|
Trojaner TR/Dropper.Gen in C:\\windows\system32\sdra64.exe - was muss ich tun? Hallo! Auch ich bin Opfer des Trojaners Dropper.Gen geworden... :( Ich habe es über mein Vireprogramm "AntiVir" in Quarantäne verschoben, aber nichts scheint zu helfen. Die Warnmeldung kommt immer wieder! Ich bin was die Entfernung von Trojanern angeht total unerfahren! Weiß also überhaupt nicht was ich machen muss. Muss zugeben, dass ich das Problem ein paar Wochen ignoriert hab und hoffe dass daraus jetzt kein größerer Schaden entstanden ist. Würd mich freuen, wenn mir jemand helfen könnte! :) Hier ist übrigens die Logfile von HijackThis. Hab mitgekriegt, dass das alle mit dem gleichen Problem posten... Danke schon mal! MfG, Helli Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:06:55, on 19.04.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SVCHOST.EXE C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\Explorer.EXE C:\Acer\Empowering Technology\admServ.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Programme\Synaptics\SynTP\SynTPLpr.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\QuickTime\qttask.exe C:\Program Files\Acer\Acer Arcade\PCMService.exe C:\Programme\Launch Manager\LaunchAp.exe C:\Programme\Launch Manager\PowerKey.exe C:\Programme\Launch Manager\HotkeyApp.exe C:\Programme\Launch Manager\OSDCtrl.exe C:\Programme\Launch Manager\Wbutton.exe C:\acer\Empowering Technology\ePower\epm-dm.exe C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\Acer\Empowering Technology\admtray.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Programme\Lexmark 3400 Series\lxcymon.exe C:\Programme\Lexmark 3400 Series\ezprint.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\Logitech\Logitech WebCam Software\LWS.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe C:\Programme\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\lxcycoms.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Helena Tsiflidis\Eigene Dateien\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe, O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - (no file) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: (no name) - {D032570A-5F63-4812-A094-87D007C23012} - C:\WINDOWS\system32\iebho19.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - (no file) O3 - Toolbar: Acer eDataSecurity Management - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll O3 - Toolbar: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - (no file) O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll (file missing) O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe" O4 - HKLM\..\Run: [LaunchAp] "C:\Programme\Launch Manager\LaunchAp.exe" O4 - HKLM\..\Run: [PowerKey] "C:\Programme\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] "C:\Programme\Launch Manager\HotkeyApp.exe" O4 - HKLM\..\Run: [CtrlVol] "C:\Programme\Launch Manager\CtrlVol.exe" O4 - HKLM\..\Run: [LMgrOSD] "C:\Programme\Launch Manager\OSDCtrl.exe" O4 - HKLM\..\Run: [Wbutton] "C:\Programme\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [lxcymon.exe] "C:\Programme\Lexmark 3400 Series\lxcymon.exe" O4 - HKLM\..\Run: [EzPrint] "C:\Programme\Lexmark 3400 Series\ezprint.exe" O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\Logitech WebCam Software\LWS.exe" /hide O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Phoenix Backup] C:\PROGRA~1\SYDATEC\PHOENI~1\pbtray.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user') O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Geräteerkennung) - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - hxxp://www.adobe.com/products/acrobat/nos/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: Google Update Service (gupdate1c9f2af3026b914) (gupdate1c9f2af3026b914) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe |
Hi und :hallo: ! Damit ich eine bessere Einsicht in Dein System bekomme, bitte folgende Schritte abarbeiten: 1.) Malwarebytes' Anti-Malware
2.) Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
Poste mir dann bitte: - Malwarebytes-Logfile - OTL.txt - Extras.txt |
Hallo nochmal, hier ist zunächst die Logdatei von Malwarebytes' Anti-Malware: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 4007 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 19.04.2010 21:26:29 mbam-log-2010-04-19 (21-26-29).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 114273 Laufzeit: 8 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 9 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 5 Infizierte Verzeichnisse: 1 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{d032570a-5f63-4812-a094-87d007c23012} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d032570a-5f63-4812-a094-87d007c23012} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d032570a-5f63-4812-a094-87d007c23012} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot. Infizierte Dateien: C:\WINDOWS\Temp\4EA.tmp (Trojan.Dropper) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot. C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot. C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot. Der Rest kommt gleich! |
Hier ist der Rest: 1) OTL.Txt OTL logfile created on: 19.04.2010 21:38:12 - Run 1 OTL by OldTimer - Version 3.2.1.3 Folder = C:\Dokumente und Einstellungen\***\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free 3,00 Gb Paging File | 2,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 25,76 Gb Total Space | 1,77 Gb Free Space | 6,87% Space Free | Partition Type: FAT32 Drive D: | 26,97 Gb Total Space | 20,55 Gb Free Space | 76,18% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ACER-A9CE03BBC6 Current User Name: *** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Programme\Logitech\Logitech WebCam Software\LWS.exe () PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe () PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\lxcycoms.exe ( ) PRC - C:\Programme\Lexmark 3400 Series\ezprint.exe (Lexmark International Inc.) PRC - C:\Programme\Lexmark 3400 Series\lxcymon.exe () PRC - C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.) PRC - C:\Acer\Empowering Technology\ePower\epm-dm.exe (Acer Inc) PRC - C:\Programme\Launch Manager\HotkeyApp.exe (Wistron) PRC - C:\Programme\Launch Manager\WButton.exe () PRC - C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.) PRC - C:\Acer\Empowering Technology\admServ.exe (Avocent Inc.) PRC - C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.) PRC - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe (Cyberlink) PRC - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink) PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe () PRC - C:\Programme\Launch Manager\LaunchAp.exe () PRC - C:\Programme\Launch Manager\OSDCtrl.exe () PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) PRC - C:\Programme\Launch Manager\Powerkey.exe () ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\sysenv.dll (HiTRUST) MOD - C:\WINDOWS\system32\MSNChatHook.dll () MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.) MOD - C:\WINDOWS\system32\MFC71u.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\MFC71DEU.DLL (Microsoft Corporation) MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Adobe LM Service) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems) SRV - (lxcy_device) -- C:\WINDOWS\System32\lxcycoms.exe ( ) SRV - (AWService) -- C:\Acer\Empowering Technology\admServ.exe (Avocent Inc.) SRV - (CLSched) CyberLink Task Scheduler (CTS) -- C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe () SRV - (CyberLink Media Library Service) -- C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys () DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys () DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (PID_0928) Logitech QuickCam Express(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Logitech Inc.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation) DRV - (NSCIRDA) -- C:\WINDOWS\system32\drivers\nscirda.sys (National Semiconductor Corporation) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation) DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.) DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV - (OsaFsLoc) -- C:\WINDOWS\system32\drivers\OsaFsLoc.sys (OSA Technologies) DRV - (NdisFilt) -- C:\WINDOWS\system32\drivers\NdisFilt.sys (OSA Technologies) DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company) DRV - (NETMNT) -- C:\WINDOWS\system32\drivers\NETMNT.sys () DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.) DRV - (EpmShd) -- C:\WINDOWS\system32\drivers\epm-shd.sys (Acer Value Labs, USA) DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider) DRV - (int15.sys) -- C:\Acer\Empowering Technology\eRecovery\int15.sys () DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation ) DRV - (PCANDIS5) -- C:\WINDOWS\system32\PCANDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation) DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation) DRV - (EpmPsd) -- C:\WINDOWS\system32\drivers\epm-psd.sys (Acer Value Labs, USA) DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (Hotkey) -- C:\WINDOWS\system32\drivers\HOTKEY.sys () DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (POWERKEY) -- C:\Programme\Launch Manager\POWERKEY.SYS () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.03.26 14:45:36 | 000,000,000 | ---D | M] [2007.11.26 10:33:12 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2006.09.26 12:03:14 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll O1 HOSTS File: ([2004.08.04 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - File not found O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - File not found O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll (HiTRUST) O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - File not found O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll File not found O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll (HiTRUST) O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\ToolBand.dll (HiTRUST) O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - File not found O4 - HKLM..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe (Acer Value Labs, Taiwan) O4 - HKLM..\Run: [ADMTray.exe] C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CtrlVol] C:\Programme\Launch Manager\CtrlVol.exe (Wistron) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe () O4 - HKLM..\Run: [EPM-DM] c:\Acer\Empowering Technology\ePower\epm-dm.exe (Acer Inc) O4 - HKLM..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.) O4 - HKLM..\Run: [EzPrint] C:\Programme\Lexmark 3400 Series\ezprint.exe (Lexmark International Inc.) O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation) O4 - HKLM..\Run: [LaunchAp] C:\Programme\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [LMgrOSD] C:\Programme\Launch Manager\OSDCtrl.exe () O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\Logitech WebCam Software\LWS.exe () O4 - HKLM..\Run: [LXCYCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.DLL () O4 - HKLM..\Run: [lxcymon.exe] C:\Programme\Lexmark 3400 Series\lxcymon.exe () O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe () O4 - HKLM..\Run: [PCMService] C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [PowerKey] C:\Programme\Launch Manager\PowerKey.exe () O4 - HKLM..\Run: [preload] C:\WINDOWS\RUNXMLPL.EXE (Wistron) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Wbutton] C:\Programme\Launch Manager\Wbutton.exe () O4 - HKCU..\Run: [Phoenix Backup] C:\PROGRA~1\SYDATEC\PHOENI~1\pbtray.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0 O8 - Extra context menu item: &Sample Toolband Serach - C:\WINDOWS\System32\ToolBand.dll (HiTRUST) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.186.33 83.169.186.97 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe () O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2c58885e-9616-11dc-ac9e-0016ce2c743e}\Shell\AutoRun\command - "" = C:\WINDOWS\explorer.exe -- [2008.04.14 04:22:46 | 001,036,800 | ---- | M] (Microsoft Corporation) O33 - MountPoints2\{2c58885e-9616-11dc-ac9e-0016ce2c743e}\Shell\explore\Command - "" = C:\WINDOWS\explorer.exe -- [2008.04.14 04:22:46 | 001,036,800 | ---- | M] (Microsoft Corporation) O33 - MountPoints2\{2c58885e-9616-11dc-ac9e-0016ce2c743e}\Shell\open\Command - "" = C:\WINDOWS\explorer.exe -- [2008.04.14 04:22:46 | 001,036,800 | ---- | M] (Microsoft Corporation) O33 - MountPoints2\{4e85f26a-fbde-11de-b2bb-0016ce2c743e}\Shell\AutoRun\command - "" = F:\Toshiba\more4you.exe -- File not found O33 - MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\Shell\explore\Command - "" = boot.exe O33 - MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\Shell\open\Command - "" = boot.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.19 21:35:15 | 000,562,176 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe [2010.04.19 21:14:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes [2010.04.19 21:14:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.04.19 21:14:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.04.19 21:14:17 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.04.19 21:14:17 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.04.19 21:13:28 | 005,918,720 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Helena Tsiflidis\Eigene Dateien\mbam-setup-1.45.exe [2010.04.19 20:06:18 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\***\Eigene Dateien\HiJackThis.exe [2010.04.17 16:14:44 | 000,000,000 | ---D | C] -- C:\Programme\CDex [2010.04.17 16:13:54 | 008,697,544 | ---- | C] (Georgy Berdyshev) -- C:\Dokumente und Einstellungen\***\Eigene Dateien\CDex-win32-1.70-b4-2009.exe [2010.04.09 16:26:49 | 000,000,000 | ---D | C] -- C:\Programme\CamStudio [2010.03.31 12:56:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2010.03.26 14:46:04 | 000,000,000 | ---D | C] -- C:\My Music [2010.03.26 14:44:59 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\xing shared [2010.03.18 12:15:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Temp [2010.02.25 15:10:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Temp [2009.06.22 12:29:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google [2009.05.22 11:31:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe [2007.04.15 11:39:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia [2007.01.25 11:50:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google [2007.01.25 11:50:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Google [2007.01.04 16:34:19 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyinpa.dll [2007.01.04 16:34:19 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyiesc.dll [2007.01.04 16:31:21 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyserv.dll [2007.01.04 16:31:21 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyusb1.dll [2007.01.04 16:31:20 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcylmpm.dll [2007.01.04 16:31:20 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyprox.dll [2007.01.04 16:31:20 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcypplc.dll [2007.01.04 16:31:18 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcyhbn3.dll [2007.01.04 16:31:18 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycomm.dll [2007.01.04 16:31:17 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcycomc.dll [2004.09.13 12:37:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft [2004.09.13 12:37:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft [2004.09.13 12:24:52 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Microsoft [2004.09.13 12:24:52 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Microsoft [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.04.19 21:38:20 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1802197209-1933737886-4094737418-1005.job [2010.04.19 21:38:20 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1802197209-1933737886-4094737418-1005.job [2010.04.19 21:35:24 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe [2010.04.19 21:32:02 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.04.19 21:31:38 | 000,000,451 | ---- | M] () -- C:\WINDOWS\System32\eRLog.ini [2010.04.19 21:31:04 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.04.19 21:30:58 | 000,000,097 | ---- | M] () -- C:\WINDOWS\ComponentList.xml [2010.04.19 21:30:46 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.04.19 21:30:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.04.19 21:30:40 | 2137,509,888 | -HS- | M] () -- C:\hiberfil.sys [2010.04.19 21:29:24 | 008,388,608 | -H-- | M] () -- C:\Dokumente und Einstellungen\***\NTUSER.DAT [2010.04.19 21:29:24 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini [2010.04.19 21:20:02 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.04.19 21:13:44 | 005,918,720 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Helena Tsiflidis\Eigene Dateien\mbam-setup-1.45.exe [2010.04.19 20:06:20 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\***\Eigene Dateien\HiJackThis.exe [2010.04.17 16:20:28 | 000,006,144 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.04.17 16:13:56 | 008,697,544 | ---- | M] (Georgy Berdyshev) -- C:\Dokumente und Einstellungen\***\Eigene Dateien\CDex-win32-1.70-b4-2009.exe [2010.04.17 15:56:32 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2010.04.17 15:44:38 | 000,073,797 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MDR-Volo.pdf [2010.04.14 00:47:16 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010.04.09 16:26:56 | 000,000,569 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CamStudio.lnk [2010.04.09 16:26:34 | 001,364,995 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\CamStudio20.exe [2010.04.06 14:42:26 | 000,001,617 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk [2010.03.30 20:09:50 | 000,001,037 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MA-Aufgaben.rtf [2010.03.29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.03.29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.03.28 19:29:32 | 000,226,408 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.03.27 17:34:34 | 005,331,372 | -H-- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2010.03.26 14:45:26 | 000,185,920 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll [2010.03.26 14:45:12 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll [2010.03.26 14:45:12 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll [2010.03.26 14:44:30 | 000,499,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll [2010.03.26 14:44:30 | 000,278,528 | ---- | M] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.04.17 15:44:36 | 000,073,797 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MDR-Volo.pdf [2010.04.09 16:26:55 | 000,000,569 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CamStudio.lnk [2010.04.09 16:26:30 | 001,364,995 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\CamStudio20.exe [2010.04.06 14:42:25 | 000,001,617 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 8.lnk [2010.03.30 20:09:48 | 000,001,037 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MA-Aufgaben.rtf [2010.03.26 14:45:36 | 000,000,300 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1802197209-1933737886-4094737418-1005.job [2010.03.26 14:45:36 | 000,000,292 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1802197209-1933737886-4094737418-1005.job [2010.02.02 23:30:59 | 000,006,144 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.01.07 23:53:58 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009.11.26 00:55:20 | 000,000,063 | ---- | C] () -- C:\Dokumente und Einstellungen\***\jagex_runescape_preferences2.dat [2009.11.15 00:22:09 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI [2009.10.27 20:42:50 | 000,003,690 | ---- | C] () -- C:\Dokumente und Einstellungen\***\.jmf-resource [2009.10.25 20:22:14 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\advd.dll [2009.10.25 20:22:14 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\auth.dll [2009.10.07 01:46:36 | 000,025,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2009.10.07 01:23:08 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll [2009.08.28 17:36:35 | 000,000,038 | ---- | C] () -- C:\Dokumente und Einstellungen\***\jagex_runescape_preferences.dat [2009.06.20 21:04:18 | 000,082,289 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2008.11.19 00:15:26 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2008.10.29 17:08:50 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll [2008.03.06 13:06:57 | 000,000,032 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat [2008.01.26 19:13:24 | 000,005,655 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Z [2008.01.25 18:33:31 | 000,000,012 | ---- | C] () -- C:\WINDOWS\SetDSL.ini [2008.01.25 18:19:52 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll [2007.09.13 02:24:36 | 000,000,172 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2007.06.08 14:39:10 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll [2007.06.03 21:09:14 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini [2007.02.17 17:59:08 | 000,000,174 | ---- | C] () -- C:\WINDOWS\Tcsofla.INI [2007.02.07 17:07:31 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2007.02.07 17:07:31 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\MP2enc.dll [2007.01.04 16:34:21 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcyvs.dll [2007.01.04 16:34:18 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\lxcycoin.dll [2007.01.04 16:33:52 | 000,684,032 | ---- | C] () -- C:\WINDOWS\System32\lxcydrs.dll [2007.01.04 16:33:52 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcycaps.dll [2007.01.04 16:33:51 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcycnv4.dll [2007.01.04 16:31:22 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lxcyinst.dll [2006.12.15 15:53:34 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll [2006.12.15 15:53:34 | 000,000,342 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll [2006.12.15 15:50:27 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll [2006.12.15 15:50:27 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll [2006.12.15 15:50:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll [2006.12.15 15:50:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll [2006.12.15 15:50:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll [2006.12.15 15:50:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll [2006.09.07 19:30:46 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.09.07 19:15:39 | 000,000,116 | ---- | C] () -- C:\Dokumente und Einstellungen\***\LuResult.txt [2006.06.16 16:33:00 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI [2006.05.26 17:58:12 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.05.26 17:31:43 | 000,822,784 | ---- | C] () -- C:\WINDOWS\System32\UIVCL.dll [2006.05.26 17:31:43 | 000,152,576 | ---- | C] () -- C:\WINDOWS\System32\CryptoAPI.dll [2006.05.26 17:31:43 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Outlook Addin.dll [2006.05.26 17:31:43 | 000,082,432 | ---- | C] () -- C:\WINDOWS\System32\keyManager.dll [2006.05.26 17:31:43 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\LogSPWusage.dll [2006.05.26 17:31:43 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\APISlice.dll [2006.05.26 17:31:43 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\SC_res.dll [2006.05.26 17:31:43 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EN_res.dll [2006.05.26 17:31:43 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\TC_res.dll [2006.05.26 17:31:43 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\MSNChatHook.dll [2006.05.26 17:30:53 | 000,000,451 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini [2006.05.26 17:28:02 | 000,009,867 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys [2006.05.26 17:24:51 | 000,007,600 | ---- | C] () -- C:\Dokumente und Einstellungen\***\launApp.log [2006.05.26 17:24:51 | 000,000,348 | ---- | C] () -- C:\Dokumente und Einstellungen\***\results.txt [2006.05.26 17:24:49 | 008,388,608 | -H-- | C] () -- C:\Dokumente und Einstellungen\***\NTUSER.DAT [2006.05.26 17:24:49 | 000,001,024 | -H-- | C] () -- C:\Dokumente und Einstellungen\***\ntuser.dat.LOG [2006.05.26 17:24:49 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\***\ntuser.ini [2006.05.26 17:24:05 | 000,262,144 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\NTUSER.DAT [2006.05.26 17:24:05 | 000,001,024 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\NTUSER.DAT.LOG [2006.05.26 11:41:46 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2005.12.06 10:51:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll [2005.12.06 10:50:50 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll [2005.12.06 10:50:50 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll [2005.12.06 10:50:50 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll [2005.12.06 10:50:50 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll [2005.07.05 08:09:06 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005.05.02 12:13:42 | 000,009,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\NETMNT.sys [2005.01.21 11:48:06 | 000,225,280 | ---- | C] () -- C:\WINDOWS\Capsule.dll [2004.09.07 14:23:16 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2003.12.29 20:45:08 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ServiceControl.dll [2003.11.24 15:55:48 | 000,743,424 | ---- | C] () -- C:\WINDOWS\libxml2.dll [2003.11.24 15:55:32 | 000,872,448 | ---- | C] () -- C:\WINDOWS\iconv.dll [2003.07.21 16:52:40 | 000,001,150 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2001.12.26 16:12:30 | 000,065,536 | R--- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll [2001.09.03 23:46:38 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Hmpg12.dll [2001.07.30 16:33:56 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll [2001.07.23 22:04:36 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll < End of report > 2) Extras.Txt OTL Extras logfile created on: 19.04.2010 21:38:12 - Run 1 OTL by OldTimer - Version 3.2.1.3 Folder = C:\Dokumente und Einstellungen\***\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free 3,00 Gb Paging File | 2,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 25,76 Gb Total Space | 1,77 Gb Free Space | 6,87% Space Free | Partition Type: FAT32 Drive D: | 26,97 Gb Total Space | 20,55 Gb Free Space | 76,18% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ACER-A9CE03BBC6 Current User Name: *** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found "C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Enabled:AOL -- File not found "C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 -- File not found "C:\Programme\concept design\onlineTV 5\onlineTV.exe" = C:\Programme\concept design\onlineTV 5\onlineTV.exe:*:Enabled:onlineTV -- File not found [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Acer\Acer Arcade\PCMService.exe" = C:\Program Files\Acer\Acer Arcade\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.) "C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Disabled:AOL -- File not found "C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Disabled:AOL -- File not found "C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Disabled:AOL 9.0 -- File not found "C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- File not found "C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.) "D:\Games\Anno 1701\Anno1701.exe" = D:\Games\Anno 1701\Anno1701.exe:*:Disabled:Anno 1701 -- File not found "C:\Programme\concept design\onlineTV 5\onlineTV.exe" = C:\Programme\concept design\onlineTV 5\onlineTV.exe:*:Enabled:onlineTV -- File not found "G:\Anno1404\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe" = G:\Anno1404\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe:*:Enabled:Anno4Web -- File not found "D:\Civilization4.exe" = D:\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 Complete -- (Firaxis Games) "D:\Warlords\Civ4Warlords.exe" = D:\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4: Warlords -- (Firaxis Games) "D:\Beyond the Sword\Civ4BeyondSword.exe" = D:\Beyond the Sword\Civ4BeyondSword.exe:*:Enabled:Sid Meier's Civilization 4: Beyond the Sword -- (Firaxis Games) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{03440014-3975-4267-9F39-1DC4745090B7}" = Microsoft Encarta Enzyklopädie 2003 "{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste "{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework "{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade "{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17 "{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = modem ADSL USB "{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management "{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3 "{B136F351-BF1E-4948-9557-FA6524302ACA}" = SPSS 14.0 für Windows "{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software "{C4BEEB8C-B9D2-4CD9-A2AA-1F3A1F57DF21}" = Works Suite-Betriebssystem-Pack "{CBB25040-2D43-4868-930C-F08B812F2BF8}" = Acer eDataSecurity Management "{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.0.9.3 "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management "{E431C518-2EE2-471E-9234-BE995C36D513}" = Acer eDataSecurity Management 1.00.21 "{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 "{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0 "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe SVG Viewer" = Adobe SVG Viewer 3.0 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "CamStudio" = CamStudio "CDex" = CDex - Open Source Digital Audio CD Extractor "ePresentation" = Acer ePresentation Management "getPlus(R)_ocx" = getPlus(R)_ocx "GridVista" = Acer GridVista "HijackThis" = HijackThis 2.0.2 "ie8" = Windows Internet Explorer 8 "InstallShield_{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework "InstallShield_{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management "InstallShield_{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management "legacyqcam_10.51" = Logitech Legacy USB Camera-Treiberpaket "Lexmark 3400 Series" = Lexmark 3400 Series "lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "QuickTime" = QuickTime "RealPlayer 12.0" = RealPlayer "SecureW2 TTLS Client" = SecureW2 TTLS Client 3.3.3 for Windows "Shockwave" = Shockwave "SynTPDeinstKey" = Synaptics Pointing Device Driver "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Works2003Setup" = Microsoft Works 2003-Setup-Start "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 19.04.2010 11:32:44 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:45 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:45 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:46 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:46 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:47 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:47 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:48 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 11:32:48 | Computer Name = ACER-A9CE03BBC6 | Source = SecureW2 | ID = 703 Description = Error - 19.04.2010 13:16:53 | Computer Name = ACER-A9CE03BBC6 | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. [ System Events ] Error - 19.04.2010 15:02:53 | Computer Name = ACER-A9CE03BBC6 | Source = DCOM | ID = 10005 Description = Bei DCOM ist der Fehler "%1075" aufgetreten, als der Dienst "CLSched" mit den Argumenten "-Service" gestartet wurde, um den folgenden Server zu verwenden: {C4F585BE-012A-4F2D-9C27-B55897FC3DCE} Error - 19.04.2010 15:02:53 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7003 Description = Der Dienst "CyberLink Task Scheduler (CTS)" ist von folgendem, nicht vorhandenem Dienst abhängig: CLCapSvc Error - 19.04.2010 15:03:01 | Computer Name = ACER-A9CE03BBC6 | Source = DCOM | ID = 10005 Description = Bei DCOM ist der Fehler "%1053" aufgetreten, als der Dienst "lxcy_device" mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {323CE21C-A448-40AA-BA74-7FCF1E44105A} Error - 19.04.2010 15:03:02 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7009 Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst lxcy_device. Error - 19.04.2010 15:03:02 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7000 Description = Der Dienst "lxcy_device" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 19.04.2010 15:31:07 | Computer Name = ACER-A9CE03BBC6 | Source = sr | ID = 1 Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume2" ist im Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung wurde angehalten. Error - 19.04.2010 15:31:19 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7003 Description = Der Dienst "CyberLink Task Scheduler (CTS)" ist von folgendem, nicht vorhandenem Dienst abhängig: CLCapSvc Error - 19.04.2010 15:31:26 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7026 Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o gagp30kx hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde Error - 19.04.2010 15:31:31 | Computer Name = ACER-A9CE03BBC6 | Source = Service Control Manager | ID = 7003 Description = Der Dienst "CyberLink Task Scheduler (CTS)" ist von folgendem, nicht vorhandenem Dienst abhängig: CLCapSvc Error - 19.04.2010 15:31:31 | Computer Name = ACER-A9CE03BBC6 | Source = DCOM | ID = 10005 Description = Bei DCOM ist der Fehler "%1075" aufgetreten, als der Dienst "CLSched" mit den Argumenten "-Service" gestartet wurde, um den folgenden Server zu verwenden: {C4F585BE-012A-4F2D-9C27-B55897FC3DCE} < End of report > Ich hoffe daraus wird das Problem ersichtlich! Danke schon mal! VG, Helli |
==================== Backdoor-Warnung Dein System ist mit einem sog. Backdoor infiziert. Ein Backdoor infiziert das System über eine Hintertür, um es zu schädigen und die komplette Kontrolle darüber zu erlangen. Oft bringt er auch Schädlinge mit sich, welche Tastatur-Eingaben (u.a. Passwörter) mitloggen, Programme starten, oder sogar sehen können, was auf Deinem Bildschirm passiert. Ein Neuaufsetzen des Systems ist daher die schnellste und auch sicherste Variante. Solltest Du trotzdem bereinigen wollen, führe bitte die unten genannten Schritte aus. Sei Dir außerdem bewusst: Backdoors können sämtliche von Dir verwendete Passwörter - z.B. bei E-Mail, Online-Banking, eBay, etc. - durch mitloggen aller Tastatur-Eingaben ausspionieren und somit missbrauchen. => siehe hier im Malwarebytes-Log: (Stolen.data) Ändere daher bitte von einem sauberen Rechner aus alle Deine Passwörter . ==================== Malwarebytes hat schon den Großteil der Schädlinge entfernt. Dateiauswertung bei VirusTotal
|
Hallo, erstmal sehr vielen Dank für die Hilfe! Klingt ganz schön schlimm! Werd sofort meine Passwörter ändern... Wie kommt sowas auf meinen PC? Das Neuaufsetzen des Systems ist wohl die beste Möglichkeit um das wieder los zu werden... Hier trotzdem nochmal die Dateiauswertung von VirusTotal: 1) hxxp://www.virustotal.com/de/analisis/a6322c6f5bd745287666c045c3bff2861461a1752c50a2869f343d46f97fda82-1271708575 2) hxxp://www.virustotal.com/de/analisis/b26276ee87b6806c9bf4f453c44f2abf675dad19b67688df5d432d159184db97-1271708474 |
Hi, wie gesagt, es liegt bei dir... Wenn du weiter bereinigen willst: Bitte einen Rootkitscan mit GMER machen. |
Hallo nochmal, ich versuchs mal zuerst mit ner Bereinigung! Falls das nicht klappt, kann ich das System immer noch neu aufsetzen.... Dann mach ich mal diesen Rootkitscan. Gruß, Helli |
Hi, das kam bei dem Scan raus: GMER 1.0.15.15281 - hxxp://www.gmer.net Rootkit scan 2010-04-20 21:38:15 Windows 5.1.2600 Service Pack 3 Running: gzlpgcvz.exe; Driver: C:\DOKUME~1\HELENA~1\LOKALE~1\Temp\uwdoafoc.sys ---- System - GMER 1.0.15 ---- SSDT BA3145A6 ZwCreateKey SSDT BA31459C ZwCreateThread SSDT BA3145AB ZwDeleteKey SSDT BA3145B5 ZwDeleteValueKey SSDT spyq.sys ZwEnumerateKey [0xBA6CDDA4] SSDT spyq.sys ZwEnumerateValueKey [0xBA6CE132] SSDT BA3145BA ZwLoadKey SSDT spyq.sys ZwOpenKey [0xBA6B50C0] SSDT BA314588 ZwOpenProcess SSDT BA31458D ZwOpenThread SSDT spyq.sys ZwQueryKey [0xBA6CE20A] SSDT spyq.sys ZwQueryValueKey [0xBA6CE08A] SSDT BA3145C4 ZwReplaceKey SSDT BA3145BF ZwRestoreKey SSDT BA3145B0 ZwSetValueKey SSDT BA314597 ZwTerminateProcess INT 0x62 ? 8A5FFBF8 INT 0x74 ? 8A0D4BF8 INT 0x84 ? 8A0D4BF8 INT 0x94 ? 8A0D4BF8 INT 0xB4 ? 8A0D4BF8 ---- Kernel code sections - GMER 1.0.15 ---- ? spyq.sys Das System kann die angegebene Datei nicht finden. ! .text USBPORT.SYS!DllUnload BA1F18AC 5 Bytes JMP 8A0D41D8 ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6B6042] spyq.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6B613E] spyq.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6B60C0] spyq.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6B6800] spyq.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6B66D6] spyq.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6C5B90] spyq.sys ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Programme\Logitech\Logitech WebCam Software\LWS.exe[1364] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00F32F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Logitech\Logitech WebCam Software\LWS.exe[1364] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00F32C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Logitech\Logitech WebCam Software\LWS.exe[1364] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00F32CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Logitech\Logitech WebCam Software\LWS.exe[1364] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00F32CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Skype\Phone\Skype.exe[1808] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [025B2F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Skype\Phone\Skype.exe[1808] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [025B2C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Skype\Phone\Skype.exe[1808] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [025B2CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Programme\Skype\Phone\Skype.exe[1808] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [025B2CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[2352] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C62F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[2352] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C62C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[2352] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C62CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\WINDOWS\Explorer.EXE[2352] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C62CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Fastfat \FatCdrom 8A57F1F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{C9318D64-9DF3-4C4E-9FD1-003F48EE5292} 8A0E8500 AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\usbuhci \Device\USBPDO-0 8A1B1500 Device \Driver\usbuhci \Device\USBPDO-1 8A1B1500 Device \Driver\usbuhci \Device\USBPDO-2 8A1B1500 Device \Driver\usbehci \Device\USBPDO-3 8A2EB500 Device \Driver\usbuhci \Device\USBPDO-4 8A1B1500 Device \Driver\Ftdisk \Device\HarddiskVolume1 8A6001F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8A6001F8 Device \Driver\Cdrom \Device\CdRom0 OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies) Device \Driver\Cdrom \Device\CdRom0 8A2FE500 Device \Driver\Ftdisk \Device\HarddiskVolume3 8A6001F8 Device \Driver\atapi \Device\Ide\IdePort0 [BA610B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 [BA610B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c [BA610B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\NetBT \Device\NetBt_Wins_Export 8A0E8500 Device \Driver\NetBT \Device\NetbiosSmb 8A0E8500 Device \Driver\NetBT \Device\NetBT_Tcpip_{9A147AE5-B926-4E40-AA42-943B928D5545} 8A0E8500 Device \Driver\usbuhci \Device\USBFDO-0 8A1B1500 Device \Driver\usbuhci \Device\USBFDO-1 8A1B1500 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A175500 Device \Driver\usbuhci \Device\USBFDO-2 8A1B1500 Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A175500 Device \Driver\usbuhci \Device\USBFDO-3 8A1B1500 Device \Driver\Ftdisk \Device\FtControl 8A6001F8 Device \Driver\usbehci \Device\USBFDO-4 8A2EB500 Device \FileSystem\Fastfat \Fat 8A57F1F8 AttachedDevice \FileSystem\Fastfat \Fat OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies) AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs 8A11A500 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x28 0xC0 0x0C 0xEB ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x28 0xC0 0x0C 0xEB ... ---- EOF - GMER 1.0.15 ---- |
Hi, jepp, sieht gut aus, da hast nochmal Glück gehabt. :) Sagen dir diese Mountpoints was - bzw. kennst du diese Dateien? O33 - MountPoints2\{4e85f26a-fbde-11de-b2bb-0016ce2c743e}\Shell\AutoRun\command - "" = F:\Toshiba\more4you.exe -- File not found O33 - MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\Shell\explore\Command - "" = boot.exe O33 - MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\Shell\open\Command - "" = boot.exe |
Hallo, nee die Dateien kenne ich nicht! Bei der ersten wundert mich das Toshiba. Wir haben in unserer WG nen Fernseher von der Marke und mein Laptop war da mal angeschlossen, aber hat das irgendwas zu bedeuten? VG, Helli |
Hallo, lade mal bitte folgende Datei noch bei Virustotal hoch, damit ich weiß ob was schädliches dahintersteckt: C:\WINDOWS\system32\ToolBand.dll |
Hi, das sagt Virustotal: hxxp://www.virustotal.com/de/analisis/2c1f64f86ed4e22e4b39efbd36642c9011abfe26afb185c38410045fbe956b61-1272209401 Mfg, Helli |
Hi, gut, dann lassen wir ihn mal weiterleben :) Fixen mit OTL
Code: :OTL
Danach bitte Malwarebytes starten, Signaturen updaten (derzeit Datenbank Version 4034), und einen VollScan durchführen. |
Hallo, zu OTL: All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Phoenix Backup deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e85f26a-fbde-11de-b2bb-0016ce2c743e}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e85f26a-fbde-11de-b2bb-0016ce2c743e}\ not found. File F:\Toshiba\more4you.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\ not found. File boot.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efbafe50-f1e0-11dc-ada5-000ae4fc6867}\ not found. File boot.exe not found. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: Default User ->Temp folder emptied: 3517517 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: All Users User: NetworkService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 82513 bytes ->Temporary Internet Files folder emptied: 412184 bytes ->Flash cache emptied: 0 bytes User: *** ->Temp folder emptied: 664846794 bytes ->Temporary Internet Files folder emptied: 1314711281 bytes ->Java cache emptied: 68327805 bytes ->Flash cache emptied: 3853436 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 2676103 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 103518854 bytes RecycleBin emptied: 2730545713 bytes Total Files Cleaned = 4.666,00 mb OTL by OldTimer - Version 3.2.1.3 log created on 04272010_115122 Files\Folders moved on Reboot... File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\4XAFS5E7\default;sz=728x90;!c=;kvid=Zw-TUO7A-HQ;kpu=TheLawyer;kgender=f;ko=u;kpid=;kr=F;kage=22;u=Zw-TUO7A-HQ_;tile=1;dcopt=ist;ord=3184631622962414[2].5 not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\SL2RWXEJ\default;sz=728x90;!c=;kvid=V3E2h1Te8Fs;kpu=3L3CTICJUIC3;kgender=f;ko=u;kpid=;kr=F;kage=22;u=V3E2h1Te8Fs_;tile=1;dcopt=ist;o rd=6291291549461494[2] not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\SL2RWXEJ\default;sz=728x90;!c=;kvid=V3E2h1Te8Fs;kpu=3L3CTICJUIC3;kgender=f;ko=u;kpid=;kr=F;kage=22;u=V3E2h1Te8Fs_;tile=1;dcopt=ist;o rd=66923575511279[2].48 not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\GXMNGXMF\default;sz=728x90;!c=;kvid=V3E2h1Te8Fs;kpu=3L3CTICJUIC3;kgender=f;ko=u;kpid=;kr=F;kage=22;u=V3E2h1Te8Fs_;tile=1;dcopt=ist;o rd=2998707680833212[2] not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\GXMNGXMF\default;sz=728x90;!c=;kvid=lR33AyciWbc;kpu=NGC316;kgender=f;ko=u;kpid=;kr=F;kage=22;u=lR33AyciWbc_;tile=1;dcopt=ist;ord=182 7019513715681[2].2 not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WHY7W96N\main_2;sz=480x70;!c=2;kvid=-i3DZwwvrQQ;kpu=sonybmg;kgender=f;ko=p;kpid=2;kr=F;k1=rhythm%20blues;kage=22;u=-i3DZwwvrQQ_2;tile=1;dcopt=ist;ord=44067[1].asx not found! File\Folder C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WHY7W96N\main_2;sz=300x250;!c=2;kvid=-i3DZwwvrQQ;kpu=sonybmg;kgender=f;ko=p;kpid=2;kr=F;k1=rhythm%20blues;kage=22;u=-i3DZwwvrQQ_2;tile=1;dcopt=ist;ord=7742215555419163[1].htm not found! C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\inC4.tmp moved successfully. Registry entries deleted on Reboot... Beim Vollscan mit Malware kam raus: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 4041 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 27.04.2010 13:05:29 mbam-log-2010-04-27 (13-05-29).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 202014 Laufzeit: 39 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 13 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP748\A0110966.EXE (Trojan.Dropper) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP740\A0108416.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP737\A0107573.EXE (Trojan.Dropper) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP737\A0108231.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP741\A0108685.EXE (Spyware.Banker) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP742\A0108818.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP743\A0108891.EXE (Spyware.Banker) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP743\A0108918.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP744\A0108949.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP744\A0109174.EXE (Spyware.Banker) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP744\A0109306.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP745\A0109593.EXE (Spyware.Zbot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP738\A0108296.EXE (Spyware.Banker) -> Quarantined and deleted successfully. Viele Grüße! Helli |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 17:39 Uhr. |
Copyright ©2000-2025, Trojaner-Board