Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Entfernen von roper0dun Fehlermeldung nach TR/Reveton.F.48 (https://www.trojaner-board.de/124516-entfernen-roper0dun-fehlermeldung-tr-reveton-f-48-a.html)

baensh 22.09.2012 14:53
Entfernen von roper0dun Fehlermeldung nach TR/Reveton.F.48
 
Hallo,

nachdem vor einigen Tagen mein Avira den Trojaner Reveton.F.48 gefunden und die roper0dun.exe erfolgreich gelöscht hat, bekomme ich nach jedem Systemstart (Vista 32-bit) einen RunDLL - Fehler.

Ich habe schon in einigen Beiträgen die erfolgreiche Hilfe gesehen und hoffe, auch sobald wie möglich hier Hilfe zu bekommen.

Hier die Logs:
Code:
OTL logfile created on: 22.09.2012 14:59:09 - Run 1
OTL by OldTimer - Version 3.2.65.1    Folder = C:\Users\baensh\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,04 Gb Available Physical Memory | 68,18% Memory free
6,19 Gb Paging File | 5,15 Gb Available in Paging File | 83,26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 253,31 Gb Total Space | 61,91 Gb Free Space | 24,44% Space Free | Partition Type: NTFS
Drive D: | 10,60 Gb Total Space | 1,73 Gb Free Space | 16,37% Space Free | Partition Type: NTFS
Drive F: | 6,89 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: BAENSH-LAPTOP | User Name: baensh | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.22 14:03:48 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Users\baensh\Desktop\OTL.exe
PRC - [2012.08.09 03:30:24 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:38 | 000,823,224 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2012.07.27 13:51:28 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.09 11:03:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 11:03:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 11:03:38 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.15 18:59:32 | 000,312,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2011.02.02 19:34:54 | 000,353,800 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
PRC - [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.09.23 12:18:52 | 000,365,904 | ---- | M] () -- C:\Program Files\SMINST\BLService.exe
PRC - [2008.09.19 08:30:34 | 003,674,112 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
PRC - [2008.09.19 04:03:58 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
PRC - [2008.09.11 12:52:52 | 000,237,650 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\stacsv.exe
PRC - [2008.09.11 12:50:38 | 000,446,556 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2008.06.27 16:53:08 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\AEstSrv.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.06.17 12:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll
MOD - [2009.06.17 12:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll
MOD - [2009.06.17 12:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2008.09.16 21:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 -- (Norton Internet Security)
SRV - [2012.09.07 20:11:28 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.09.07 10:58:11 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.03 20:37:50 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.07.27 13:51:28 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.09 11:03:39 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 11:03:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.02.02 19:34:54 | 000,353,800 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe -- (cpextender)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2008.09.23 12:18:52 | 000,365,904 | ---- | M] () [Auto | Running] -- C:\Program Files\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008.09.19 04:03:58 | 000,065,536 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe -- (pgsql-8.3)
SRV - [2008.09.11 12:52:52 | 000,237,650 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\stacsv.exe -- (STacSV)
SRV - [2008.06.27 16:53:08 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\AEstSrv.exe -- (AESTFilters)
SRV - [2008.02.03 12:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX)
DRV - File not found [File_System | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | Auto | Stopped] --  -- (adfs)
DRV - [2012.05.09 11:03:39 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 11:03:39 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.02 23:18:05 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.12.02 23:18:04 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.12.02 13:44:32 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.10.19 17:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.05.13 19:57:42 | 000,025,656 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2011.05.13 19:57:20 | 000,035,896 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2011.02.02 19:34:54 | 000,129,304 | ---- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vna.sys -- (VNA)
DRV - [2010.08.31 14:43:36 | 000,195,968 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2010.06.17 16:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.10.03 07:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.06.10 00:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009.04.10 23:06:28 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2008.11.17 16:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008.09.11 12:54:44 | 000,389,120 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008.09.04 19:47:00 | 000,054,784 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2008.08.07 19:01:44 | 000,097,536 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008.08.06 18:26:08 | 000,124,928 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.08.06 05:29:26 | 000,044,576 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.01.21 04:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2008.01.21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
DRV - [2007.06.18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007.04.05 12:08:16 | 000,012,160 | ---- | M] (PLX Technology, Inc. (visit www.PlxTech.com)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RealICEBulk.SYS -- (NCBULK)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {471BF022-2160-4207-8BD3-B9A7EBB54A3A}
IE - HKLM\..\SearchScopes\{471BF022-2160-4207-8BD3-B9A7EBB54A3A}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1134&query={searchTerms}&invocationType=tb50hpcnnbie7-de-at
IE - HKLM\..\SearchScopes\{600A3585-D7C7-45F6-A98E-FA4D1C04596A}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{ADF7FD40-D543-4DA3-8E35-EC7233F24B91}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=91&bd=Pavilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {471BF022-2160-4207-8BD3-B9A7EBB54A3A}
IE - HKCU\..\SearchScopes\{471BF022-2160-4207-8BD3-B9A7EBB54A3A}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1134&query={searchTerms}&invocationType=tb50hpcnnbie7-de-at
IE - HKCU\..\SearchScopes\{600A3585-D7C7-45F6-A98E-FA4D1C04596A}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{ADF7FD40-D543-4DA3-8E35-EC7233F24B91}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.http: "86.59.5.46"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\baensh\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.15 14:13:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.09.04 12:15:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 20:11:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.15 14:13:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.07 20:11:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.12.02 11:42:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\baensh\AppData\Roaming\mozilla\Extensions
[2012.07.25 21:30:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\baensh\AppData\Roaming\mozilla\Firefox\Profiles\ks4bs9o9.default\extensions
[2012.05.04 09:49:35 | 000,013,610 | ---- | M] () (No name found) -- C:\Users\baensh\AppData\Roaming\mozilla\firefox\profiles\ks4bs9o9.default\extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi
[2012.07.25 21:30:35 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\baensh\AppData\Roaming\mozilla\firefox\profiles\ks4bs9o9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.07 20:11:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.09.07 20:11:28 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.20 17:04:56 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 22:22:19 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.20 17:04:56 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.20 17:04:56 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.20 17:04:56 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.20 17:04:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.04.24 23:58:29 | 000,001,211 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [F.lux] C:\Users\baensh\Local Settings\Apps\F.lux\flux.exe ()
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254 192.168.0.254 213.33.99.70
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{568DB25C-5B54-45A0-B6F0-854C394EC882}: DhcpNameServer = 192.168.0.254 192.168.0.254 213.33.99.70
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B4378362-FE6D-408B-82E4-64270E7EE215}: DhcpNameServer = 192.168.0.254 192.168.0.254 213.33.99.70
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011.09.25 23:19:27 | 000,000,000 | ---D | M] - F:\AutoRun -- [ CDFS ]
O32 - AutoRun File - [2011.09.25 23:19:27 | 003,809,416 | R--- | M] (Electronic Arts Inc.) - F:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2011.09.25 23:19:27 | 000,000,049 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{099d9e2e-da51-11e1-93f5-54330dd63f0d}\Shell - "" = AutoRun
O33 - MountPoints2\{099d9e2e-da51-11e1-93f5-54330dd63f0d}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{099d9e41-da51-11e1-93f5-001e101f1838}\Shell - "" = AutoRun
O33 - MountPoints2\{099d9e41-da51-11e1-93f5-001e101f1838}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{099d9e4c-da51-11e1-93f5-001e101f859f}\Shell - "" = AutoRun
O33 - MountPoints2\{099d9e4c-da51-11e1-93f5-001e101f859f}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{5f317288-5d67-11e1-86da-00238b5f625a}\Shell - "" = AutoRun
O33 - MountPoints2\{5f317288-5d67-11e1-86da-00238b5f625a}\Shell\AutoRun\command - "" = G:\OnSpcLCK.exe
O33 - MountPoints2\{791a26f5-dcbd-11e1-b068-001e101fe5e1}\Shell - "" = AutoRun
O33 - MountPoints2\{791a26f5-dcbd-11e1-b068-001e101fe5e1}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{a9c765de-1cd2-11e1-85dc-00238b5f625a}\Shell - "" = AutoRun
O33 - MountPoints2\{a9c765de-1cd2-11e1-85dc-00238b5f625a}\Shell\AutoRun\command - "" = F:\Autorun.exe -- [2011.09.25 23:19:27 | 003,809,416 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\{b6c42094-dcb4-11e1-a850-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{b6c42094-dcb4-11e1-a850-001e101fa1f5}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{f8269091-e5dc-11e1-945b-54330dd63f0d}\Shell - "" = AutoRun
O33 - MountPoints2\{f8269091-e5dc-11e1-945b-54330dd63f0d}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.22 14:03:46 | 000,600,576 | ---- | C] (OldTimer Tools) -- C:\Users\baensh\Desktop\OTL.exe
[2012.09.07 20:11:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.09.03 21:26:00 | 000,000,000 | ---D | C] -- C:\Users\baensh\AppData\Roaming\TS3Client
[2012.09.03 21:25:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012.09.03 21:25:39 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2012.09.03 20:49:13 | 000,000,000 | ---D | C] -- C:\Users\baensh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[2012.08.31 18:10:55 | 000,000,000 | ---D | C] -- C:\Users\baensh\AppData\Roaming\.matplotlib
[2012.08.31 18:01:16 | 000,000,000 | ---D | C] -- C:\Users\baensh\Desktop\Anki Pictures
[2012.08.31 17:53:28 | 000,000,000 | ---D | C] -- C:\Users\baensh\Documents\Anki
[2012.08.31 17:53:27 | 000,000,000 | ---D | C] -- C:\Users\baensh\AppData\Roaming\.anki
[2012.08.31 17:51:28 | 000,000,000 | ---D | C] -- C:\Program Files\Anki
[2012.08.31 09:50:52 | 000,000,000 | ---D | C] -- C:\Windows\pss
[1 C:\Users\baensh\Desktop\*.tmp files -> C:\Users\baensh\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.22 15:05:06 | 000,000,448 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D6B1CC9A-7EF6-42CF-9657-680082B9E40E}.job
[2012.09.22 14:57:15 | 000,000,156 | ---- | M] () -- C:\Users\baensh\defogger_reenable
[2012.09.22 14:56:26 | 000,050,477 | ---- | M] () -- C:\Users\baensh\Desktop\Defogger.exe
[2012.09.22 14:46:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.22 14:25:20 | 000,689,148 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.22 14:25:20 | 000,646,970 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.22 14:25:20 | 000,152,144 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.22 14:25:20 | 000,124,726 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.22 14:12:25 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.22 14:12:25 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.22 14:03:48 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Users\baensh\Desktop\OTL.exe
[2012.09.22 13:52:28 | 000,902,866 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.09.22 13:52:28 | 000,902,866 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.09.22 13:52:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.22 12:47:01 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-760881748-415986508-3123094275-1000UA.job
[2012.09.22 12:12:13 | 3216,224,256 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.20 21:47:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-760881748-415986508-3123094275-1000Core.job
[2012.09.10 21:34:37 | 000,066,048 | ---- | M] () -- C:\Users\baensh\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.06 11:20:01 | 000,002,587 | ---- | M] () -- C:\Users\baensh\Desktop\word.lnk
[2012.09.05 09:41:38 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.09.04 12:15:41 | 000,001,859 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.09.03 20:49:12 | 000,000,219 | ---- | M] () -- C:\Users\baensh\Desktop\Counter-Strike Global Offensive.url
[2012.09.03 19:06:41 | 000,001,724 | ---- | M] () -- C:\Users\baensh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.31 17:51:28 | 000,000,539 | ---- | M] () -- C:\Users\baensh\Desktop\Anki.lnk
[1 C:\Users\baensh\Desktop\*.tmp files -> C:\Users\baensh\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.22 14:57:11 | 000,000,156 | ---- | C] () -- C:\Users\baensh\defogger_reenable
[2012.09.22 14:56:25 | 000,050,477 | ---- | C] () -- C:\Users\baensh\Desktop\Defogger.exe
[2012.09.04 12:15:41 | 000,001,859 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.09.03 20:49:12 | 000,000,219 | ---- | C] () -- C:\Users\baensh\Desktop\Counter-Strike Global Offensive.url
[2012.09.03 19:06:41 | 000,001,724 | ---- | C] () -- C:\Users\baensh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.09.03 19:06:40 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.31 17:51:28 | 000,000,551 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk
[2012.08.31 17:51:28 | 000,000,539 | ---- | C] () -- C:\Users\baensh\Desktop\Anki.lnk
[2012.06.20 12:45:29 | 000,082,200 | ---- | C] () -- C:\Users\baensh\Bank-Departure information for Summer School Students.pdf
[2012.05.11 11:22:55 | 000,004,877 | ---- | C] () -- C:\ProgramData\bltofzsb.qlf
[2012.03.18 18:49:51 | 000,000,680 | ---- | C] () -- C:\Users\baensh\AppData\Local\d3d9caps.dat
[2012.03.01 11:55:41 | 000,001,832 | ---- | C] () -- C:\Users\baensh\AppData\Local\SLC_baensh.prx
[2012.02.25 19:26:21 | 000,000,556 | ---- | C] () -- C:\Windows\eReg.dat
[2012.02.06 18:15:43 | 000,000,132 | ---- | C] () -- C:\Users\baensh\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2012.01.25 23:23:24 | 000,000,132 | ---- | C] () -- C:\Users\baensh\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.12.15 13:40:33 | 000,181,518 | ---- | C] () -- C:\Windows\hpoins38.dat
[2011.12.09 11:33:32 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.12.07 16:28:36 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.12.07 16:27:01 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.12.03 15:46:31 | 000,003,850 | ---- | C] () -- C:\Windows\scad3.INI
[2011.12.02 23:18:05 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.12.02 23:18:04 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.12.02 11:37:49 | 000,902,866 | ---- | C] () -- C:\ProgramData\nvModes.001
[2011.12.02 11:37:36 | 000,902,866 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2011.12.02 00:58:33 | 000,066,048 | ---- | C] () -- C:\Users\baensh\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.06 17:54:58 | 000,081,920 | ---- | C] () -- C:\Windows\System32\MPMapTrace.dll
[2011.10.06 16:53:06 | 000,364,544 | ---- | C] () -- C:\Windows\System32\mpPathan.dll
[2008.10.22 09:00:35 | 000,218,480 | ---- | C] () -- C:\ProgramData\SymUpdate.exe
 
========== ZeroAccess Check ==========
 
[2012.05.19 02:43:15 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\baensh\AppData\Roaming\Dropbox\shellext\l
[2012.08.03 11:50:18 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Local\RStudio-Desktop\sdb\per\u
[2012.08.22 12:54:43 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Dropbox\l
[2012.06.24 12:52:49 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Dropbox\installer\l
[2012.09.22 14:03:32 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Dropbox\shellext\l
[2012.06.23 09:41:19 | 000,000,082 | ---- | M] () -- C:\Users\baensh\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\CS3FHMDN\t.cxt.ms\lso.swf\u.sol
[2012.09.22 12:04:50 | 000,000,000 | ---D | M] -- C:\Users\baensh\Downloads\SARDU_2.0.5\ISO\isolinux\system\usr\share\terminfo\l
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
========== LOP Check ==========
 
[2012.09.06 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\.anki
[2012.09.06 01:09:19 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\.matplotlib
[2012.08.07 10:51:55 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Arduino
[2011.12.03 12:18:12 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Atmel
[2012.01.14 19:02:37 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\CadSoft
[2012.03.01 11:48:53 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\CheckPoint
[2012.02.25 19:24:20 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\DAEMON Tools Lite
[2012.08.29 16:16:01 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Dropbox
[2012.08.13 16:50:02 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\HTC
[2011.12.03 15:48:53 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\KI-I
[2012.09.05 17:17:04 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Microchip
[2012.05.05 11:55:52 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Origin
[2012.03.16 11:35:17 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\ProXoft
[2012.08.03 11:50:18 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\RStudio
[2012.09.10 13:31:20 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Spotify
[2012.07.24 20:07:34 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.09.04 23:24:17 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\TS3Client
[2012.02.26 17:47:58 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Ubisoft
[2012.09.10 21:34:13 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\uTorrent
[2011.12.19 17:14:18 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\VisualAssist
[2012.08.20 14:09:41 | 000,000,000 | ---D | M] -- C:\Users\baensh\AppData\Roaming\Xerox
 
========== Purity Check ==========
 
 

< End of report >
Extras.txt im Anhang

GMER Scan konnte nicht fertig durchlaufen. - "Aufgrund eines Fehlers wird das Programm nicht richtig ausgeführt."
Welche Info's kann ich dazu noch geben? Braucht ihr den Log für dieses Problem gar nicht? Hilfe bitte!

Dankeschön schon mal im Vorraus!

M-K-D-B 23.09.2012 11:42
:hallo:

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:
  • Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
    Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
  • Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
  • Bitte füge alle Logfiles in sog. Codeboxen ein. Das Symbol dafür findest du über dem Textfeld, es sieht in etwa so aus: #.
  • Solltest du mir nicht innerhalb von 5 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  • Für Benutzer von Windows Vista und Windows 7 gilt: Alle Programme mit Rechtsklick "Als Administrator ausführen" starten.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.




Zitat:
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
Mit Hilfe dieser Einträge kann dein Computer Seiten von Adobe nicht erreichen. Es gibt keinen vernüftigen Grund, diese Seiten zu blockieren.
Diese Einträge in der Hosts Datei deuten auf illegale Software hin.

Woher stammen diese Einträge?
Was kannst/möchtest du mir dazu sagen?

M-K-D-B 26.09.2012 13:32
Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:15 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131