Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner Generic29.AGEZ+Cryptic.EGJ (https://www.trojaner-board.de/123026-trojaner-generic29-agez-cryptic-egj.html)

play4fun28 29.08.2012 20:22
Trojaner Generic29.AGEZ+Cryptic.EGJ
 
Guten Tag liebes Forum,
ich hoffe ihr könnt mir helfen.
Ich wollte mir gerade etwas runterladen und es haben sich auf der Downloadseite 5 neue Tabs geöffnet, mehrmals, bis ich dann von der Seite runterging. Dann kam von AVG diese Meldung, dass irgendetwas geblockt wurde. Danach habe ich sofort ein Scan mit AVG gemacht und es wurde nix gefunden, poste aber mal zur Sicherheit hier etwas rein.
Habe auf Ok geklickt. Dann nach ca 10 Minuten kam auf einmal die Meldung, dass ich mir ein 2 Trojaner gefangen habe:
Code:
"Infektion";"Trojaner: Generic29.AGEZ";"c:\Users\Sascha\AppData\Local\Temp\rncxewsoam.exe";"Nicht verfügbar";"29.08.2012, 20:38:46"
Code:
"Infektion";"Trojaner: Cryptic.EGJ";"c:\Users\Sascha\AppData\Local\Temp\owsacxenrm.exe";"Nicht verfügbar";"29.08.2012, 20:38:48"
Ich wollte mir heute noch etwas über paypal kaufen, ist der Kauf durch diesen Virus gefährdet?
OTL und so habe ich alles drauf, hier das Log:
Code:
OTL logfile created on: 29.08.2012 20:53:18 - Run 4
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Users\Sascha\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 59,56% Memory free
6,00 Gb Paging File | 4,56 Gb Available in Paging File | 76,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,16 Gb Total Space | 119,67 Gb Free Space | 79,69% Space Free | Partition Type: NTFS
Drive D: | 488,28 Gb Total Space | 388,91 Gb Free Space | 79,65% Space Free | Partition Type: NTFS
Drive E: | 292,87 Gb Total Space | 292,77 Gb Free Space | 99,96% Space Free | Partition Type: NTFS
 
Computer Name: SASCHA-PC | User Name: Sascha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.24 18:42:26 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Programme\Common Files\Steam\SteamService.exe
PRC - [2012.08.09 14:07:35 | 003,414,680 | ---- | M] (Electronic Arts) -- C:\Programme\Origin\Origin.exe
PRC - [2012.08.04 13:11:41 | 001,353,080 | ---- | M] (Valve Corporation) -- D:\Spiele\Steam\Steam.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.17 15:49:04 | 000,935,008 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgidsagent.exe
PRC - [2012.06.28 14:05:43 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\java.exe
PRC - [2012.06.24 10:52:23 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Sascha\Desktop\OTL.exe
PRC - [2012.06.13 03:48:26 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgrsx.exe
PRC - [2012.06.13 03:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgnsx.exe
PRC - [2012.05.04 19:29:40 | 000,035,216 | ---- | M] (Oracle Corporation) -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2launcher.exe
PRC - [2012.04.05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgtray.exe
PRC - [2012.03.19 05:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgemcx.exe
PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgwdsvc.exe
PRC - [2012.02.14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgcsrvx.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010.08.26 03:57:32 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2010.08.26 03:57:04 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.11.06 14:41:06 | 002,080,768 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
PRC - [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:17:29 | 000,673,048 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 03:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll
MOD - [2012.08.24 18:42:24 | 020,317,008 | ---- | M] () -- D:\Spiele\Steam\bin\libcef.dll
MOD - [2012.08.24 18:42:22 | 000,902,480 | ---- | M] () -- D:\Spiele\Steam\bin\chromehtml.dll
MOD - [2012.08.24 18:42:20 | 000,123,232 | ---- | M] () -- D:\Spiele\Steam\bin\avutil-51.dll
MOD - [2012.08.24 18:42:18 | 000,190,816 | ---- | M] () -- D:\Spiele\Steam\bin\avformat-53.dll
MOD - [2012.08.24 18:42:16 | 001,099,616 | ---- | M] () -- D:\Spiele\Steam\bin\avcodec-53.dll
MOD - [2012.05.30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.05.30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.05.04 19:29:38 | 000,015,760 | ---- | M] () -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2native.dll
MOD - [2009.11.06 14:41:06 | 002,080,768 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe
MOD - [2009.03.04 09:52:36 | 000,372,736 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WlanDll.dll
MOD - [2008.12.29 17:13:24 | 000,204,800 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\KJLog.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.08.24 18:42:26 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.16 13:37:18 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.20 15:47:04 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.17 15:49:04 | 000,935,008 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.08.26 03:57:04 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Sascha\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012.04.19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012.03.19 05:17:28 | 000,301,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012.02.23 14:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2012.02.22 05:25:32 | 000,235,216 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012.01.31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.12.23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.12.23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011.12.23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011.12.23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011.11.10 18:32:00 | 000,095,304 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV - [2011.03.18 18:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2010.08.26 05:36:28 | 006,380,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2010.08.26 03:20:36 | 000,221,696 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2009.11.18 18:09:52 | 000,376,832 | ---- | M] (NETGEAR Inc.                          ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wg111v3.sys -- (RTL8187B)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 DF 45 05 B3 4F CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012.07.17 15:58:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012.07.17 15:58:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.20 15:47:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.06.21 15:39:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Extensions
[2012.06.23 16:35:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Firefox\Profiles\xfzlfqxq.default\extensions
[2012.06.23 16:35:44 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Sascha\AppData\Roaming\mozilla\Firefox\Profiles\xfzlfqxq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.06.21 15:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.17 15:58:44 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012.07.20 15:47:04 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.20 15:47:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.20 15:47:02 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.20 15:47:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.20 15:47:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.20 15:47:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.20 15:47:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.07.22 15:08:13 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Programme\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [cdpbj] C:\Users\Sascha\AppData\Roaming\cdpbj.dll ()
O4 - HKCU..\Run: [Steam] D:\Spiele\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sascha\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Programme\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95E3C5A3-A58D-4F7D-A977-4AAE6ABE8C34}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B96EAFA4-4CCD-420D-AB87-0DAEA1108052}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.26 18:41:39 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{5DB5A4D1-6D65-4462-A97E-C88BD3C707AE}
[2012.08.22 17:13:07 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.08.19 14:32:38 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\PunkBuster
[2012.08.19 14:32:27 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ubisoft
[2012.08.16 17:32:05 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\Ubisoft Game Launcher
[2012.08.16 17:32:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft
[2012.08.16 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft
[2012.08.16 12:48:58 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.11 14:46:25 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{47B878E3-C472-476C-A982-8E9E9C7BDA19}
[2012.08.11 14:46:13 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{1557D964-65CE-44A1-9A6B-E48FA59458CD}
[2012.08.10 17:39:21 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{CD0319AB-3811-45C7-9F23-5531B747F0CF}
[2012.08.10 17:39:09 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{AC2414BD-6529-4ADF-89AC-23519A537CBB}
[2012.08.10 17:39:09 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{42A91397-8D1F-4938-BD8F-A1076746488C}
[2012.08.10 17:35:22 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps
[2012.08.10 13:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\vlc
[2012.08.10 13:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.08.09 17:43:33 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer
[2012.08.09 17:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer
[2012.08.08 21:33:27 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Skype
[2012.08.08 21:33:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.08.08 21:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.08 21:33:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.08.08 21:33:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.08.06 15:34:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
[2012.08.06 15:34:42 | 000,000,000 | ---D | C] -- C:\ProgramData\MTA San Andreas All
[2012.08.06 15:26:56 | 000,000,000 | ---D | C] -- C:\Users\Sascha\Documents\GTA San Andreas User Files
[2012.08.06 15:26:51 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.08.03 15:26:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArtMoney SE
[2012.08.02 14:48:22 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.08.02 14:47:44 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.08.02 14:41:47 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.08.02 14:41:47 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.08.02 14:41:47 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.08.02 14:41:44 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.08.02 14:41:42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.08.02 14:41:34 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.07.30 23:12:10 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.07.30 23:12:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll
[2012.08.29 20:37:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.29 18:13:53 | 000,696,132 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.29 18:13:53 | 000,651,450 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.29 18:13:53 | 000,147,428 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.29 18:13:53 | 000,120,382 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.29 18:12:55 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 18:12:55 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.29 18:07:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.29 18:07:47 | 247,595,494 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.08.29 18:07:47 | 2415,312,896 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.29 17:20:53 | 105,217,374 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012.08.19 18:10:57 | 000,168,995 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012.08.19 14:33:05 | 000,138,536 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.08.19 14:32:41 | 000,270,408 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.08.16 16:16:55 | 000,000,208 | ---- | M] () -- C:\Users\Sascha\Desktop\Assassin's Creed Brotherhood.url
[2012.08.16 13:37:07 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.08.16 13:37:07 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.08.10 13:20:17 | 000,000,615 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.08.09 17:43:49 | 000,000,693 | ---- | M] () -- C:\Users\Sascha\Desktop\SAMP.lnk
[2012.08.08 21:33:23 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.06 15:34:55 | 000,000,849 | ---- | M] () -- C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
[2012.08.06 15:26:38 | 000,000,891 | ---- | M] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk
[2012.08.03 15:26:43 | 000,000,654 | ---- | M] () -- C:\Users\Public\Desktop\ArtMoney SE v7.39.lnk
[2012.08.02 15:30:47 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\FIFA 12.lnk
[2012.07.30 23:12:10 | 000,000,667 | ---- | M] () -- C:\Users\Sascha\Desktop\SpeedFan.lnk
[2012.07.30 23:12:10 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
 
========== Files Created - No Company Name ==========
 
[2012.08.29 20:37:49 | 000,161,792 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll
[2012.08.22 17:13:05 | 247,595,494 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.08.19 14:33:05 | 000,138,536 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.08.19 14:32:41 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.08.16 17:31:14 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2012.08.16 17:31:13 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2012.08.16 16:16:55 | 000,000,208 | ---- | C] () -- C:\Users\Sascha\Desktop\Assassin's Creed Brotherhood.url
[2012.08.10 13:20:17 | 000,000,615 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.08.09 17:43:51 | 000,000,693 | ---- | C] () -- C:\Users\Sascha\Desktop\SAMP.lnk
[2012.08.08 21:33:23 | 000,002,505 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.08.06 15:34:55 | 000,000,849 | ---- | C] () -- C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk
[2012.08.06 15:17:38 | 000,000,891 | ---- | C] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk
[2012.08.03 15:26:43 | 000,000,654 | ---- | C] () -- C:\Users\Public\Desktop\ArtMoney SE v7.39.lnk
[2012.08.02 14:41:47 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.08.02 14:41:47 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.08.02 14:41:47 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.08.02 14:41:47 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.08.02 14:41:47 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.07.30 23:12:10 | 000,000,667 | ---- | C] () -- C:\Users\Sascha\Desktop\SpeedFan.lnk
[2012.07.30 23:12:09 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
[2012.07.20 17:11:01 | 000,027,520 | ---- | C] () -- C:\Users\Sascha\AppData\Local\dt.dat
[2012.06.24 10:51:45 | 000,000,000 | ---- | C] () -- C:\Users\Sascha\defogger_reenable
[2012.06.21 15:25:54 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.06.21 15:18:02 | 000,002,857 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2012.06.11 18:41:48 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2012.06.11 18:41:48 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2012.06.11 13:50:42 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.05.10 16:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

< End of report >
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-24 11:10:51
Windows 6.1.7600  Harddisk0\DR0 -> \Device\00000066 ST310005 rev.CC44
Running: vjqxwf28.exe; Driver: C:\Users\Sascha\AppData\Local\Temp\fwliqpog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwNotifyChangeKey [0x95B6E004]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwNotifyChangeMultipleKeys [0x95B6E0D4]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwOpenProcess [0x95B6DD76]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateProcess [0x95B6DE1E]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateThread [0x95B6DEBA]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwWriteVirtualMemory [0x95B6DF56]

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                              82A55579 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                      82A79F52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!RtlSidHashLookup + 4A0                                                                                          82A819A0 8 Bytes  [04, E0, B6, 95, D4, E0, B6, ...] {ADD AL, 0xe0; MOV DH, 0x95; AAM 0xe0; MOV DH, 0x95}
.text          ntkrnlpa.exe!RtlSidHashLookup + 4E8                                                                                          82A819E8 4 Bytes  [76, DD, B6, 95] {JBE 0xffffffffffffffdf; MOV DH, 0x95}
.text          ntkrnlpa.exe!RtlSidHashLookup + 7B8                                                                                          82A81CB8 8 Bytes  [1E, DE, B6, 95, BA, DE, B6, ...] {PUSH DS; FIDIV WORD [ESI-0x4921456b]; XCHG EBP, EAX}
.text          ntkrnlpa.exe!RtlSidHashLookup + 82C                                                                                          82A81D2C 4 Bytes  [56, DF, B6, 95]
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                                                    section is writeable [0x9122B000, 0x341E0C, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                      avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                      avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume8                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\0000004b                                                                                            halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\tdx \Device\Udp                                                                                                      avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                                    avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----
Defogger hat keine Fehlermeldung oder sonstwas abgegeben.
MfG play4fun28

t'john 29.08.2012 22:48
:hallo:

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
:OTL
MOD - [2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O4 - HKCU..\Run: [cdpbj] C:\Users\Sascha\AppData\Roaming\cdpbj.dll ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
 

[2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll
 
:Files

C:\Users\Sascha\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Sascha\AppData\Local\Temp\*.exe
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

play4fun28 30.08.2012 15:47
Hi,
erstmal danke für deine Hilfe.
Der Fix hat nur zum Teil funktioniert.
Es kam eine Meldung:
Code:
Cannot create C:/Users/Sascha/Desktop/cmd.bat.
Nur, ich habe gestern etwas komisches bemerkt, was nach diese Fix weg ist.
1. Es war im Task-Manager 2 mal iexplorer.exe geöffnet.
2. In /Appdata/Local/temp waren 8 Dateien, welche von dem Prozess genutzt worden sind, die auch genau zum Zeitpunkt des Donloads erstellt wurden (20:38). Diese sind jetzt auch weg.
Ein Log wurde nicht erstellt, lediglich ein Ordner mit dem Zeitpunk, an dem ich angefangen habe. In dem Ordner ist aber nichts drin.

MfG play4fun28

Achso, außerdem stoppt OTL mit der Zeile:
Code:
type c:\Combofix.txt /c
:Commands
[purity]
[emptytemp]
Also, diese 4 sind dann noch zu sehen und dann kommt die Fehlermeldung. Auch, wenn ich es als Admin ausfürhe, funktioniert es nicht.
(Ich konnte es oben nicht mehr rein editieren, deswegen ein neuer Beitrag)

MfG play4fun28

t'john 30.08.2012 20:27
Wo ist das Fix Log?

Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

play4fun28 30.08.2012 20:43
Hi, es gibt kein Fix Log. Es gibt nur ein Ordner mit dem Zeitpunkt, an dem ich das Log gemacht.
Steht doch auch in meinem Beitrag davor :D

t'john 31.08.2012 08:56
Fix angepasst, nochmal versuchen

c:\Combofix.txt auch posten!

play4fun28 31.08.2012 10:08
Hi, jetzt hast es funktioniert.
Hier das OTL Log:
Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Google" removed from browser.search.selectedEngine
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cdpbj not found.
File C:\Users\Sascha\AppData\Roaming\cdpbj.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File C:\Users\Sascha\AppData\Roaming\cdpbj.dll not found.
========== FILES ==========
File\Folder C:\Users\Sascha\AppData\Local\{*} not found.
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\TEMP not found.
File\Folder C:\Users\Sascha\AppData\Local\Temp\*.exe not found.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Sascha\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File/Folder C:\Windows\System32\*.tmp not found.
File/Folder C:\Windows\SysWOW64\*.tmp not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Sascha\Desktop\cmd.bat deleted successfully.
C:\Users\Sascha\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Sascha
->Temp folder emptied: 23968788 bytes
->Temporary Internet Files folder emptied: 7528864 bytes
->FireFox cache emptied: 64272573 bytes
->Flash cache emptied: 506 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 884241 bytes
RecycleBin emptied: 147686 bytes
 
Total Files Cleaned = 92,00 mb
 
 
OTL by OldTimer - Version 3.2.53.0 log created on 08312012_110350

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Eine combofix.txt gibt es nicht unter C, weil ich das Programm doch gar nicht benutzen sollte.

MfG play4fun28

t'john 31.08.2012 19:32
Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

play4fun28 31.08.2012 20:36
Hi,
mein Rechner läuft zur Zeit nicht gut, ich hatte heute 2 Blue Screens.
Hier die beiden Logs:
Code:
# AdwCleaner v2.000 - Datei am 08/31/2012 um 21:34:13 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate  (32 bits)
# Benutzer : Sascha - SASCHA-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Sascha\Desktop\adwcleaner(1).exe
# Option [Suche]


**** [Dienste] ****

Gefunden : vToolbarUpdater11.2.0

***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Program Files\Common Files\AVG Secure Search
Ordner Gefunden : C:\ProgramData\AVG Secure Search

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\xfzlfqxq.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R2].txt - [893 octets] - [31/08/2012 21:34:13]

########## EOF - C:\AdwCleaner[R2].txt - [952 octets] ##########
Malwarebytes hat nichts gefunden, doch während des Suchlaufs wurde was von AVG gefunden:
Code:
"Infektion";"Virus gefunden: Win32/Cryptor";"c:\_OTL\MovedFiles\08302012_161328\C_Users\Sascha\AppData\Roaming\cdpbj.dll";"Nicht verfügbar";"31.08.2012, 21:26:09"

t'john 31.08.2012 22:54
Sehr gut! :daumenhoc


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

play4fun28 01.09.2012 13:59
Hi, ich hatte gerade wieder 2 Blue Screens.
Hier das adwcleaner Log:
Code:
# AdwCleaner v2.000 - Datei am 09/01/2012 um 14:34:51 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate  (32 bits)
# Benutzer : Sascha - SASCHA-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Sascha\Desktop\adwcleaner(1).exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : vToolbarUpdater11.2.0

***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\Common Files\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Secure Search

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\xfzlfqxq.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R2].txt - [1020 octets] - [31/08/2012 21:34:13]
AdwCleaner[S2].txt - [1409 octets] - [01/09/2012 14:34:51]

########## EOF - C:\AdwCleaner[S2].txt - [1469 octets] ##########
Bei dem Emisoft kommt immer die Meldung: Files are corrupted.

t'john 02.09.2012 05:33
Bitte mal ausfuehren:
http://www.trojaner-board.de/72874-s...eparieren.html

Danach:
- neustarten


danach: Emsisoft

play4fun28 02.09.2012 13:31
Hi,
jetzt sagt Emisoft mir, dass ich mir das Service Paket 1 runterladen soll, aber das mach ich nicht, da es bei mir nur Probleme verursacht hat.
Vor einer Woche wurde ich schonmal aufgefordert das zu machen. Danach gingen alle meine Spieler nicht mehr, auch nach Neuinstallation nicht mehr, also musste ich Windows neu aufsetzen und darauf habe ich keine Lust mehr :D

t'john 02.09.2012 20:14
Zitat:
Danach gingen alle meine Spieler nicht mehr
was ging nicht?

play4fun28 03.09.2012 15:44
Hi, kann man emisoft nicht einfach überspringen?

So, jetzt hat es mir gereicht, heute schon wieder 2 Blue Screens bekommen. Jetzt habe ich einfach Windows neu aufgesetzt und den MBR neu geschrieben. Reicht das?


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:51 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132