5.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
    Achte darauf, eventuell angebotene Toolbar nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar (falls nötig), entfernen.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:03 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129