Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Auch 50€ Cyber Crime virus (https://www.trojaner-board.de/112510-50-cyber-crime-virus.html)

Jazon123 28.03.2012 17:18
Auch 50€ Cyber Crime virus
 
Hallo, habe auch den 50€ Virus, was genau muss ich Laden und dann hier Posten? Habe Null Ahnung.... Danke im voraus

Chris

markusg 28.03.2012 17:23
hi
neustart, f8 drücken, abgesicherter modus mit netzwerk wählen, im betroffenen konto anmelden, internet verbindung herstellen.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Jazon123 28.03.2012 17:26
Der Virus ist auch im AbGes.modus mit Netzwerk aktiv, kann nur ohne Netzwerk starten. Habe jetzt einen zweiten pc, lade otl gleich

markusg 28.03.2012 17:28
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLpe Download OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

Jazon123 28.03.2012 17:46
hier die "Extras" Datei, die andere war leer.

Wie geht das nun weiter ?

danke vorab !!OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 28.03.2012 18:35:23 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = E:\
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19190)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 1,33 Gb Available Physical Memory | 75,94% Memory free
3,73 Gb Paging File | 3,45 Gb Available in Paging File | 92,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113,88 Gb Total Space | 8,87 Gb Free Space | 7,79% Space Free | Partition Type: NTFS
Drive D: | 114,00 Gb Total Space | 49,41 Gb Free Space | 43,35% Space Free | Partition Type: NTFS
Drive E: | 702,31 Mb Total Space | 673,79 Mb Free Space | 95,94% Space Free | Partition Type: UDF
 
Computer Name: CHRISTIANRÜT-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{221A09E9-1F8B-4618-AFD5-B10610DD5C04}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{693F8A70-C6E0-4C8A-97A6-5FD40E972C20}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{A75811A9-F4BE-4338-8BA6-3433A035219A}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0081FE6D-E32F-47F3-8D54-AACC2560BF91}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{01C4385E-5489-4738-BDFE-DE0C0CE6F268}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{0DFE40F9-2861-4449-A6B7-301A7D439EED}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{25BEE60B-0162-459A-8789-87AFD4B147D2}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{28612D19-42A2-4F57-8547-132973B3A72A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{2FA021E4-B391-4AE0-9FCA-EA03AAB1597F}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{3D387E8B-65EA-455F-836F-240173CFBF11}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{4407449F-C1D8-4FE6-8500-34B94AFDE762}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{441772A0-F87F-4481-861E-DD20337FDE32}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{47331828-81EA-4AAF-9478-6A3E826769DF}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{7F4060BF-9E39-4648-B8D4-D461EAD06BD3}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{823E5489-6990-4778-89FA-5A8F1032121A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8E3067A3-8451-4690-A2AD-509B43F6D5F3}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{9CD01B65-1D36-4594-BDF6-F416A583447C}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{DFDD0B13-6AA2-4573-93FD-10AF6A27DDA1}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{E547CB20-FD06-413C-A752-2971E8DDA9D6}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{25B473C3-2C62-482B-858F-94ED76880F79}" = Patrizier 4
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 30
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquer™ Alarmstufe Rot 3
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{5482DCBE-D2D1-47B0-A621-DF8E2B0D174C}" = Windows Live Family Safety
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{712538AF-06AE-4F7F-B246-617034495FE6}" = ANNO 1404 (Demo)
"{71E6124C-FA50-447B-B044-47A682627C26}" = Anno 1404 (Demo)
"{759142E8-25B0-42AE-B408-4215065D3F4B}" = Windows Live Family Safety
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OUTLOOKR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_OUTLOOKR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_OUTLOOKR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_OUTLOOKR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_OUTLOOKR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_OUTLOOKR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-001A-0000-0000-0000000FF1CE}" = Microsoft Office Outlook 2007
"{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{BCF16F16-AC0E-4ABE-A9EF-412CF484BA51}" = Windows Live Family Safety
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.18
"{E3B99F3D-9856-482A-9048-305E28E2510C}" = Vodafone Mobile Connect Lite
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AudibleDownloadManager" = Audible Download Manager
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.815
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"king.com" = king.com (remove only)
"Mantronic´s Kaiser II_is1" = KaiserII (Version 1.9.0)
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 11.0 (x86 en-GB)" = Mozilla Firefox 11.0 (x86 en-GB)
"OUTLOOKR" = Microsoft Office Outlook 2007
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"QuestScan" = QuestScan 1.0 build 135 powered by FIRST SEARCHBAR
"Secunia PSI" = Secunia PSI (2.0.0.3001)
"ShopperReportsSA" = ShopperReports
"WinLiveSuite" = Windows Live Essentials
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.03.2012 12:33:29 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6162
 
Error - 06.03.2012 12:33:30 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.03.2012 12:33:30 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7379
 
Error - 06.03.2012 12:33:30 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7379
 
Error - 06.03.2012 12:33:32 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.03.2012 12:33:32 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8455
 
Error - 06.03.2012 12:33:32 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8455
 
Error - 06.03.2012 12:33:33 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.03.2012 12:33:33 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9454
 
Error - 06.03.2012 12:33:33 | Computer Name = ChristianRüt-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9454
 
[ OSession Events ]
Error - 09.08.2011 02:12:49 | Computer Name = ChristianRüt-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 502
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 09.08.2011 02:13:07 | Computer Name = ChristianRüt-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 11
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 28.03.2012 12:33:52 | Computer Name = ChristianRüt-PC | Source = DCOM | ID = 10005
Description =
 
Error - 28.03.2012 12:33:52 | Computer Name = ChristianRüt-PC | Source = DCOM | ID = 10005
Description =
 
Error - 28.03.2012 12:33:52 | Computer Name = ChristianRüt-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 28.03.2012 12:33:52 | Computer Name = ChristianRüt-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 28.03.2012 12:34:25 | Computer Name = ChristianRüt-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 28.03.2012 12:34:25 | Computer Name = ChristianRüt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 28.03.2012 12:34:28 | Computer Name = ChristianRüt-PC | Source = DCOM | ID = 10005
Description =
 
Error - 28.03.2012 12:34:29 | Computer Name = ChristianRüt-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 28.03.2012 12:34:33 | Computer Name = ChristianRüt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 28.03.2012 12:41:14 | Computer Name = ChristianRüt-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
 
< End of report >
--- --- ---

markusg 28.03.2012 17:53
dann scanne noch mal, ich brauche die otl.txt

Jazon123 28.03.2012 17:56
here we go: hoffe das passt nun:

OTL Logfile:
Code:
OTL logfile created on: 28.03.2012 18:47:38 - Run 1
OTL by OldTimer - Version 3.2.39.2    Folder = E:\
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19190)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 1,24 Gb Available Physical Memory | 70,90% Memory free
3,73 Gb Paging File | 3,38 Gb Available in Paging File | 90,62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 113,88 Gb Total Space | 8,61 Gb Free Space | 7,56% Space Free | Partition Type: NTFS
Drive D: | 114,00 Gb Total Space | 49,41 Gb Free Space | 43,35% Space Free | Partition Type: NTFS
Drive F: | 952,19 Mb Total Space | 725,22 Mb Free Space | 76,16% Space Free | Partition Type: FAT
 
Computer Name: CHRISTIANRÜT-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.28 18:29:40 | 000,593,920 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.02.29 09:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.01.10 16:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011.01.10 16:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.11.02 23:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto | Stopped] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.04.20 18:20:30 | 000,009,216 | ---- | M] (Vodafone) [Auto | Stopped] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2006.10.05 18:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Stopped] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\nvhbcxey.sys -- (nvhbcxey)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.03.20 19:30:30 | 000,281,760 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2012.03.20 19:30:28 | 000,025,888 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.02.18 16:21:31 | 000,488,536 | ---- | M] (Kaspersky Lab) [File_System | System | Stopped] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2010.09.01 10:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2010.06.09 17:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2010.06.09 17:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV - [2010.04.22 19:07:34 | 000,022,104 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2009.12.17 17:02:20 | 001,203,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.11.02 20:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009.04.09 14:38:30 | 000,110,592 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnet.sys -- (ZTEusbnet)
DRV - [2009.04.09 14:38:30 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV - [2009.04.09 14:38:30 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.04.09 14:38:30 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.04.09 14:38:30 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2009.04.09 14:38:30 | 000,007,680 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2007.01.19 01:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.28 21:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 F9 8E F1 F5 16 CC 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}: "URL" = hxxp://www.questscan.com/?prt=QstscanPB&keywords={searchTerms}
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:11.0.2.556
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.2.556
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\HBLite@HBLite.com: C:\Program Files\HBLite\bin\11.0.363.0\firefox\extensions
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ShopperReports@ShopperReports.com: C:\Program Files\ShopperReports3\bin\3.1.69.0\firefox\firefoxtoolbar\extensions [2011.06.08 21:06:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.15 21:24:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.17 14:33:57 | 000,000,000 | ---D | M]
 
[2011.02.16 16:35:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.03.23 09:38:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\l0j9eh5h.default\extensions
[2011.05.09 07:19:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\l0j9eh5h.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.01.04 22:43:49 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\l0j9eh5h.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.08.31 21:01:09 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\l0j9eh5h.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.08.21 19:28:58 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\l0j9eh5h.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.03.22 10:43:12 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-1.xml
[2011.09.20 22:20:11 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-10.xml
[2011.09.25 16:16:41 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-11.xml
[2011.10.01 10:56:38 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-12.xml
[2011.10.21 08:19:58 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-13.xml
[2011.11.08 10:30:38 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-14.xml
[2011.07.05 21:08:16 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-2.xml
[2011.08.18 17:30:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-3.xml
[2011.08.20 20:14:05 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-4.xml
[2011.08.21 16:13:22 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-5.xml
[2011.09.01 19:48:51 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-6.xml
[2011.09.08 07:51:51 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-7.xml
[2011.09.09 07:15:58 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-8.xml
[2011.09.16 14:18:32 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin-9.xml
[2011.06.23 08:51:30 | 000,001,056 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\searchplugins\icqplugin.xml
[2012.02.23 09:31:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.06.10 07:20:58 | 000,000,000 | ---D | M] (QuestScan) -- C:\Program Files\mozilla firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}
[2011.02.18 21:11:50 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files\mozilla firefox\extensions\KavAntiBanner@Kaspersky.ru
[2011.02.18 21:11:49 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files\mozilla firefox\extensions\linkfilter@kaspersky.ru
File not found (No name found) -- C:\USERS\CHRISTIAN RüTTGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L0J9EH5H.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
File not found (No name found) -- C:\USERS\CHRISTIAN RüTTGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L0J9EH5H.DEFAULT\EXTENSIONS\DE-DE@DICTIONARIES.ADDONS.MOZILLA.ORG
File not found (No name found) -- C:\USERS\CHRISTIAN RüTTGER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L0J9EH5H.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI
[2012.03.15 21:24:36 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.11.24 00:32:34 | 000,070,528 | ---- | M] (Pinball Corporation.) -- C:\Program Files\mozilla firefox\plugins\npclntax_ClickPotatoLiteSA.dll
[2011.03.23 00:53:04 | 000,083,248 | ---- | M] (Pinball Corporation.) -- C:\Program Files\mozilla firefox\plugins\npclntax_HBLiteSA.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files\mozilla firefox\plugins\npmidas.dll
[2012.03.15 21:24:33 | 000,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012.03.15 21:24:33 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.03.15 21:24:33 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012.03.15 21:24:33 | 000,001,180 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012.03.15 21:24:33 | 000,001,135 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [] C:\Users\***\AppData\Local\Temp\cgs8h0.exe ()
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{791D4CE4-A3E7-417E-B014-85C5A657DEE9}: DhcpNameServer = 195.184.180.4 195.184.181.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{97F6F8F7-B12C-4A0F-A703-662802A77D26}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\kloehk.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d5566f56-39b7-11e0-ac52-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d5566f56-39b7-11e0-ac52-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\{d6a9e11d-4ed0-11e0-ae0b-00a0c6000000}\Shell - "" = AutoRun
O33 - MountPoints2\{d6a9e11d-4ed0-11e0-ae0b-00a0c6000000}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.28 12:53:52 | 000,000,000 | ---D | C] -- C:\Users\***\2012-03-28 ebay 2012
[2012.03.28 11:14:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tinypic
[2012.03.28 11:14:15 | 000,000,000 | ---D | C] -- C:\Program Files\Tinypic
[2012.03.28 08:27:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{BEBD69BB-DBCD-406C-B72C-710855E7246D}
[2012.03.28 08:27:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{C1DB30B8-5F75-4BBA-9E86-99824A40F68B}
[2012.03.27 14:00:01 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Kalypso Media
[2012.03.27 13:57:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\ProtectDISC
[2012.03.27 13:57:10 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2012.03.27 13:56:44 | 000,000,000 | ---D | C] -- C:\Program Files\ProtectDisc Driver Installer
[2012.03.27 13:56:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kalypso
[2012.03.27 13:45:49 | 000,000,000 | ---D | C] -- C:\Program Files\Kalypso Media
[2012.03.27 11:43:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{72CA39D7-1C66-48A9-96CA-BC4A0C47D9FB}
[2012.03.27 11:43:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5382C584-E3E4-4326-BD21-07CB8BEA8032}
[2012.03.26 17:46:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2012
[2012.03.26 14:41:07 | 000,000,000 | ---D | C] -- C:\Users\***\2012-03-26 eddy
[2012.03.26 11:48:19 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B4AE9E5A-8D02-4074-A588-6ADFBDE80080}
[2012.03.26 11:48:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B0878C4A-01EC-4B29-8B53-B5FB90222FD4}
[2012.03.23 13:59:01 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{30B025D7-9D68-4F6A-B12A-79F4A441C222}
[2012.03.23 13:58:59 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{BA244F4C-33FD-4F0B-9AE5-CE9FC9D94B7E}
[2012.03.22 11:09:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E7809101-674D-4E78-8A20-C74D3E3B0FC7}
[2012.03.22 11:09:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{ABCAF29A-BB18-4A99-9B01-9739928188CD}
[2012.03.21 21:39:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5A0882AF-CF3C-4954-9DF8-E0084C604BCD}
[2012.03.21 21:39:42 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{26DC46AF-B9A1-4689-BE1D-D3BD0F5AE52C}
[2012.03.21 16:23:42 | 000,000,000 | ---D | C] -- C:\keen
[2012.03.21 09:39:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B87F641A-E1AA-4C32-AC8C-894FF9C37CB9}
[2012.03.21 09:39:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B9FBE261-48F3-4E2A-B69B-24942CCA7826}
[2012.03.20 22:15:26 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Red Alert 3
[2012.03.20 22:15:14 | 000,000,000 | RH-D | C] -- C:\Users\***\AppData\Roaming\SecuROM
[2012.03.20 21:54:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Downloaded Installations
[2012.03.20 21:54:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2012.03.20 21:39:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F40242C0-9EC6-4134-A13E-F371F4383855}
[2012.03.20 21:39:07 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9466B185-E1F4-4329-80DE-8BAFB0D1691D}
[2012.03.20 21:01:51 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2012.03.20 19:31:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Ubisoft
[2012.03.20 19:22:43 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft
[2012.03.20 16:28:12 | 000,000,000 | ---D | C] -- C:\Program Files\Fernseh Tycoon
[2012.03.20 15:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mantronic
[2012.03.20 15:14:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mantronic
[2012.03.20 15:10:02 | 000,000,000 | ---D | C] -- C:\schiffbruch
[2012.03.20 09:38:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E6E0D8CB-59B0-4531-8A20-498E019DB3B9}
[2012.03.20 09:38:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{2D58DF43-71B6-425B-852C-FE0F1F1EE966}
[2012.03.19 21:19:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{76CD686A-287F-40BF-9C03-A8A5AC58F65E}
[2012.03.19 21:19:27 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{1A22E88D-EAF5-479E-A38B-08AEBA276BA3}
[2012.03.19 09:19:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{37E52BC3-7730-4C90-B143-1E4FD023748F}
[2012.03.19 09:19:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{8874AA2A-7B72-4683-9F8E-33116EE0C260}
[2012.03.18 17:29:43 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9DF97BCF-59E7-4368-BC76-F112402577B7}
[2012.03.18 17:29:37 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{35088C55-F9E0-4FD0-9830-000C5B8ADCC9}
[2012.03.17 18:48:28 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Steuer-Sparbuch
[2012.03.17 17:11:38 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Mein Steuer-Sparbuch Heute
[2012.03.17 16:54:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2012.03.17 16:48:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2011
[2012.03.17 16:47:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Buhl
[2012.03.17 16:46:06 | 000,000,000 | ---D | C] -- C:\Program Files\WISO
[2012.03.17 16:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Buhl Data Service GmbH
[2012.03.17 16:45:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Buhl Data Service
[2012.03.17 00:11:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2012.03.16 08:50:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4D413196-8F16-4E01-9893-A672A7BDF857}
[2012.03.16 08:50:50 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6D6BCABC-6FB4-44F4-9785-BF9801EB29CE}
[2012.03.15 13:19:24 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{D4C9DF4A-9763-43D9-B2F4-EF0579BD9AA2}
[2012.03.15 13:19:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A8E02783-CF50-4B6F-B4C5-C134BBFA1915}
[2012.03.12 14:31:42 | 000,000,000 | ---D | C] -- C:\Users\***\2012-03-12 boston
[2012.03.12 08:37:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{C179A1EE-807F-4ABB-9B9D-5BB3E19CB66C}
[2012.03.12 08:37:23 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{EE5C1290-40E2-42D7-9DAD-3C5888D588CC}
[2012.03.11 19:28:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.11 19:28:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.03.11 19:23:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B7311A9C-82BF-4D49-8441-960D3B923546}
[2012.03.11 19:23:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{436F0B99-5E14-4E58-A54F-7132A2C60CAF}
[2012.03.10 10:56:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E1C7DD19-D70F-4801-AB17-338544D36746}
[2012.03.10 10:56:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{192E031C-0A62-488A-AD86-9FBB7270C5C1}
[2012.03.09 17:37:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{64EA50CB-25E2-4150-A642-89767066308C}
[2012.03.09 17:37:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6F793F36-E211-46B0-9521-AB5BD6A91CAD}
[2012.03.07 09:53:51 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A49D358B-3BA5-436F-816E-CB9D33A9395F}
[2012.03.07 09:53:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F9D65265-A7B4-454E-928F-28E8AE3CA81A}
[2012.03.06 08:56:24 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A39BBA3B-8ACA-4F17-AC8B-78715DCDB525}
[2012.03.06 08:56:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F927ABE6-58DD-4F2E-B31A-6F06C277AF1B}
[2012.03.05 19:54:49 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{13BFB29F-C685-401A-AE0B-6BDF8482259A}
[2012.03.05 19:54:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{451ACD1F-54BC-45AE-9384-BFE54B270ABD}
[2012.02.27 23:25:05 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{FD5FF5F4-2B2A-4F32-9720-DF7BEC65FD5E}
[2012.02.27 23:25:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9EAC9419-0249-4425-9025-4456DC72AEB8}
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.28 18:38:33 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.28 18:38:33 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.28 18:38:33 | 000,125,676 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.28 18:38:33 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.28 18:27:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.28 18:21:31 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.28 18:21:31 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.28 18:12:11 | 000,002,687 | ---- | M] () -- C:\Users\Public\Desktop\Vodafone Mobile Connect.lnk
[2012.03.28 17:26:14 | 000,001,248 | ---- | M] () -- C:\Users\***\Desktop\gggg.jpg
[2012.03.28 17:25:34 | 000,035,940 | ---- | M] () -- C:\Users\***\Desktop\sq_falkenmeyer-l.jpg
[2012.03.28 12:41:14 | 000,023,440 | ---- | M] () -- C:\Users\***\Desktop\patri.jpg
[2012.03.28 12:29:30 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001726.LCS
[2012.03.28 11:14:16 | 000,000,788 | ---- | M] () -- C:\Users\***\Desktop\TinyPic.lnk
[2012.03.27 21:33:05 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.27 14:04:12 | 000,001,963 | ---- | M] () -- C:\Users\Public\Desktop\Patrizier IV.lnk
[2012.03.27 11:51:09 | 000,001,349 | ---- | M] () -- C:\Users\***\Desktop\babbel02.jpg
[2012.03.27 11:00:14 | 000,474,610 | ---- | M] () -- C:\Users\***\Desktop\gerichtskasse.TIF
[2012.03.27 08:29:07 | 000,002,177 | ---- | M] () -- C:\Users\***\Desktop\babbel.jpg
[2012.03.26 18:30:31 | 000,000,982 | ---- | M] () -- C:\Windows\wiso.ini
[2012.03.26 17:48:10 | 000,001,906 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
[2012.03.26 17:48:10 | 000,001,874 | ---- | M] () -- C:\Users\Public\Desktop\WISO Steuer-Sparbuch 2012.lnk
[2012.03.26 14:06:34 | 000,327,592 | ---- | M] () -- C:\Users\***\Documents\eddy 018.JPG
[2012.03.26 14:05:32 | 000,364,116 | ---- | M] () -- C:\Users\***\Documents\eddy 015.JPG
[2012.03.26 14:05:14 | 000,336,636 | ---- | M] () -- C:\Users\***\Documents\eddy 012.JPG
[2012.03.26 14:04:48 | 000,347,839 | ---- | M] () -- C:\Users\***\Documents\eddy 011.JPG
[2012.03.26 14:03:48 | 000,386,949 | ---- | M] () -- C:\Users\***\Documents\eddy 006.JPG
[2012.03.26 14:03:38 | 000,412,470 | ---- | M] () -- C:\Users\***\Documents\eddy 005.JPG
[2012.03.26 14:02:54 | 000,381,564 | ---- | M] () -- C:\Users\***\Documents\eddy 001.JPG
[2012.03.23 01:54:48 | 000,000,680 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.03.22 20:22:16 | 156,465,281 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.03.21 14:34:13 | 000,001,005 | ---- | M] () -- C:\Users\***\Desktop\RA3 - Verknüpfung.lnk
[2012.03.20 21:54:41 | 000,003,638 | ---- | M] () -- C:\Windows\System32\ealregsnapshot1.reg
[2012.03.20 19:30:30 | 000,281,760 | ---- | M] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.03.20 19:30:28 | 000,025,888 | ---- | M] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.03.20 15:14:29 | 000,000,935 | ---- | M] () -- C:\Users\***\Desktop\Mantronic´s Kaiser II.lnk
[2012.03.17 16:48:37 | 000,001,874 | ---- | M] () -- C:\Users\Public\Desktop\WISO Steuer-Sparbuch 2011.lnk
[2012.03.17 10:03:59 | 000,373,128 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.17 00:05:00 | 001,653,760 | ---- | M] () -- C:\Users\***\Desktop\Tagebuchvorlage.pub
 
========== Files Created - No Company Name ==========
 
[2012.03.28 17:26:14 | 000,001,248 | ---- | C] () -- C:\Users\***\Desktop\gggg.jpg
[2012.03.28 17:25:31 | 000,035,940 | ---- | C] () -- C:\Users\***\Desktop\sq_falkenmeyer-l.jpg
[2012.03.28 12:41:10 | 000,023,440 | ---- | C] () -- C:\Users\***\Desktop\patri.jpg
[2012.03.28 11:14:16 | 000,000,788 | ---- | C] () -- C:\Users\***\Desktop\TinyPic.lnk
[2012.03.27 13:57:23 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00001726.LCS
[2012.03.27 13:56:37 | 000,001,963 | ---- | C] () -- C:\Users\Public\Desktop\Patrizier IV.lnk
[2012.03.27 11:51:09 | 000,001,349 | ---- | C] () -- C:\Users\***\Desktop\babbel02.jpg
[2012.03.27 11:01:09 | 000,474,610 | ---- | C] () -- C:\Users\***\Desktop\gerichtskasse.TIF
[2012.03.27 08:29:07 | 000,002,177 | ---- | C] () -- C:\Users\***\Desktop\babbel.jpg
[2012.03.26 17:48:10 | 000,001,874 | ---- | C] () -- C:\Users\Public\Desktop\WISO Steuer-Sparbuch 2012.lnk
[2012.03.26 14:06:34 | 000,327,592 | ---- | C] () -- C:\Users\***\Documents\eddy 018.JPG
[2012.03.26 14:05:32 | 000,364,116 | ---- | C] () -- C:\Users\***\Documents\eddy 015.JPG
[2012.03.26 14:05:14 | 000,336,636 | ---- | C] () -- C:\Users\***\Documents\eddy 012.JPG
[2012.03.26 14:04:48 | 000,347,839 | ---- | C] () -- C:\Users\***\Documents\eddy 011.JPG
[2012.03.26 14:03:48 | 000,386,949 | ---- | C] () -- C:\Users\***\Documents\eddy 006.JPG
[2012.03.26 14:03:38 | 000,412,470 | ---- | C] () -- C:\Users\***\Documents\eddy 005.JPG
[2012.03.26 14:02:54 | 000,381,564 | ---- | C] () -- C:\Users\***\Documents\eddy 001.JPG
[2012.03.21 14:34:13 | 000,001,005 | ---- | C] () -- C:\Users\***\Desktop\RA3 - Verknüpfung.lnk
[2012.03.20 21:54:41 | 000,003,638 | ---- | C] () -- C:\Windows\System32\ealregsnapshot1.reg
[2012.03.20 19:30:30 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2012.03.20 19:30:28 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2012.03.20 15:14:29 | 000,000,935 | ---- | C] () -- C:\Users\***\Desktop\Mantronic´s Kaiser II.lnk
[2012.03.17 16:49:07 | 000,000,982 | ---- | C] () -- C:\Windows\wiso.ini
[2012.03.17 16:48:37 | 000,001,906 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
[2012.03.17 16:48:37 | 000,001,874 | ---- | C] () -- C:\Users\Public\Desktop\WISO Steuer-Sparbuch 2011.lnk
[2012.03.17 00:05:00 | 001,653,760 | ---- | C] () -- C:\Users\***\Desktop\Tagebuchvorlage.pub
[2011.07.17 15:30:44 | 000,000,680 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2011.06.06 20:50:11 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe
[2011.04.10 17:24:06 | 000,006,656 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.18 16:23:57 | 000,115,267 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011.02.18 16:23:57 | 000,097,859 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2011.02.17 16:35:38 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.02.17 15:11:31 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.02.17 15:11:30 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.02.17 15:10:15 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.02.16 12:35:20 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2011.02.16 12:34:42 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
 
========== LOP Check ==========
 
[2012.03.17 16:54:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2011.08.31 21:01:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.08.31 21:01:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.09.07 09:40:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Firefly Studios
[2012.01.24 18:07:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2012.03.27 14:01:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Kalypso Media
[2012.03.27 14:05:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ProtectDISC
[2012.03.20 22:15:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Red Alert 3
[2011.06.08 21:05:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ShopperReports3
[2012.03.20 19:31:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ubisoft
[2011.03.15 16:15:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Vodafone
[2012.03.27 21:33:05 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 164 bytes -> C:\Users\***\Desktop\gerichtskasse.TIF:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\***\Desktop\ec2.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\***\Desktop\ec1.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\***\Desktop\easylink.JPG:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:3B75B877

< End of report >
--- --- ---

markusg 28.03.2012 17:58
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [] C:\Users\***\AppData\Local\Temp\cgs8h0.exe ()
 :Files
C:\Users\***\AppData\Local\Temp\cgs8h0.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Jazon123 28.03.2012 18:16
Ich habe 2 Desktop.ini Dateien gefunden nach reboot, meinst du diese?

habs gefunden ;)

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Users\***\AppData\Local\Temp\cgs8h0.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: ***
->Flash cache emptied: 33094 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: ***
->Temp folder emptied: 2133300747 bytes
->Temporary Internet Files folder emptied: 602954682 bytes
->Java cache emptied: 8513163 bytes
->FireFox cache emptied: 583384070 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 193522206 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 2427763 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 2561275371 bytes

Total Files Cleaned = 5.804,00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 03282012_190508

upload hat geklappt

Update: nun funkt Outlook nicht mehr... Pst offenbar weg?

markusg 28.03.2012 19:07
hi, danke wegen den upload.
wegen der outlook probleme weise ich alle schuld von mir, das script kann nicht schuld daran sein, welches ich erstellt hab :-(
starte mal neu, teste outlook und poste mal die fehlermeldung

Jazon123 28.03.2012 19:27
ach naja das krieg ich schon hin, das ist kein Virus, ergo falsch hier ....

nochmal 1000 Dank .... :)

markusg 28.03.2012 19:40
wir sind nicht fertig.
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Jazon123 28.03.2012 20:09
Combofix Logfile:
Code:
ComboFix 12-03-28.02 - *** 28.03.2012  20:52:22.1.2 - x86
Microsoft® Windows Vista™ Business  6.0.6002.2.1252.49.1031.18.1789.1034 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Outdated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll
c:\program files\Mozilla Firefox\Plugins\npclntax_HBLiteSA.dll
c:\program files\QuestScan
c:\program files\QuestScan\questscan.exe
c:\program files\QuestScan\uninstall.exe
c:\programdata\QuestScan
c:\programdata\QuestScan\questscan135.exe
c:\windows\system32\start.exe
D:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-28 bis 2012-03-28  ))))))))))))))))))))))))))))))
.
.
2012-03-28 10:53 . 2012-03-28 10:54        --------        d-----w-        c:\users\***\2012-03-28 ebay 2012
2012-03-28 09:14 . 2012-03-28 09:14        --------        d-----w-        c:\program files\Tinypic
2012-03-28 06:27 . 2012-03-28 06:27        --------        d-----w-        c:\users\***\AppData\Local\{BEBD69BB-DBCD-406C-B72C-710855E7246D}
2012-03-28 06:27 . 2012-03-28 06:27        --------        d-----w-        c:\users\***\AppData\Local\{C1DB30B8-5F75-4BBA-9E86-99824A40F68B}
2012-03-27 12:00 . 2012-03-28 17:53        --------        d-----w-        c:\users\***\AppData\Roaming\Kalypso Media
2012-03-27 11:57 . 2012-03-27 12:05        --------        d-----w-        c:\users\***\AppData\Roaming\ProtectDISC
2012-03-27 11:57 . 2012-03-27 11:57        --------        d--h--w-        c:\windows\PIF
2012-03-27 11:56 . 2012-03-27 11:56        --------        d-----w-        c:\program files\ProtectDisc Driver Installer
2012-03-27 09:43 . 2012-03-27 09:43        --------        d-----w-        c:\users\***\AppData\Local\{72CA39D7-1C66-48A9-96CA-BC4A0C47D9FB}
2012-03-27 09:43 . 2012-03-27 09:43        --------        d-----w-        c:\users\***\AppData\Local\{5382C584-E3E4-4326-BD21-07CB8BEA8032}
2012-03-27 05:53 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{81B69F45-5056-497F-8B70-88D2CFC4DCA7}\mpengine.dll
2012-03-26 12:41 . 2012-03-28 09:14        --------        d-----w-        c:\users\***\2012-03-26 eddy
2012-03-26 09:48 . 2012-03-26 09:48        --------        d-----w-        c:\users\***\AppData\Local\{B4AE9E5A-8D02-4074-A588-6ADFBDE80080}
2012-03-26 09:48 . 2012-03-26 09:48        --------        d-----w-        c:\users\***\AppData\Local\{B0878C4A-01EC-4B29-8B53-B5FB90222FD4}
2012-03-23 11:59 . 2012-03-23 11:59        --------        d-----w-        c:\users\***\AppData\Local\{30B025D7-9D68-4F6A-B12A-79F4A441C222}
2012-03-23 11:58 . 2012-03-23 11:59        --------        d-----w-        c:\users\***\AppData\Local\{BA244F4C-33FD-4F0B-9AE5-CE9FC9D94B7E}
2012-03-22 09:09 . 2012-03-22 09:09        --------        d-----w-        c:\users\***\AppData\Local\{E7809101-674D-4E78-8A20-C74D3E3B0FC7}
2012-03-22 09:09 . 2012-03-22 09:09        --------        d-----w-        c:\users\***\AppData\Local\{ABCAF29A-BB18-4A99-9B01-9739928188CD}
2012-03-21 19:39 . 2012-03-21 19:39        --------        d-----w-        c:\users\***\AppData\Local\{5A0882AF-CF3C-4954-9DF8-E0084C604BCD}
2012-03-21 19:39 . 2012-03-21 19:39        --------        d-----w-        c:\users\***\AppData\Local\{26DC46AF-B9A1-4689-BE1D-D3BD0F5AE52C}
2012-03-21 14:23 . 2012-03-21 14:23        --------        d-----w-        C:\keen
2012-03-21 07:39 . 2012-03-21 07:39        --------        d-----w-        c:\users\***\AppData\Local\{B87F641A-E1AA-4C32-AC8C-894FF9C37CB9}
2012-03-21 07:39 . 2012-03-21 07:39        --------        d-----w-        c:\users\***\AppData\Local\{B9FBE261-48F3-4E2A-B69B-24942CCA7826}
2012-03-20 20:15 . 2012-03-20 20:15        --------        d-----w-        c:\users\***\AppData\Roaming\Red Alert 3
2012-03-20 20:15 . 2012-03-20 20:15        --------        d--h--r-        c:\users\***\AppData\Roaming\SecuROM
2012-03-20 19:39 . 2012-03-20 19:39        --------        d-----w-        c:\users\***\AppData\Local\{F40242C0-9EC6-4134-A13E-F371F4383855}
2012-03-20 19:39 . 2012-03-20 19:39        --------        d-----w-        c:\users\***\AppData\Local\{9466B185-E1F4-4329-80DE-8BAFB0D1691D}
2012-03-20 19:01 . 2012-03-20 19:01        --------        d-----w-        c:\program files\Electronic Arts
2012-03-20 17:30 . 2012-03-20 17:30        281760        ----a-w-        c:\windows\system32\drivers\atksgt.sys
2012-03-20 17:30 . 2012-03-20 17:30        25888        ----a-w-        c:\windows\system32\drivers\lirsgt.sys
2012-03-20 17:30 . 2009-03-16 13:18        22360        ----a-w-        c:\windows\system32\X3DAudio1_6.dll
2012-03-20 17:30 . 2008-10-15 05:22        452440        ----a-w-        c:\windows\system32\d3dx10_40.dll
2012-03-20 17:30 . 2008-10-15 05:22        2036576        ----a-w-        c:\windows\system32\D3DCompiler_40.dll
2012-03-20 17:30 . 2008-10-15 05:22        4379984        ----a-w-        c:\windows\system32\D3DX9_40.dll
2012-03-20 17:30 . 2007-04-04 17:53        81768        ----a-w-        c:\windows\system32\xinput1_3.dll
2012-03-20 14:28 . 2012-03-20 14:28        --------        d-----w-        c:\program files\Fernseh Tycoon
2012-03-20 13:10 . 2012-03-20 13:12        --------        d-----w-        C:\schiffbruch
2012-03-20 07:38 . 2012-03-20 07:39        --------        d-----w-        c:\users\***\AppData\Local\{E6E0D8CB-59B0-4531-8A20-498E019DB3B9}
2012-03-20 07:38 . 2012-03-20 07:38        --------        d-----w-        c:\users\***\AppData\Local\{2D58DF43-71B6-425B-852C-FE0F1F1EE966}
2012-03-19 19:19 . 2012-03-19 19:19        --------        d-----w-        c:\users\***\AppData\Local\{76CD686A-287F-40BF-9C03-A8A5AC58F65E}
2012-03-19 19:19 . 2012-03-19 19:19        --------        d-----w-        c:\users\***\AppData\Local\{1A22E88D-EAF5-479E-A38B-08AEBA276BA3}
2012-03-19 07:19 . 2012-03-19 07:19        --------        d-----w-        c:\users\***\AppData\Local\{37E52BC3-7730-4C90-B143-1E4FD023748F}
2012-03-19 07:19 . 2012-03-19 07:19        --------        d-----w-        c:\users\***\AppData\Local\{8874AA2A-7B72-4683-9F8E-33116EE0C260}
2012-03-18 15:29 . 2012-03-18 15:29        --------        d-----w-        c:\users\***\AppData\Local\{9DF97BCF-59E7-4368-BC76-F112402577B7}
2012-03-18 15:29 . 2012-03-18 15:29        --------        d-----w-        c:\users\***\AppData\Local\{35088C55-F9E0-4FD0-9830-000C5B8ADCC9}
2012-03-17 14:54 . 2012-03-17 14:54        --------        d-----w-        c:\users\***\AppData\Roaming\Buhl Data Service
2012-03-17 14:47 . 2012-03-26 15:48        --------        d-----w-        c:\users\***\AppData\Local\Buhl
2012-03-17 14:46 . 2012-03-26 15:44        --------        d-----w-        c:\program files\WISO
2012-03-17 14:45 . 2012-03-26 16:30        --------        d-----w-        c:\programdata\Buhl Data Service GmbH
2012-03-17 14:45 . 2012-03-17 14:45        --------        d-----w-        c:\users\***\AppData\Local\Buhl Data Service
2012-03-16 06:50 . 2012-03-16 06:50        --------        d-----w-        c:\users\***\AppData\Local\{4D413196-8F16-4E01-9893-A672A7BDF857}
2012-03-16 06:50 . 2012-03-16 06:50        --------        d-----w-        c:\users\***\AppData\Local\{6D6BCABC-6FB4-44F4-9785-BF9801EB29CE}
2012-03-15 19:24 . 2012-03-15 19:24        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-15 19:24 . 2012-03-15 19:24        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll
2012-03-15 11:19 . 2012-03-15 11:19        --------        d-----w-        c:\users\***\AppData\Local\{D4C9DF4A-9763-43D9-B2F4-EF0579BD9AA2}
2012-03-15 11:19 . 2012-03-15 11:19        --------        d-----w-        c:\users\***\AppData\Local\{A8E02783-CF50-4B6F-B4C5-C134BBFA1915}
2012-03-14 05:52 . 2012-02-02 15:16        2044416        ----a-w-        c:\windows\system32\win32k.sys
2012-03-14 05:51 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll
2012-03-14 05:51 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-03-14 05:51 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2012-03-14 05:51 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll
2012-03-14 05:51 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 05:51 . 2012-01-31 10:59        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2012-03-14 05:51 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll
2012-03-14 05:51 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-12 12:31 . 2012-03-12 12:32        --------        d-----w-        c:\users\***\2012-03-12 boston
2012-03-12 06:37 . 2012-03-12 06:37        --------        d-----w-        c:\users\***\AppData\Local\{C179A1EE-807F-4ABB-9B9D-5BB3E19CB66C}
2012-03-12 06:37 . 2012-03-12 06:37        --------        d-----w-        c:\users\***\AppData\Local\{EE5C1290-40E2-42D7-9DAD-3C5888D588CC}
2012-03-11 17:28 . 2012-03-11 17:28        --------        d-----w-        c:\program files\Common Files\Skype
2012-03-11 17:23 . 2012-03-11 17:23        --------        d-----w-        c:\users\***\AppData\Local\{B7311A9C-82BF-4D49-8441-960D3B923546}
2012-03-11 17:23 . 2012-03-11 17:23        --------        d-----w-        c:\users\***\AppData\Local\{436F0B99-5E14-4E58-A54F-7132A2C60CAF}
2012-03-10 08:56 . 2012-03-10 08:56        --------        d-----w-        c:\users\***\AppData\Local\{E1C7DD19-D70F-4801-AB17-338544D36746}
2012-03-10 08:56 . 2012-03-10 08:56        --------        d-----w-        c:\users\***\AppData\Local\{192E031C-0A62-488A-AD86-9FBB7270C5C1}
2012-03-09 15:37 . 2012-03-09 15:37        --------        d-----w-        c:\users\***\AppData\Local\{64EA50CB-25E2-4150-A642-89767066308C}
2012-03-09 15:37 . 2012-03-09 15:37        --------        d-----w-        c:\users\***\AppData\Local\{6F793F36-E211-46B0-9521-AB5BD6A91CAD}
2012-03-07 07:53 . 2012-03-07 07:53        --------        d-----w-        c:\users\***\AppData\Local\{A49D358B-3BA5-436F-816E-CB9D33A9395F}
2012-03-07 07:53 . 2012-03-07 07:53        --------        d-----w-        c:\users\***\AppData\Local\{F9D65265-A7B4-454E-928F-28E8AE3CA81A}
2012-03-06 06:56 . 2012-03-06 06:56        --------        d-----w-        c:\users\***\AppData\Local\{A39BBA3B-8ACA-4F17-AC8B-78715DCDB525}
2012-03-06 06:56 . 2012-03-06 06:56        --------        d-----w-        c:\users\***\AppData\Local\{F927ABE6-58DD-4F2E-B31A-6F06C277AF1B}
2012-03-05 17:54 . 2012-03-05 17:54        --------        d-----w-        c:\users\***\AppData\Local\{13BFB29F-C685-401A-AE0B-6BDF8482259A}
2012-03-05 17:54 . 2012-03-05 17:54        --------        d-----w-        c:\users\***\AppData\Local\{451ACD1F-54BC-45AE-9384-BFE54B270ABD}
2012-02-27 21:25 . 2012-02-27 21:25        --------        d-----w-        c:\users\***\AppData\Local\{FD5FF5F4-2B2A-4F32-9720-DF7BEC65FD5E}
2012-02-27 21:25 . 2012-02-27 21:25        --------        d-----w-        c:\users\***\AppData\Local\{9EAC9419-0249-4425-9025-4456DC72AEB8}
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-07 06:56 . 2011-05-13 14:19        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2011-02-16 11:55        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-03-15 19:24 . 2011-05-14 07:58        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-04-20 2327552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Inhaltsverzeichnis.onetoc2 [2011-9-29 3656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Audible Download Manager.lnk - c:\program files\Audible\Bin\AudibleDownloadHelper.exe [2010-10-19 1795488]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-3-26 1380464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\kloehk.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
bthsvcs        REG_MULTI_SZ          BthServ
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\l0j9eh5h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-QuestScan - c:\program files\QuestScan\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-03-28 21:03
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3759201032-1668517145-2826145873-1000\Software\SecuROM\License information*]
"datasecu"=hex:00,ba,97,29,63,71,97,67,8b,5c,f8,17,f9,f2,13,6c,e1,bc,2b,32,13,
  9a,74,ed,18,32,ae,ce,0d,5f,39,a9,5f,c9,f0,8d,6b,69,f9,35,e5,3a,69,22,79,7b,\
"rkeysecu"=hex:f5,9d,40,b1,be,2b,18,e5,33,dc,17,ef,3c,84,14,5c
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-03-28  21:07:25
ComboFix-quarantined-files.txt  2012-03-28 19:07
.
Vor Suchlauf: 14 Verzeichnis(se), 14.389.846.016 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 14.594.576.384 Bytes frei
.
- - End Of File - - 2DE8D090DB27D50D2B958C923758B6C5
--- --- ---


ist das korrekt so ? was sagt uns das nun ? ;)

markusg 29.03.2012 11:45
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Jazon123 29.03.2012 18:49
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.29.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19190
*** :: CHRISTIANRÜT-PC [Administrator]

Schutz: Aktiviert

29.03.2012 18:11:58
mbam-log-2012-03-29 (18-11-58).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 308954
Laufzeit: 1 Stunde(n), 24 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 4
HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C} (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\QUESTSCAN (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKLM\SOFTWARE\Mozilla\Firefox\extensions|HBLite@HBLite.com (Adware.HotBar) -> Daten: C:\Program Files\HBLite\bin\11.0.363.0\firefox\extensions -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\QuestScan|DllPath (Adware.QuestScan) -> Daten: C:\Program Files\QuestScan\questscan.dll -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 4
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096} (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\chrome (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\defaults (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\defaults\preferences (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 13
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\fltlib.dll (RiskWare.Tool.CK) -> Löschen bei Neustart.
C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll.vir (Adware.ClickPotato) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\plugins\npclntax_HBLiteSA.dll.vir (Adware.Hotbar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\Program Files\QuestScan\questscan.exe.vir (Adware.Agent.ZGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Qoobox\Quarantine\C\ProgramData\QuestScan\questscan135.exe.vir (Adware.Agent.ZGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Local\ClickPotatoLiteSA\bin\12.0.15.0\ClickPotatoLiteSAHook.dll (Adware.HotBar.CP) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\Downloads\eMuleSetup.exe (Adware.Hotbar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\KIS\Kaspersky 2011 Crack.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Downloads\Kaspersky 2011 Crack.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\chrome.manifest (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\install.rdf (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\chrome\questscan.jar (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Mozilla Firefox\extensions\{F0E1168A-B4B5-484C-B77E-0D28E6B64096}\defaults\preferences\prefs.js (Adware.QuestScan) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:19 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19