Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ist das ein gefährlicher Trojaner Trj/CI.A (https://www.trojaner-board.de/105088-gefaehrlicher-trojaner-trj-ci-a.html)

kessemaus1 14.11.2011 13:15
Ist das ein gefährlicher Trojaner Trj/CI.A
 
Hallo,

hoffe hier sehr auf Hilfe, mein PC öffnet plötzlich mehrere explorer, Und wenn ich eine Internetseite öffne setzt diese sich auf google zurück. Bei Mozilla auch so. Kann nicht mehr zocken online, da meine Seite sich dann auf google zurück setzt. Habe mit Panda online den PC gescannt und dieser hat was gefunden. Trj/CI.A hätte ich wohl. Ich weiss nicht ob das wirklich so ist. Kann mir jemand helfen was zu tun ist. das komische hab in 2 PC angeschlossen genau das gleiche. Den einen hatte ich schon neu aufgesetzt immer noch da.

http://s14.directupload.net/file/d/2...ygriaj_jpg.htm

hab noch ein screenshot vom fund mit hochgeladen

cosinus 14.11.2011 14:55
Zitat:
Habe mit Panda online den PC gescannt und dieser hat was gefunden. Trj/CI.A hätte ich wohl.
Bitte alle Logs dazu posten

kessemaus1 14.11.2011 18:13
Hi,

was genau soll ich posten?

cosinus 14.11.2011 20:12
Ja was steht denn da? Was hab ich zitiert? Womit hast du gescannt? => Panda!
Von dem Tool will ich das Log sehen

kessemaus1 15.11.2011 00:18
Hi,

so hab nun mal ein HijackThis gesagt. Kann mir jemand helfen?

HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 00:08:35, on 15.11.2011
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\WirBeide\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GH1TSIVQ\HiJackThis204[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Global Registration] "C:\Program Files (x86)\Acer\Registration\GREG.exe" BOOT
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O23 - Service: AAV UpdateService - Unknown owner - C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
O23 - Service: ABBYY PDF Transformer 3.0 Licensing Service (ABBYY.Licensing.PDFTransformer.Site License.3.0) - ABBYY - C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: Partner Service - Google Inc. - C:\ProgramData\Partner\Partner.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: USBS3S4Detection - Unknown owner - C:\OEM\USBDECTION\USBS3S4Detection.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12177 bytes
--- --- ---



Das sagt mir Malwarebytes, da ist nichts gefunden. Und Avast auch nicht

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8162

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.11.2011 23:06:30
mbam-log-2011-11-14 (23-06-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
Durchsuchte Objekte: 275005
Laufzeit: 39 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

kessemaus1 15.11.2011 00:21
Das Problem besteht nach wie vor. Explorer setzt sich weiterhin auf die eingestellt Startseite zurück. PC hab ich schon neu formatiert Fehler immer noch vorhanden bei Mozilla auch, bin echt total verzweifelt

kessemaus1 15.11.2011 00:53
Und das bei Panda Active Scan

;***************************************************************************************************************************************************** ******************************
ANALYSIS: 2011-11-15 00:48:19
PROTECTIONS: 2
MALWARE: 11
SUSPECTS: 0
;***************************************************************************************************************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================== ==============================
avast! Antivirus Yes Yes
Avira Desktop Yes Yes
;===================================================================================================================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================== ==============================
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@doubleclick[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\wirbeide@atdmt[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@mediaplex[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@ad.yieldmanager[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@apmebf[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@serving-sys[1].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@adtech[2].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@questionmarket[2].txt
00207936 Cookie/Adviva TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@adviva[1].txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@smartadserver[2].txt
;===================================================================================================================================================== ==============================
SUSPECTS
Sent Location
;===================================================================================================================================================== ==============================
;===================================================================================================================================================== ==============================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================== ==============================
;===================================================================================================================================================== ==============================

cosinus 15.11.2011 09:15
Zitat:
so hab nun mal ein HijackThis gesagt. Kann mir jemand helfen?
hast du schon mal gesehen was dick und fett in meiner Signatur steht?! :balla:
Ich kann ja verstehen, dass du keine Computer-Experting bist, aber ein wenig die Augen aufmachen hier muss man schon im Bord!


Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


kessemaus1 15.11.2011 13:22
So hallo erstmal und danke das du dich meiner an nimmst. sorry wegen dem HijackThis

hier die logs

Eset:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK

Malwarebytes' Anti-Malware 1.51.2.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 8166

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15.11.2011 12:57:22
mbam-log-2011-11-15 (12-57-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)
Durchsuchte Objekte: 270992
Laufzeit: 12 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

ältere hab ich nicht nur das was oben schon steht von gestern
OnlineScanner.ocx - registred OK

cosinus 15.11.2011 13:28
Zitat:
ältere hab ich nicht nur das was oben schon steht von gestern
OnlineScanner.ocx - registred OK
Das hier hast du nicht beachtet => Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen

kessemaus1 15.11.2011 13:34
Sorry, aber wie mach ich das denn? wie ich als admin den explorer öffne weiss ich schon, aber wie bekomm ich denn das programm da rein

cosinus 15.11.2011 13:58
Zitat:
wie ich als admin den explorer öffne weiss ich schon, aber wie bekomm ich denn das programm da rein
Wo ist denn da das Problem?
Firefox oder anderen Browser per Rechtsklick => als Admin ausführen
Dann erst auf die ESET Seite gehen!
Wo ist da der riesige Unterschied?

kessemaus1 15.11.2011 15:08
So auf ein neues

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=26197e4ef2feef448aa144f095960ddb
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-11-15 02:05:54
# local_time=2011-11-15 03:05:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5893 16776573 100 94 10849 72994330 0 0
# compatibility_mode=8192 67108863 100 0 10470 10470 0 0
# scanned=110705
# found=0
# cleaned=0
# scan_time=1474

cosinus 15.11.2011 15:38
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

kessemaus1 15.11.2011 16:32
hier das Ergebnis:OTL Logfile:
Code:
OTL logfile created on: 15.11.2011 16:28:58 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\WirBeide\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,93 Gb Total Physical Memory | 4,45 Gb Available Physical Memory | 75,04% Memory free
11,86 Gb Paging File | 10,31 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455,95 Gb Total Space | 413,18 Gb Free Space | 90,62% Space Free | Partition Type: NTFS
Drive D: | 456,46 Gb Total Space | 455,79 Gb Free Space | 99,85% Space Free | Partition Type: NTFS
 
Computer Name: WIRBEIDE-PC | User Name: WirBeide | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
PRC - [2009.12.22 19:28:16 | 000,128,296 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
PRC - [2009.12.22 19:11:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
PRC - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () -- C:\OEM\USBDECTION\USBS3S4Detection.exe
PRC - [2009.10.13 19:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.10 14:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
PRC - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
PRC - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2009.08.12 22:58:28 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2009.08.04 06:09:34 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
PRC - [2009.07.18 04:12:12 | 000,257,440 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10c.exe
PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.08.18 08:31:22 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll
MOD - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
MOD - [2009.02.03 01:33:56 | 000,460,199 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.01.13 15:04:08 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Auto | Running] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection)
SRV - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R)
SRV - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009.09.10 14:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe -- (ABBYY.Licensing.PDFTransformer.Site License.3.0)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2010.01.13 15:26:00 | 006,327,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.01.13 14:10:56 | 000,185,344 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2009.10.29 09:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.09.30 02:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.09.23 10:11:04 | 000,283,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R)
DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.30 10:37:16 | 000,033,800 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.02 12:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.02 12:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.02 12:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.14 21:54:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.14 21:54:00 | 000,000,000 | ---D | M]
 
[2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Extensions
[2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Firefox\Profiles\gk512yjg.default\extensions
[2011.11.14 21:54:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.03 16:21:59 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.03 16:21:59 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.03 16:21:59 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.03 16:21:59 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.03 16:21:59 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32D33DE0-981E-4996-9D7A-848F55219933}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.15 16:27:01 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
[2011.11.15 12:46:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.11.15 12:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.11.15 12:42:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2011.11.15 05:25:47 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2011.11.15 05:25:47 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2011.11.15 05:20:25 | 000,000,000 | ---D | C] -- C:\Windows\NAPP_Dism_Log
[2011.11.14 22:40:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\TS3Client
[2011.11.14 22:31:16 | 000,254,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011.11.14 22:25:47 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Malwarebytes
[2011.11.14 22:25:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.11.14 22:25:17 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.11.14 22:05:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Mozilla
[2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Mozilla
[2011.11.14 21:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.11.14 21:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.11.14 21:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2011.11.14 21:51:53 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2011.11.14 21:48:47 | 000,033,800 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\pavboot64.sys
[2011.11.14 21:48:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda Security
[2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Screensaver
[2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Macromedia
[2011.11.14 21:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
[2011.11.14 21:26:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2011.11.14 21:25:59 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft Help
[2011.11.14 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2011.11.14 21:23:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Adobe
[2011.11.14 21:23:33 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Google
[2011.11.14 21:23:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Google
[2011.11.14 21:23:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2011.11.14 21:23:13 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft
[2011.11.14 21:23:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live SkyDrive
[2011.11.14 21:23:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2011.11.14 21:22:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2011.11.14 21:21:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2011.11.14 21:20:16 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe
[2011.11.14 21:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink
[2011.11.14 21:18:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acer Arcade Deluxe
[2011.11.14 21:18:37 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011.11.14 21:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2011.11.14 21:17:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\InstallShield
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\ATI
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\ATI
[2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.11.14 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2011.11.14 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcerSystem
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McQcModifier-5c47-a7b0
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\EgisTec
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\EgisTec
[2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\book
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Searches
[2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.11.14 21:15:14 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Identities
[2011.11.14 21:15:12 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Apple
[2011.11.14 21:15:11 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Contacts
[2011.11.14 21:15:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\VirtualStore
[2011.11.14 21:06:50 | 000,000,000 | ---D | C] -- C:\Program Files\Acer Accessory Store
[2011.11.14 21:06:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OEM
[2011.11.14 21:06:32 | 000,000,000 | --SD | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Videos
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Saved Games
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Pictures
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Music
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Links
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Favorites
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Downloads
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Documents
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Desktop
[2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Vorlagen
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Verlauf
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Temporary Internet Files
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Startmenü
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\SendTo
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Recent
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Netzwerkumgebung
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Lokale Einstellungen
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Videos
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Musik
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Eigene Dateien
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Bilder
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Druckumgebung
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Cookies
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Anwendungsdaten
[2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Anwendungsdaten
[2011.11.14 21:06:32 | 000,000,000 | -H-D | C] -- C:\Users\WirBeide\AppData
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Temp
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft
[2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Media Center Programs
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Recovery
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2011.11.14 20:52:01 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2011.11.14 20:52:01 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2011.11.14 20:52:01 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2011.11.14 20:52:01 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2011.11.14 20:52:01 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2011.11.14 20:52:01 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2011.11.14 20:52:01 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2011.11.14 20:52:01 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2011.11.14 20:52:00 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2011.11.14 20:52:00 | 000,310,784 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2011.11.14 20:52:00 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2011.11.14 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2011.11.14 20:49:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2011.11.14 20:49:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.11.14 20:49:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011.11.14 20:48:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.11.14 20:45:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe
[2011.11.15 16:00:01 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Acer Registration Reminder.job
[2011.11.15 15:47:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.15 12:47:18 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.11.15 12:47:18 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.15 12:47:18 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.11.15 12:47:18 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.15 12:47:18 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.11.15 12:42:45 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.15 12:40:32 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.15 12:40:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.15 12:40:03 | 479,510,527 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.15 05:26:14 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2011.11.15 05:26:14 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2011.11.15 05:25:47 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2011.11.15 05:25:47 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2011.11.15 05:20:24 | 000,011,453 | ---- | M] () -- C:\Windows\ChangeLang_Done.tag
[2011.11.14 22:31:17 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011.11.14 22:05:16 | 000,001,258 | ---- | M] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk
[2011.11.14 21:54:07 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2011.11.14 21:54:01 | 000,001,939 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.14 21:51:56 | 000,000,971 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2011.11.14 21:39:21 | 000,361,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.11.14 21:24:03 | 000,000,020 | ---- | M] () -- C:\Windows\Àù·
[2011.11.14 21:06:50 | 000,001,962 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2011.11.14 21:06:47 | 000,002,609 | ---- | M] () -- C:\Users\Public\Desktop\eBay.lnk
[2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.11.14 20:54:29 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011.11.14 20:53:31 | 000,000,003 | ---- | M] () -- C:\Windows\SysNative\PLD_Framework.cmd
 
========== Files Created - No Company Name ==========
 
[2011.11.15 12:42:45 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.11.15 05:29:17 | 000,011,453 | ---- | C] () -- C:\Windows\ChangeLang_Done.tag
[2011.11.15 05:26:43 | 000,643,628 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2011.11.15 05:26:43 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2011.11.15 05:26:43 | 000,126,188 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2011.11.15 05:26:43 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
[2011.11.15 01:05:24 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Acer Registration Reminder.job
[2011.11.14 22:31:16 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2011.11.14 22:05:16 | 000,001,258 | ---- | C] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk
[2011.11.14 21:54:07 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.11.14 21:54:01 | 000,001,939 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.14 21:51:56 | 000,000,971 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2011.11.14 21:37:35 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.14 21:37:35 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.14 21:28:21 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk
[2011.11.14 21:28:13 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
[2011.11.14 21:24:02 | 000,000,020 | ---- | C] () -- C:\Windows\Àù·
[2011.11.14 21:15:30 | 000,001,405 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.11.14 21:15:25 | 000,001,439 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.11.14 21:06:57 | 000,002,495 | ---- | C] () -- C:\Users\Public\Desktop\Serif WEBPLUS X4.lnk
[2011.11.14 21:06:57 | 000,001,833 | ---- | C] () -- C:\Users\Public\Desktop\RADIOTRACKER.lnk
[2011.11.14 21:06:57 | 000,001,656 | ---- | C] () -- C:\Users\Public\Desktop\PDF Transformer.lnk
[2011.11.14 21:06:50 | 000,001,962 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2011.11.14 21:06:47 | 000,002,609 | ---- | C] () -- C:\Users\Public\Desktop\eBay.lnk
[2011.11.14 20:54:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.11.14 20:53:31 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\PLD_Framework.cmd
[2011.11.14 20:45:46 | 479,510,527 | -HS- | C] () -- C:\hiberfil.sys
[2010.03.23 16:35:44 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.03.23 16:03:34 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.11.14 23:19:22 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\TS3Client
[2011.11.15 16:30:01 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\Acer Registration Reminder.job
[2009.07.14 06:08:49 | 000,004,142 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< ESETSmartInstaller@High as CAB hook log: >
 
< OnlineScanner64.ocx - registred OK >
 
< OnlineScanner.ocx - registred OK >
 
< # version=7 >
 
< # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) >
 
< # OnlineScanner.ocx=1.0.0.6583 >
 
< # api_version=3.0.2 >
 
< # EOSSerial=26197e4ef2feef448aa144f095960ddb >
 
< # end=finished >
 
< # remove_checked=true >
 
< # archives_checked=true >
 
< # unwanted_checked=true >
 
< # unsafe_checked=false >
 
< # antistealth_checked=true >
 
< # utc_time=2011-11-15 02:05:54 >
 
< # local_time=2011-11-15 03:05:54 (+0100, Mitteleuropäische Zeit) >
 
< # country="Germany" >
 
< # lang=1033 >
 
< # osver=6.1.7600 NT  >
 
< # compatibility_mode=5893 16776573 100 94 10849 72994330 0 0 >
 
< # compatibility_mode=8192 67108863 100 0 10470 10470 0 0 >
 
< # scanned=110705 >
 
< # found=0 >
 
< # cleaned=0 >
 
< # scan_time=1474 >

< End of report >
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:11 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131