Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows Virus Auswertung (https://www.trojaner-board.de/135543-windows-virus-auswertung.html)

antikerjojo 25.05.2013 19:14
Windows Virus Auswertung
 
Hallo
ich habe jetzt alle schritte von der otlpe anleitung befolgt
dort stand ich sollte nun eine datei hier reinstellen
habe ienen Trojana der mich nicht in den abgesicherten mdus rein laest
deswegen das ganze
ich hoffe auf schnelle hilfe und moechte mich schon im vorraus bedanke



[code]
OTL logfile created on: 5/25/2013 8:46:37 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 74.40 Mb Free Space | 74.40% Space Free | Partition Type: NTFS
Drive D: | 465.66 Gb Total Space | 84.88 Gb Free Space | 18.23% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002

========== Win32 Services (SafeList) ==========

SRV - [2013/05/15 06:08:44 | 001,435,984 | ---- | M] (LogMeIn Inc.) [Auto] -- D:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2013/05/03 19:35:30 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand] -- D:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013/02/28 12:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto] -- D:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/19 07:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto] -- D:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012/03/09 18:56:41 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/07/01 16:30:56 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/30 16:18:37 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/11/04 11:45:02 | 000,172,032 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/10/13 03:39:04 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/09/04 03:31:42 | 000,434,176 | ---- | M] (Hauppauge Computer Works) [Auto] -- D:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/30 04:16:40 | 000,166,520 | ---- | M] () [Auto] -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)
SRV - [2007/09/30 04:16:38 | 000,051,816 | ---- | M] () [Auto] -- D:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- (Start BT in service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (EagleNT)
DRV - [2012/10/09 14:31:12 | 000,064,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV - [2012/04/06 14:15:10 | 000,033,512 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2011/12/16 11:53:01 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- D:\Windows\System32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2011/08/17 04:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/07/01 16:30:57 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/01 16:30:57 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/20 08:30:17 | 000,296,064 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm)
DRV - [2010/11/20 08:30:17 | 000,172,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vpchbus.sys -- (vpcbus)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 06:50:38 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vpcusb.sys -- (vpcusb)
DRV - [2010/11/20 06:50:37 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System] -- D:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/07/28 19:25:02 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ivusb.sys -- (ivusb)
DRV - [2010/06/17 09:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/11/04 12:16:46 | 005,079,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/10/09 06:04:00 | 000,253,480 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\mv91xx.sys -- (mv91xx)
DRV - [2009/09/30 10:33:56 | 000,104,976 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/09/25 10:57:40 | 000,138,240 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/09/25 10:57:36 | 000,056,576 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV - [2009/08/06 04:35:12 | 000,321,280 | ---- | M] (Hauppauge Computer Works, Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88tse.sys -- (HCW88TSE)
DRV - [2009/08/06 04:35:11 | 000,215,168 | ---- | M] (Hauppauge Computer Works, Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88bda.sys -- (hcw88bda)
DRV - [2009/08/06 04:35:11 | 000,012,288 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hcw88rc5.sys -- (hcw88rc5)
DRV - [2009/07/13 18:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/06/23 07:28:12 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\HECI.sys -- (HECI) Intel(R)
DRV - [2009/06/03 08:57:02 | 000,006,504 | ---- | M] () [Kernel | On_Demand] -- D:\windows\system32\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2009/03/18 12:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2007/06/24 16:56:54 | 000,038,920 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2007/06/24 16:56:40 | 000,027,656 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2007/06/24 16:56:34 | 000,034,312 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2007/03/05 15:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btnetdrv.sys -- (BT)
DRV - [2007/03/05 15:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- D:\Windows\System32\drivers\BtHidMgr.sys -- (BTHidMgr)
DRV - [2007/03/05 15:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- D:\Windows\System32\drivers\VBTEnum.sys -- (BTHidEnum)
DRV - [2007/03/05 15:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\VCommMgr.sys -- (VcommMgr)
DRV - [2007/03/05 15:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\VComm.sys -- (VComm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=14476185000000000000001167d6a48f&tlver=1.4.19.19&ss=1&affID=17395
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Johannes_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FD 6B 59 D7 BB 83 CA 01 [binary data]
IE - HKU\Johannes_ON_D\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Johannes_ON_D\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKU\Johannes_ON_D\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - Reg Error: Key error. File not found
IE - HKU\Johannes_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Johannes_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local




========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=14597"
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0
FF - prefs.js..extensions.enabledItems: ShopperReports@ShopperReports.com:3.0.517.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: software@loadtubes.com:1.01
FF - prefs.js..extensions.enabledItems: adblockpopups@jessehakanen.net:0.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}:6.0.37
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.15.9.100013
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=de_DE&apn_uid=4e1c2369-8037-45f8-b393-e67c920c2fd2&apn_ptnrs=^FV&apn_sauid=207C1E8C-56C4-4D4D-8AAA-8633635CA8C7&apn_dtid=^YYYYYY^YY^DE&&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Winload Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/ig|hxxp://www.youtube.com/?gl=DE&hl=de|hxxp://www.facebook.com/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=14476185000000000000001167d6a48f&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: D:\Windows\System32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: D:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: D:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: D:\Users\Johannes\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: D:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ShopperReports@ShopperReports.com: C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions [2010/12/23 15:28:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/14 14:42:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/14 14:42:28 | 000,000,000 | ---D | M]

[2010/04/28 13:58:28 | 000,000,000 | -H-D | M] (No name found) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Extensions
[2013/01/29 13:23:13 | 000,000,000 | -H-D | M] (No name found) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions
[2012/12/16 08:34:13 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/06/22 14:21:19 | 000,000,000 | ---D | M] (Adblock Plus Pop-up Addon) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\adblockpopups@jessehakanen.net
[2011/03/13 07:02:00 | 000,000,000 | -H-D | M] (Personas) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\personas@christopher.beard
[2012/05/06 04:45:34 | 000,000,000 | -H-D | M] (loadtbs) -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\software@loadtubes.com
[2013/01/29 13:22:10 | 000,000,000 | ---D | M] ("Ask Toolbar") -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\extensions\toolbar@ask.com
[2013/01/29 13:22:22 | 000,002,403 | ---- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\askcom.xml
[2012/05/06 11:03:35 | 000,000,937 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\conduit.xml
[2012/05/06 06:52:36 | 000,004,108 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\SweetIM Search.xml
[2012/01/22 14:36:21 | 000,003,915 | -H-- | M] () -- D:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\6j2wilmm.default\searchplugins\sweetim.xml
[2012/12/08 15:59:09 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\Mozilla Firefox\extensions
[2012/05/13 10:50:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- D:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/10/23 15:00:33 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2012/08/31 12:40:48 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012/12/08 15:59:09 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2010/12/23 15:29:46 | 000,000,000 | ---D | M] (QuestBrowse) -- D:\Program Files\Mozilla Firefox\extensions\{D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}
[2010/12/23 15:28:31 | 000,000,000 | ---D | M] (ShopperReports) -- D:\PROGRAM FILES\SHOPPERREPORTS3\BIN\3.0.517.0\FIREFOX\FIREFOXTOOLBAR\EXTENSIONS
[2012/05/06 04:45:31 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- D:\Program Files\mozilla firefox\plugins\npmieze.dll
[2010/04/01 12:54:38 | 000,001,392 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/06/13 16:12:52 | 000,002,428 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2010/04/01 12:54:38 | 000,002,344 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010/04/01 12:54:38 | 000,006,805 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/04/01 12:54:38 | 000,001,178 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/04/01 12:54:38 | 000,001,105 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ShopperReports) - {100EB1FD-D03E-47fd-81F3-EE91287F9465} - File not found
O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - D:\Program Files\PriceGong\2.5.4\PriceGongIE.dll (PriceGong)
O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - D:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - D:\Users\Johannes\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\Johannes_ON_D\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - D:\Program Files\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKU\Johannes_ON_D\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] D:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BabylonToolbar] D:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe (Babylon Ltd.)
O4 - HKLM..\Run: [IntelliPoint] D:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelliType Pro] D:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] D:\Program Files\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [SweetIM] D:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\Johannes_ON_D..\Run: [EADM] D:\Program Files\Origin\Origin.exe (Electronic Arts)
O4 - HKU\Johannes_ON_D..\Run: [MobileDocuments] File not found
O4 - HKU\Johannes_ON_D..\Run: [Spotify Web Helper] D:\Users\Johannes\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\Johannes_ON_D..\Run: [Steam] D:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] D:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: D:\Users\Johannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Web-Suche - D:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - File not found
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Johannes_ON_D Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Johannes_ON_D Winlogon: Shell - (C:\Users\Johannes\AppData\Roaming\skype.dat) - D:\Users\Johannes\AppData\Roaming\skype.dat ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 10:52:22 | 000,000,000 | ---D | C] -- D:\windows\Minidump
[2013/05/24 12:12:17 | 000,000,000 | ---D | C] -- D:\Users\Johannes\Desktop\A
[2013/05/23 15:14:24 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2013/05/23 15:14:23 | 000,000,000 | ---D | C] -- D:\Program Files\LogMeIn Hamachi
[2013/05/18 08:08:22 | 000,420,864 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\vbscript.dll
[2013/05/18 08:08:22 | 000,065,024 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jsproxy.dll
[2013/05/18 08:08:21 | 000,717,824 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript.dll
[2013/05/18 08:08:21 | 000,607,744 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\msfeeds.dll
[2013/05/18 08:08:21 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieui.dll
[2013/05/18 08:08:21 | 000,142,848 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\ieUnatt.exe
[2013/05/18 08:08:20 | 001,800,704 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\jscript9.dll
[2013/05/18 08:08:20 | 001,427,968 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\inetcpl.cpl
[2013/05/18 08:08:20 | 000,231,936 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\url.dll
[2013/05/18 08:06:14 | 002,382,848 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/18 07:38:22 | 000,040,960 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\wwanprotdim.dll
[2013/05/18 07:38:21 | 002,347,520 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\win32k.sys
[2013/05/18 07:38:16 | 000,218,984 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\drivers\dxgmms1.sys
[2013/05/18 07:38:08 | 001,796,096 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\authui.dll
[2013/05/18 07:38:08 | 000,101,720 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\consent.exe
[1 D:\windows\*.tmp files -> D:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/25 13:30:28 | 000,067,584 | --S- | M] () -- D:\windows\bootstat.dat
[2013/05/25 13:23:35 | 000,010,256 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 13:23:35 | 000,010,256 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 13:22:03 | 000,709,194 | ---- | M] () -- D:\windows\System32\perfh007.dat
[2013/05/25 13:22:03 | 000,661,476 | ---- | M] () -- D:\windows\System32\perfh009.dat
[2013/05/25 13:22:03 | 000,153,546 | ---- | M] () -- D:\windows\System32\perfc007.dat
[2013/05/25 13:22:03 | 000,125,666 | ---- | M] () -- D:\windows\System32\perfc009.dat
[2013/05/25 13:16:19 | 000,000,004 | ---- | M] () -- D:\Users\Johannes\AppData\Roaming\skype.ini
[2013/05/25 13:15:16 | 000,001,098 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/25 13:14:35 | 2817,384,448 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/25 12:34:00 | 000,001,102 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/25 10:52:20 | 342,842,563 | ---- | M] () -- D:\windows\MEMORY.DMP
[2013/05/24 13:53:21 | 000,000,213 | ---- | M] () -- D:\Users\Johannes\Desktop\Dota 2.url
[2013/05/23 15:14:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2013/05/18 10:40:40 | 000,326,928 | ---- | M] () -- D:\windows\System32\FNTCACHE.DAT
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\mshtml.tlb
[2013/05/01 20:06:08 | 000,238,872 | ---- | M] (Microsoft Corporation) -- D:\windows\System32\MpSigStub.exe
[1 D:\windows\*.tmp files -> D:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/25 12:53:04 | 000,000,004 | ---- | C] () -- D:\Users\Johannes\AppData\Roaming\skype.ini
[2013/05/24 13:53:21 | 000,000,213 | ---- | C] () -- D:\Users\Johannes\Desktop\Dota 2.url
[2012/08/27 15:28:36 | 000,000,868 | ---- | C] () -- D:\Users\Johannes\AppData\Local\recently-used.xbel
[2012/04/21 10:38:30 | 000,003,584 | ---- | C] () -- D:\Users\Johannes\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/17 14:32:03 | 000,139,048 | ---- | C] () -- D:\windows\System32\drivers\PnkBstrK.sys
[2012/03/17 14:31:50 | 000,282,296 | ---- | C] () -- D:\windows\System32\PnkBstrB.exe
[2012/03/17 14:31:28 | 000,076,888 | ---- | C] () -- D:\windows\System32\PnkBstrA.exe
[2012/01/11 14:19:07 | 000,059,392 | ---- | C] () -- D:\Users\Johannes\AppData\Roaming\skype.dat
[2011/09/17 04:35:39 | 000,000,127 | ---- | C] () -- D:\windows\System32\MRT.INI
[2011/07/01 16:56:34 | 000,138,904 | -H-- | C] () -- D:\Users\Johannes\AppData\Roaming\PnkBstrK.sys
[2011/07/01 16:56:03 | 002,434,856 | ---- | C] () -- D:\windows\System32\pbsvc_bc2.exe
[2011/06/22 15:17:15 | 000,252,928 | ---- | C] () -- D:\windows\System32\DShowRdpFilter.dll
[2011/06/22 15:16:19 | 000,066,048 | ---- | C] () -- D:\windows\System32\PrintBrmUi.exe
[2011/05/09 08:33:14 | 000,000,096 | ---- | C] () -- D:\Users\Johannes\AppData\Local\fusioncache.dat
[2011/04/08 12:39:10 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat
[2010/12/23 15:30:07 | 000,815,104 | ---- | C] () -- D:\windows\System32\xvidcore.dll
[2010/12/23 15:30:07 | 000,180,224 | ---- | C] () -- D:\windows\System32\xvidvfw.dll
[2010/10/20 10:18:31 | 000,001,940 | ---- | C] () -- D:\Users\Johannes\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/02/07 13:02:24 | 000,000,332 | ---- | C] () -- D:\windows\desctemp.dat
[2009/12/23 07:42:12 | 000,033,877 | ---- | C] () -- D:\windows\Irremote.ini
[2009/12/23 07:41:19 | 000,000,209 | ---- | C] () -- D:\windows\ODBCINST.INI
[2009/12/23 07:41:19 | 000,000,135 | ---- | C] () -- D:\windows\ODBC.INI
[2009/12/23 07:41:09 | 000,142,337 | ---- | C] () -- D:\windows\System32\Wait.exe
[2009/12/23 07:40:28 | 000,002,507 | ---- | C] () -- D:\windows\HCWPNP.INI
[2009/12/23 07:39:21 | 000,040,960 | ---- | C] () -- D:\windows\System32\hcwxds.dll
[2009/12/22 13:53:11 | 000,146,432 | ---- | C] () -- D:\windows\System32\APOMngr.DLL
[2009/12/22 13:53:11 | 000,072,704 | ---- | C] () -- D:\windows\System32\CmdRtr.DLL
[2009/12/22 13:52:37 | 000,000,000 | ---- | C] () -- D:\windows\ativpsrm.bin
[2009/12/11 09:50:29 | 000,295,922 | ---- | C] () -- D:\windows\System32\perfi007.dat
[2009/12/11 09:50:28 | 000,709,194 | ---- | C] () -- D:\windows\System32\perfh007.dat
[2009/12/11 09:50:28 | 000,153,546 | ---- | C] () -- D:\windows\System32\perfc007.dat
[2009/12/11 09:50:28 | 000,038,104 | ---- | C] () -- D:\windows\System32\perfd007.dat
[2009/09/01 16:55:54 | 000,195,855 | ---- | C] () -- D:\windows\System32\atiicdxx.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,326,928 | ---- | C] () -- D:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,661,476 | ---- | C] () -- D:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,125,666 | ---- | C] () -- D:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\windows\System32\mlang.dat
[2009/06/03 08:57:02 | 000,006,504 | ---- | C] () -- D:\windows\System32\drivers\ASACPI.sys
[2009/03/05 09:54:58 | 000,073,728 | ---- | C] () -- D:\windows\System32\RtNicProp32.dll
[2009/02/18 14:55:20 | 000,294,912 | ---- | C] () -- D:\windows\System32\ATIODE.exe
[2009/02/03 17:52:02 | 000,045,056 | ---- | C] () -- D:\windows\System32\ATIODCLI.exe
[2007/10/12 17:20:06 | 000,151,417 | ---- | C] () -- D:\windows\System32\xlive.dll.cat

========== LOP Check ==========

[2012/12/14 14:46:49 | 000,000,000 | ---D | M] -- D:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2012/12/08 16:00:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Ask
[2012/06/15 12:18:39 | 000,000,000 | ---D | M] -- D:\ProgramData\Battle.net
[2010/01/24 08:41:40 | 000,000,000 | ---D | M] -- D:\ProgramData\Bluetooth
[2012/09/09 16:26:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Civilization III
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2012/03/18 11:59:09 | 000,000,000 | ---D | M] -- D:\ProgramData\Divinity 2
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2013/02/01 18:04:10 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core
[2013/02/01 18:04:09 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Logs
[2013/02/01 18:04:13 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2010/01/16 14:08:03 | 000,000,000 | ---D | M] -- D:\ProgramData\Firefly Studios
[2011/12/05 15:06:27 | 000,000,000 | ---D | M] -- D:\ProgramData\National Instruments
[2013/01/28 10:06:05 | 000,000,000 | ---D | M] -- D:\ProgramData\Origin
[2013/05/20 07:21:57 | 000,000,000 | ---D | M] -- D:\ProgramData\PMB Files
[2009/12/24 16:50:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2012/01/22 14:36:16 | 000,000,000 | ---D | M] -- D:\ProgramData\SweetIM
[2009/12/23 07:53:05 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2011/08/03 09:39:32 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/04/07 12:11:26 | 000,000,000 | ---D | M] -- D:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2013/04/03 11:37:10 | 000,032,632 | ---- | M] () -- D:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========


< End of report >
[\code]

markusg 25.05.2013 19:29
Hi,
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O20 - HKU\Johannes_ON_D Winlogon: Shell - (C:\Users\Johannes\AppData\Roaming\skype.dat) - D:\Users\Johannes\AppData\Roaming\skype.dat ()
[2013/05/25 13:16:19 | 000,000,004 | ---- | M] () -- D:\Users\Johannes\AppData\Roaming\skype.ini
:Files
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.



falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

antikerjojo 26.05.2013 12:07
der fall ist nun dieser das ich so weit bin das ich die datei einfuegen kann
bzw wenn ich das 2. mal auf den fix button klicken moechte kann ich nichts mehr im programm machen byw es reagiert nicht ich kann zwar schon noch minimieren und schliessen aber das ist auch schon alles und nochmal danke fuer die schnelle hilfe

antikerjojo 27.05.2013 17:36
========== OTL ==========
Registry value HKEY_USERS\Johannes_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Johannes\AppData\Roaming\skype.dat deleted successfully.
File D:\Users\Johannes\AppData\Roaming\skype.dat not found.
File D:\Users\Johannes\AppData\Roaming\skype.ini not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Johannes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: All Users

User: Default

User: Default User

User: Johannes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes

Total Files Cleaned = 0.00 mb


OTLPE by OldTimer - Version 3.1.48.0 log created on 05272013_212917

markusg 27.05.2013 18:17
Hi,
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

antikerjojo 27.05.2013 21:41
Ich möchte dir nochmal Danken endlich ist dieser Virus herunten alles ich kann diese Seite nur EMPFEHLEN und werde das auch nochmal vielen Dank

markusg 28.05.2013 10:10
was ist mit dem tdss killer, keiner sagte, dass wir durch sind.


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131