|
sshnas21.dll Hallo Leute, Ich bin neu hier und habe jetzt mal eine Frage bezüglich dieser Anzeige: www.abload.de/img/unbenanntzpbi.png Jedes Mal, wenn ich meinen Pc starte, kommt diese Anzeige. Bevor ich Malwarebytes benutzt habe, kamen sogar noch ständig Internet-Explorer Fenster, diese sind zum Glück schon entfernt wurden. Ich habe schon diverse Virenscanner benutzt, wie z.B. Malwarebytes, Spybot und Antivir. Ich habe von dem Virus hier schonmal was im Forum gelesen, doch hat mir das nicht weitergeholfen. Ich würde mich über Hilfe sehr freuen. Mit freundlichen Grüßen, Franz |
Bitte http://www.trojaner-board.de/69886-a...-beachten.html beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! ) Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen! bei dir außer malwarebytes weil schon benutzt und bitte die berichte posten |
Das hab ich alles schon gemacht. Was meinst du mit "bei dir außer Malwarebytes weil schon benutzt und bitte die berichte posten" ?? |
1.ein zweiter scan , ohne das du etwas verändert hast wäre sinnos, da du schon malwarebytes benutzt hast. 2. du sollst die berichte von malwarebytes usw. in das forum schreiben(posten) |
:hallo: Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite bitte folgendes ab. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. schritt 1 Temp File Cleaner Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. schritt 2 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code: netsvcs
schritt 3 Rootkit-Suche Was sind Rootkits? Einige Scans auf Dateien, Prozesse u2nd Registryeinträge, die vor den meisten anderen Scannern versteckt werden (durch ein sogenanntes Rootkit). Während dieser Scans soll(en):
schritt 4 Poste mir bitte die aktuelle Logfile von Malwarebytes Starte Malwarebytes--> Reiter Scan-Berichte--> klick auf den Bericht wo ich die Funde sehen kann --> es öffnet sich automatisch ein Text-Dokument Bitte poste in Deiner nächsten Antwort OTL.txt extras.txt Gmer.txt Log von Malwarebytes |
Gut, danke. Ich werd heut alles einmal ausprobieren. |
Hier ersteinmal von Malwarebytes, wird aber bestimmt nicht weiterhelfen: Malwarebytes' Anti-Malware 1.41 Datenbank Version: 2775 Windows 6.1.7600 04.04.2010 14:19:51 mbam-log-2010-04-04 (14-19-51).txt Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|G:\|) Durchsuchte Objekte: 208222 Laufzeit: 17 minute(s), 42 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
Gmer.exe ging nicht. Hier die OTL.txt : OTL logfile created on: 04.04.2010 14:25:32 - Run 2 OTL by OldTimer - Version 3.2.1.0 Folder = C:\Users\Besitzer\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 71,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 58,59 Gb Total Space | 14,71 Gb Free Space | 25,11% Space Free | Partition Type: NTFS Drive D: | 407,07 Gb Total Space | 406,96 Gb Free Space | 99,97% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: Franz-PC Current User Name: Besitzer Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.04.04 14:25:22 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Besitzer\Desktop\OTL.exe PRC - [2010.03.16 16:36:29 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2010.03.05 16:29:23 | 001,217,872 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\steam.exe PRC - [2010.03.04 23:10:26 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2010.03.02 11:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2010.02.02 01:15:48 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2010.02.02 01:15:46 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2009.04.17 11:09:46 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009.01.26 16:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe PRC - [2008.02.08 18:50:55 | 000,418,120 | ---- | M] (Stardock Corporation) -- C:\Program Files (x86)\Stardock\CursorFX\CursorFX.exe PRC - [2006.12.28 01:00:00 | 001,454,080 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe PRC - [2006.12.28 01:00:00 | 000,356,352 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe ========== Modules (SafeList) ========== MOD - [2010.04.04 14:25:22 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Besitzer\Desktop\OTL.exe MOD - [2009.07.14 03:15:07 | 000,486,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\comdlg32.dll MOD - [2009.07.14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll MOD - [2008.02.04 20:56:46 | 000,035,144 | ---- | M] ( ) -- C:\Program Files (x86)\Stardock\CursorFX\CurXP0.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.02.03 06:17:10 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:41:59 | 000,229,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wwansvc.dll -- (WwanSvc) SRV:64bit: - [2009.07.14 03:41:56 | 000,202,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbiosrvc.dll -- (WbioSrvc) SRV:64bit: - [2009.07.14 03:41:56 | 000,163,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpo.dll -- (Power) SRV:64bit: - [2009.07.14 03:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes) SRV:64bit: - [2009.07.14 03:41:54 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sppuinotify.dll -- (sppuinotify) SRV:64bit: - [2009.07.14 03:41:54 | 000,029,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sensrsvc.dll -- (SensrSvc) SRV:64bit: - [2009.07.14 03:41:53 | 000,327,168 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\pnrpsvc.dll -- (PNRPsvc) SRV:64bit: - [2009.07.14 03:41:53 | 000,327,168 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\pnrpsvc.dll -- (p2pimsvc) SRV:64bit: - [2009.07.14 03:41:53 | 000,187,904 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\provsvc.dll -- (HomeGroupProvider) SRV:64bit: - [2009.07.14 03:41:53 | 000,067,072 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\SysNative\RpcEpMap.dll -- (RpcEptMapper) SRV:64bit: - [2009.07.14 03:41:53 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\pnrpauto.dll -- (PNRPAutoReg) SRV:64bit: - [2009.07.14 03:41:18 | 000,231,936 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ListSvc.dll -- (HomeGroupListener) SRV:64bit: - [2009.07.14 03:40:54 | 001,127,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FntCache.dll -- (FontCache) SRV:64bit: - [2009.07.14 03:40:28 | 000,314,368 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp) SRV:64bit: - [2009.07.14 03:40:28 | 000,291,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\defragsvc.dll -- (defragsvc) SRV:64bit: - [2009.07.14 03:40:13 | 000,083,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\bthserv.dll -- (bthserv) SRV:64bit: - [2009.07.14 03:40:10 | 000,100,864 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\SysNative\bdesvc.dll -- (BDESVC) SRV:64bit: - [2009.07.14 03:40:05 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AxInstSv.dll -- (AxInstSV) SRV:64bit: - [2009.07.14 03:40:01 | 000,032,256 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appidsvc.dll -- (AppIDSvc) SRV:64bit: - [2009.07.14 03:39:51 | 001,503,744 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbengine.exe -- (wbengine) SRV:64bit: - [2009.07.14 03:39:28 | 003,524,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\sppsvc.exe -- (sppsvc) SRV:64bit: - [2009.07.14 03:39:11 | 000,689,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FXSSVC.exe -- (Fax) SRV - [2010.03.16 16:36:29 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.03.05 16:30:32 | 000,332,720 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2010.03.04 23:10:26 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.08.05 23:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2009.07.14 05:20:14 | 000,000,000 | ---D | M] [On_Demand | Stopped] -- C:\Windows\Vss -- (VSS) SRV - [2009.07.14 05:20:14 | 000,000,000 | ---D | M] [Unknown | Stopped] -- C:\Windows\SysWOW64\Msdtc -- (MSDTC) SRV - [2009.07.14 03:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\provsvc.dll -- (HomeGroupProvider) SRV - [2009.07.14 03:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp) SRV - [2009.07.13 22:30:11 | 000,061,056 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vds.mof -- (vds) SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64) SRV - [2009.04.17 11:09:46 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2006.12.28 01:00:00 | 000,356,352 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.prisma-ct.de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.prisma-ct.de IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.8 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.04.04 13:49:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.04.04 13:49:30 | 000,000,000 | ---D | M] [2010.03.04 20:20:30 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\mozilla\Extensions [2010.04.04 01:44:02 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\mozilla\Firefox\Profiles\e4oddoow.default\extensions [2010.03.29 23:08:41 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Besitzer\AppData\Roaming\mozilla\Firefox\Profiles\e4oddoow.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2010.04.04 01:44:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010.03.04 21:57:22 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll [2010.04.04 13:49:28 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.04.04 13:49:28 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.04.04 13:49:28 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.04.04 13:49:28 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.04.04 13:49:28 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.03.23 16:21:45 | 000,380,794 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 13115 more lines... O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programme\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Canaveral] C:\Windows\SysWow64\sshnas21.DLL File not found O4 - HKCU..\Run: [CursorFX] C:\Program Files (x86)\Stardock\CursorFX\CursorFX.exe (Stardock Corporation) O4 - HKCU..\Run: [Real Desktop] C:\Program Files (x86)\Real Desktop\Real Desktop.exe File not found O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKCU..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation) O4 - Startup: C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk = C:\Program Files (x86)\Real Desktop\Real Desktop.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{9a14caf2-27b2-11df-8c38-0023545e6029}\Shell - "" = AutoRun O33 - MountPoints2\{9a14caf2-27b2-11df-8c38-0023545e6029}\Shell\AutoRun\command - "" = F:\pushinst.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2009.07.14 05:20:14 | 000,000,000 | ---D | M] NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation) NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation) NetSvcs:64bit: Themes - C:\Windows\SysNative\themeservice.dll (Microsoft Corporation) NetSvcs:64bit: BDESVC - C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation) NetSvcs: Ias - C:\Windows\SysWOW64\ias.dll (Microsoft Corporation) NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation) OTL cannot create restorepoints on Vista OSs! ========== Files/Folders - Created Within 14 Days ========== [2010.04.04 14:25:19 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Users\Besitzer\Desktop\OTL.exe [2010.04.04 02:11:47 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\AppData\Local\ElevatedDiagnostics [2010.04.02 20:53:51 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\AppData\Local\Xenocode [2010.04.02 20:53:51 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2010.04.02 20:53:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Deskshare [2010.03.31 21:08:48 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\iMacros [2010.03.27 01:18:52 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\AppData\Roaming\Avira [2010.03.27 01:05:28 | 000,116,568 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2010.03.27 01:05:28 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\SysWow64\drivers\avgntdd.sys [2010.03.27 01:05:28 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\SysWow64\drivers\avgntmgr.sys [2010.03.24 17:26:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2010.03.24 17:26:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2010.03.24 17:26:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple [2010.03.24 17:25:58 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\AppData\Local\Apple [2010.03.24 17:25:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2010.03.24 17:25:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple [2010.03.23 16:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2010.03.23 16:17:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2010.03.22 18:19:45 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\AppData\Roaming\Malwarebytes [2010.03.22 18:19:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.03.22 18:19:40 | 000,022,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.03.22 18:19:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.03.22 18:19:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.03.21 17:21:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Shock Utility [2010.03.17 19:06:06 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\My Weblog Posts [2010.03.17 18:36:27 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\Stardock [2010.03.15 14:45:18 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.03.11 17:52:52 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\FFOutput [2010.03.08 23:51:06 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\Downloads [2010.03.06 18:47:52 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\German Truck Simulator [2010.03.06 13:55:40 | 000,090,112 | ---- | C] (hxxp://www.mvps.org/vb) -- C:\Windows\SysWow64\ccrpTmr6.dll [2010.03.06 13:55:40 | 000,016,384 | ---- | C] (Thomas Olesch) -- C:\Windows\snow3run.exe [2010.03.06 13:55:39 | 000,352,256 | ---- | C] (Thomas Olesch) -- C:\Windows\Snow3.scr [2010.03.06 13:55:39 | 000,020,480 | ---- | C] (Thomas Olesch) -- C:\Windows\snow3cfg.exe [2010.03.05 20:25:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Stardock [2010.03.05 17:50:35 | 000,679,936 | ---- | C] (Generated by JEDI) -- C:\Windows\SysWow64\D3DX81ab.dll [2010.03.04 23:39:18 | 000,872,448 | ---- | C] (Blue Ripple Sound Limited) -- C:\Windows\SysWow64\rapture3d_oal.dll [2010.03.04 23:38:52 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\xlive [2010.03.04 23:38:48 | 000,466,520 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2010.03.04 23:38:48 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2010.03.04 23:38:48 | 000,122,968 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysNative\OpenAL32.dll [2010.03.04 23:38:48 | 000,109,144 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysWow64\OpenAL32.dll [2010.03.04 23:10:32 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\NFS Undercover [2010.03.04 21:38:04 | 000,000,000 | ---D | C] -- C:\Users\Besitzer\Documents\My Games [2010.03.04 21:37:26 | 000,268,048 | ---- | C] (MetaCreations Corporation) -- C:\Windows\SysWow64\dxtmeta2.dll [2010.03.04 20:34:15 | 000,081,072 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.03.04 20:34:15 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\SysWow64\drivers\ssmdrv.sys [2010.03.04 20:14:57 | 000,068,096 | R--- | C] (AVM Berlin) -- C:\Windows\avmadd32.dll [2010.03.04 20:12:12 | 000,014,120 | R--- | C] (AVM Berlin) -- C:\Windows\SysNative\drivers\avmeject.sys [2010.03.04 20:12:02 | 000,460,800 | ---- | C] (AVM GmbH) -- C:\Windows\SysNative\drivers\fwlanusb.sys [2010.03.04 20:12:02 | 000,095,232 | ---- | C] (AVM Berlin) -- C:\Windows\SysNative\fwlanci.dll [2010.02.27 11:51:25 | 000,000,000 | -HSD | C] -- C:\Users\Besitzer\Documents\Eigene Videos [2010.02.27 11:51:25 | 000,000,000 | -HSD | C] -- C:\Users\Besitzer\Documents\Eigene Musik [2010.02.27 11:51:25 | 000,000,000 | -HSD | C] -- C:\Users\Besitzer\Documents\Eigene Bilder [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Recovery [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Programme [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2010.02.27 11:51:02 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2010.02.27 11:50:58 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2010.02.26 17:35:04 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2010.02.26 16:08:08 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2010.02.26 15:27:26 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.02.26 15:25:29 | 000,000,000 | RH-D | C] -- C:\MSOCache [2010.02.26 15:24:44 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2010.02.26 15:24:38 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2010.02.26 15:24:38 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2010.02.26 15:24:38 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2010.02.26 15:24:38 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2010.02.26 15:24:38 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2010.02.26 15:24:38 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2010.02.26 15:24:38 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2010.02.26 15:24:38 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2010.02.26 15:24:38 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2010.02.26 15:24:38 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2010.02.26 15:24:37 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2010.02.26 15:24:37 | 000,310,784 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2010.02.26 15:19:36 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2010.02.03 06:17:46 | 000,450,048 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe [2010.02.03 06:17:10 | 000,202,752 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe [2010.02.03 06:15:46 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll [2010.02.03 06:15:28 | 000,420,864 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atipdl64.dll [2010.02.03 06:15:20 | 000,356,352 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\atipdlxx.dll [2010.02.03 06:15:06 | 000,274,432 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\Oemdspif.dll [2010.02.03 06:15:00 | 000,012,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll [2010.02.03 06:14:56 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll [2010.02.03 06:14:52 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll [2010.02.03 05:23:32 | 000,055,296 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst.dll [2010.01.28 16:33:38 | 000,116,736 | ---- | C] (ATI Technologies, Inc.) -- C:\Windows\SysNative\drivers\AtiHdmi.sys ========== Files - Modified Within 14 Days ========== [2010.04.04 14:25:22 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Besitzer\Desktop\OTL.exe [2010.04.04 14:23:47 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.04.04 14:23:32 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.04.04 14:23:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.04 14:23:25 | 3220,676,608 | -HS- | M] () -- C:\hiberfil.sys [2010.04.04 14:22:41 | 005,767,168 | -HS- | M] () -- C:\Users\Besitzer\NTUSER.DAT [2010.04.04 14:22:39 | 004,622,223 | -H-- | M] () -- C:\Users\Besitzer\AppData\Local\IconCache.db [2010.04.04 14:15:01 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.04.04 13:56:07 | 000,015,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.04 13:56:07 | 000,015,440 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.04 13:54:53 | 001,480,602 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.04.04 13:54:53 | 000,647,138 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.04.04 13:54:53 | 000,609,896 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.04.04 13:54:53 | 000,127,198 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.04.04 13:54:53 | 000,104,214 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.04.04 12:02:41 | 000,025,076 | ---- | M] () -- C:\Users\Besitzer\Desktop\Unbenannt.PNG [2010.03.23 16:21:45 | 000,380,794 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2010.03.23 16:17:42 | 000,001,269 | ---- | M] () -- C:\Users\Besitzer\Desktop\Spybot - Search & Destroy.lnk [2010.03.22 18:56:16 | 000,002,562 | ---- | M] () -- C:\Windows\diagwrn.xml [2010.03.22 18:56:16 | 000,001,908 | ---- | M] () -- C:\Windows\diagerr.xml [2010.03.22 18:19:44 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.03.21 17:21:15 | 000,065,536 | ---- | M] () -- C:\Windows\IFinst27.exe [2010.03.21 02:59:18 | 000,001,030 | ---- | M] () -- C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk [2010.03.20 23:30:27 | 000,183,112 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.03.20 19:31:52 | 000,000,355 | ---- | M] () -- C:\Users\Besitzer\Desktop\Computer.lnk [2010.03.17 19:08:45 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE [2010.03.17 18:46:57 | 000,000,626 | ---- | M] () -- C:\Users\Besitzer\Desktop\Hänger.lnk [2010.03.17 18:41:48 | 001,499,556 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.03.14 17:20:28 | 000,013,017 | ---- | M] () -- C:\Users\Besitzer\Documents\Entschuldigung vorlage.odt [2010.03.14 17:13:36 | 000,001,246 | ---- | M] () -- C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2010.03.11 17:52:46 | 000,001,209 | ---- | M] () -- C:\Users\Besitzer\Desktop\Format Factory.lnk [2010.03.07 01:46:42 | 000,001,294 | ---- | M] () -- C:\Users\Besitzer\Desktop\Landwirtschafts-Simulator 2009.lnk [2010.03.06 18:45:23 | 000,001,386 | ---- | M] () -- C:\Users\Besitzer\Desktop\German Truck Simulator.lnk [2010.03.05 20:27:19 | 000,001,272 | ---- | M] () -- C:\Users\Besitzer\Desktop\Snipping Tool.lnk [2010.03.05 18:02:44 | 000,001,892 | ---- | M] () -- C:\Users\Besitzer\Desktop\Call of Duty Modern Warfare 2.lnk [2010.03.05 18:02:44 | 000,001,892 | ---- | M] () -- C:\Users\Besitzer\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.lnk [2010.03.05 17:50:37 | 000,000,994 | ---- | M] () -- C:\Users\Besitzer\Desktop\Cheat Engine.lnk [2010.03.05 16:29:10 | 000,002,539 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2010.03.05 14:32:14 | 000,434,112 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.03.04 23:39:06 | 000,114,232 | ---- | M] () -- C:\Users\Besitzer\AppData\Local\GDIPFONTCACHEV1.DAT [2010.03.04 23:38:48 | 000,466,520 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2010.03.04 23:38:48 | 000,445,016 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2010.03.04 23:38:48 | 000,122,968 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysNative\OpenAL32.dll [2010.03.04 23:38:48 | 000,109,144 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysWow64\OpenAL32.dll [2010.03.04 23:38:04 | 000,000,214 | ---- | M] () -- C:\Users\Besitzer\Desktop\DiRT2.lnk [2010.03.04 23:10:26 | 000,066,872 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010.03.04 23:07:35 | 000,002,097 | ---- | M] () -- C:\Users\Besitzer\Desktop\Need for Speed™ Undercover.lnk [2010.03.04 22:39:52 | 000,001,154 | ---- | M] () -- C:\Users\Besitzer\Desktop\OpenOffice.lnk [2010.03.04 22:15:29 | 000,002,295 | ---- | M] () -- C:\Users\Besitzer\Desktop\Google Earth.lnk [2010.03.04 22:07:21 | 000,001,236 | ---- | M] () -- C:\Users\Besitzer\Desktop\Ashampoo Burning Studio 2010.lnk [2010.03.04 20:54:10 | 000,001,242 | ---- | M] () -- C:\Users\Besitzer\Desktop\Paint.lnk [2010.03.04 20:38:23 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo [2010.03.04 20:20:21 | 000,001,968 | ---- | M] () -- C:\Users\Besitzer\Desktop\Mozilla Firefox.lnk [2010.03.02 13:35:01 | 000,116,568 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2010.02.27 12:09:05 | 000,524,288 | -HS- | M] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2010.02.27 12:09:05 | 000,524,288 | -HS- | M] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2010.02.27 12:09:05 | 000,065,536 | -HS- | M] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2010.02.27 11:51:25 | 000,000,020 | -HS- | M] () -- C:\Users\Besitzer\ntuser.ini [2010.02.27 11:50:33 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2010.02.27 11:50:33 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2010.02.26 17:36:06 | 000,000,020 | ---- | M] () -- C:\Windows\è÷Ï [2010.02.26 15:28:34 | 000,000,478 | ---- | M] () -- C:\Windows\win.ini [2010.02.26 15:23:57 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2010.02.26 15:18:21 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.02.16 14:24:00 | 000,081,072 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.02.03 06:19:16 | 000,031,240 | ---- | M] () -- C:\Windows\SysNative\atiapfxx.blb [2010.02.03 06:17:46 | 000,450,048 | ---- | M] (AMD) -- C:\Windows\SysNative\atieclxx.exe [2010.02.03 06:17:10 | 000,202,752 | ---- | M] (AMD) -- C:\Windows\SysNative\atiesrxx.exe [2010.02.03 06:15:46 | 000,120,320 | ---- | M] (AMD) -- C:\Windows\SysNative\atitmm64.dll [2010.02.03 06:15:28 | 000,420,864 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atipdl64.dll [2010.02.03 06:15:20 | 000,356,352 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\atipdlxx.dll [2010.02.03 06:15:06 | 000,274,432 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\Oemdspif.dll [2010.02.03 06:15:00 | 000,012,288 | ---- | M] (AMD) -- C:\Windows\SysNative\atimuixx.dll [2010.02.03 06:14:56 | 000,059,392 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysNative\atiedu64.dll [2010.02.03 06:14:52 | 000,043,520 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysWow64\ati2edxx.dll [2010.02.03 05:40:52 | 000,491,104 | ---- | M] () -- C:\Windows\SysNative\atiumd6a.cap [2010.02.03 05:36:48 | 000,491,104 | ---- | M] () -- C:\Windows\SysWow64\atiumdva.cap [2010.02.03 05:23:32 | 000,055,296 | ---- | M] (AMD) -- C:\Windows\SysNative\coinst.dll [2010.01.28 16:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) -- C:\Windows\SysNative\drivers\AtiHdmi.sys ========== Files Created - No Company Name ========== [2010.04.04 12:02:41 | 000,025,076 | ---- | C] () -- C:\Users\Besitzer\Desktop\Unbenannt.PNG [2010.03.23 16:17:42 | 000,001,269 | ---- | C] () -- C:\Users\Besitzer\Desktop\Spybot - Search & Destroy.lnk [2010.03.22 18:51:08 | 000,002,562 | ---- | C] () -- C:\Windows\diagwrn.xml [2010.03.22 18:51:08 | 000,001,908 | ---- | C] () -- C:\Windows\diagerr.xml [2010.03.22 18:19:44 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.03.21 02:59:18 | 000,001,030 | ---- | C] () -- C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk [2010.03.21 02:42:26 | 000,065,536 | ---- | C] () -- C:\Windows\IFinst27.exe [2010.03.20 19:31:52 | 000,000,355 | ---- | C] () -- C:\Users\Besitzer\Desktop\Computer.lnk [2010.03.17 19:08:45 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2010.03.17 18:41:48 | 001,499,556 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.03.14 17:19:26 | 000,013,017 | ---- | C] () -- C:\Users\Besitzer\Documents\Entschuldigung vorlage.odt [2010.03.14 17:13:36 | 000,001,246 | ---- | C] () -- C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2010.03.11 17:52:46 | 000,001,209 | ---- | C] () -- C:\Users\Besitzer\Desktop\Format Factory.lnk [2010.03.07 01:46:42 | 000,001,294 | ---- | C] () -- C:\Users\Besitzer\Desktop\Landwirtschafts-Simulator 2009.lnk [2010.03.06 18:45:23 | 000,001,386 | ---- | C] () -- C:\Users\Besitzer\Desktop\German Truck Simulator.lnk [2010.03.06 13:55:40 | 000,002,494 | ---- | C] () -- C:\Windows\SysWow64\tabctl32.dep [2010.03.06 13:55:40 | 000,002,494 | ---- | C] () -- C:\Windows\SysWow64\mscomct2.dep [2010.03.06 13:55:40 | 000,000,331 | ---- | C] () -- C:\Windows\SysWow64\ccrpTmr6.dep [2010.03.05 20:27:19 | 000,001,272 | ---- | C] () -- C:\Users\Besitzer\Desktop\Snipping Tool.lnk [2010.03.05 18:02:44 | 000,001,892 | ---- | C] () -- C:\Users\Besitzer\Desktop\Call of Duty Modern Warfare 2.lnk [2010.03.05 18:02:44 | 000,001,892 | ---- | C] () -- C:\Users\Besitzer\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.lnk [2010.03.05 17:50:37 | 000,000,994 | ---- | C] () -- C:\Users\Besitzer\Desktop\Cheat Engine.lnk [2010.03.05 17:50:35 | 001,970,176 | ---- | C] () -- C:\Windows\SysWow64\d3dx9.dll [2010.03.05 16:29:10 | 000,002,539 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2010.03.05 00:37:30 | 000,000,626 | ---- | C] () -- C:\Users\Besitzer\Desktop\Hänger.lnk [2010.03.04 23:38:04 | 000,000,214 | ---- | C] () -- C:\Users\Besitzer\Desktop\DiRT2 Demo.lnk [2010.03.04 23:10:27 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010.03.04 23:10:22 | 000,183,112 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.03.04 23:07:35 | 000,002,097 | ---- | C] () -- C:\Users\Besitzer\Desktop\Need for Speed™ Undercover.lnk [2010.03.04 22:39:52 | 000,001,154 | ---- | C] () -- C:\Users\Besitzer\Desktop\OpenOffice.lnk [2010.03.04 22:15:29 | 000,002,295 | ---- | C] () -- C:\Users\Besitzer\Desktop\Google Earth.lnk [2010.03.04 22:07:21 | 000,001,236 | ---- | C] () -- C:\Users\Besitzer\Desktop\Ashampoo Burning Studio 2010.lnk [2010.03.04 22:05:41 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.03.04 22:05:40 | 000,001,108 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.03.04 20:54:10 | 000,001,242 | ---- | C] () -- C:\Users\Besitzer\Desktop\Paint.lnk [2010.03.04 20:38:23 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo [2010.03.04 20:20:21 | 000,001,968 | ---- | C] () -- C:\Users\Besitzer\Desktop\Mozilla Firefox.lnk [2010.03.04 20:14:57 | 000,007,045 | R--- | C] () -- C:\Windows\instwcli.inf [2010.02.27 11:51:25 | 000,000,020 | -HS- | C] () -- C:\Users\Besitzer\ntuser.ini [2010.02.27 11:51:24 | 005,767,168 | -HS- | C] () -- C:\Users\Besitzer\NTUSER.DAT [2010.02.27 11:51:24 | 000,524,288 | -HS- | C] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2010.02.27 11:51:24 | 000,524,288 | -HS- | C] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2010.02.27 11:51:24 | 000,262,144 | -HS- | C] () -- C:\Users\Besitzer\ntuser.dat.LOG1 [2010.02.27 11:51:24 | 000,065,536 | -HS- | C] () -- C:\Users\Besitzer\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2010.02.27 11:51:24 | 000,000,000 | -HS- | C] () -- C:\Users\Besitzer\ntuser.dat.LOG2 [2010.02.26 17:36:06 | 000,000,020 | ---- | C] () -- C:\Windows\è÷Ï [2010.02.26 15:23:57 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.02.26 15:18:21 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.02.26 15:14:06 | 3220,676,608 | -HS- | C] () -- C:\hiberfil.sys [2010.02.03 06:19:16 | 000,031,240 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb [2010.02.03 05:40:52 | 000,491,104 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap [2010.02.03 05:36:48 | 000,491,104 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap [2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll ========== LOP Check ========== [2010.03.04 22:07:42 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\Ashampoo [2010.03.21 03:06:49 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\Bump Technologies, Inc [2010.03.04 21:57:34 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\Foxit [2010.03.04 23:07:44 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\Leadertech [2010.03.14 17:13:08 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\OpenOffice.org [2010.03.17 19:06:06 | 000,000,000 | ---D | M] -- C:\Users\Besitzer\AppData\Roaming\Windows Live Writer [2010.04.04 13:48:58 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTORV.SYS > [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > ========== Alternate Data Streams ========== @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:66B13F37 @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:6152D44C < End of report > |
Deinstalliere bitte ASK Toolbar ( oder ähnlich ) Scan mit SystemLook Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
|
Hat nicht viel gebracht. Hier das Ergebnis: SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 19:02 on 04/04/2010 by Besitzer (Administrator - Elevation successful) ========== filefind ========== Searching for "sshnas21*" No files found. ========== regfind ========== Searching for "sshnas21" No data found. -=End Of File=- |
Die meldung immer noch vorhanden ? Starte bitte Malwarebytes, klicke auf update und lass es erneut scannen. poste mir die erhaltene Logfile |
Ich habs geupdates und schon hat das Programm 4 Trojaner gefunden. Danke erstmal, ich werd jetzt neustarten und mal sehen. |
geil, geil, danke man. Es ist weg. Durch ein simples Update. thx :daumenhoc |
Log von malwarebytes bitte schritt 2 Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
schritt 3 Starte bitte OTL.exe und klicke auf den Quick Scan Button. |
häh? Ich habs doch jetzt geschafft!? |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 09:46 Uhr. |
Copyright ©2000-2025, Trojaner-Board