Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Antimalware Doctor lässt rkill nicht zu (https://www.trojaner-board.de/89528-antimalware-doctor-laesst-rkill.html)

Dancingshoe 15.08.2010 16:15
Antimalware Doctor lässt rkill nicht zu
 
Hallo,

habe bisher mit Hilfe eurer Anleitungen versucht, den Antimalware Doctor loszuwerden, bislang aber ohne Erfolg. Das Problem scheint zu sein, dass ich rkill auch nach Umbenennung nicht zum starten kriege, es wird einfach alles geblockt.

Was kann ich nun noch tun?

Vielen Dank für eure Hilfe!

So, habe es nun doch zum Laufen bekommen.
Allerdings ist nach dem Malmware durchlauf, sowie CCleaner, anscheinend immer noch etwas übrig, da malmware doctor immer noch geöffnet ist, auch wenn keine warnfenster mehr aufgehen!

wie kriege ich ihn nun endgültig entfernt?

cosinus 15.08.2010 20:05
Zitat:
Allerdings ist nach dem Malmware durchlauf,
Poste das Log von malwarebytes!

Dancingshoe 22.08.2010 16:07
So, hier nun der log von Malware:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4433

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

17.08.2010 16:28:28
mbam-log-2010-08-17 (16-28-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 173749
Laufzeit: 23 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Betriebssystem ist Windows 7, formatieren immer noch nicht möglich, genau so wie der Internetzugang über iexplorer, Mozilla usw. (Updates gehen!)

cosinus 22.08.2010 19:26
Zitat:
17.08.2010 16:28:28
mbam-log-2010-08-17 (16-28-28).txt
Das Log hast Du aber später gemacht! Ich will natürlich alle Logs sehen, v.a. die mit den Funden!

Dancingshoe 22.08.2010 19:44
Sry, hätte ich mir denken können;)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4433

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15.08.2010 18:36:51
mbam-log-2010-08-15 (18-36-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 175239
Laufzeit: 21 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 11
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\AppID\{84c3c236-f588-4c93-84f4-147b2abbe67b} (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9d54798a-f763-487f-8db0-57129d4407c7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9d54798a-f763-487f-8db0-57129d4407c7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9d54798a-f763-487f-8db0-57129d4407c7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d54798a-f763-487f-8db0-57129d4407c7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adgj.aghlp (Adware.EZLife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adgj.aghlp.1 (Adware.EZLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Street-Ads (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$NtUninstallMTF1011$ (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Street-Ads (Adware.Adrotator) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\secureapp70700.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Windows\$NtUninstallMTF1011$ (Adware.Adrotator) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Users\Rosina\AppData\Roaming\85F2B4C666F59298924F9D5796066A3A\secureapp70700.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Windows\System32\mkscp.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\Windows\$NtUninstallMTF1011$\apUninstall.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\Windows\$NtUninstallMTF1011$\zrpt.xml (Adware.Adrotator) -> Quarantined and deleted successfully.


Kannst du dir erklären warum das formatieren nicht mehr möglich ist?
Könnte es evtl. daran liegen, dass die Echtheit meiner Version noch nicht überprüft ist, oder doch am Troyaner?

Dancingshoe 23.08.2010 19:31
könnte mir noch mal einer helfen?

vielen dank;)

cosinus 23.08.2010 19:32
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

Dancingshoe 24.08.2010 10:14
So, hier nun der Log von otl:


;OTL Logfile:
OTL Logfile:
Code:
OTL logfile created on: 24.08.2010 11:07:57 - Run 1
OTL by OldTimer - Version 3.2.10.0    Folder = C:\Users\Rosina\Desktop
 Home Basic Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
985,00 Mb Total Physical Memory | 434,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 133,31 Gb Total Space | 116,27 Gb Free Space | 87,22% Space Free | Partition Type: NTFS
Drive D: | 51,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 7,41 Gb Total Space | 4,91 Gb Free Space | 66,34% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ROSINA-PC
Current User Name: Rosina
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Rosina\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Rosina\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 59 97 11 B1 EA CA CA 01  [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.8.107
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16050&locale=de_DE&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.29 14:40:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.29 14:40:48 | 000,000,000 | ---D | M]
 
[2010.07.27 21:43:26 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Extensions
[2010.07.27 21:43:26 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2010.08.15 18:23:08 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions
[2010.08.15 18:06:27 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.08.01 21:41:13 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions\toolbar@ask.com
[2010.08.07 23:11:11 | 000,002,253 | ---- | M] () -- C:\Users\Rosina\AppData\Roaming\Mozilla\FireFox\Profiles\cz20hnhv.default\searchplugins\askcom.xml
[2010.08.15 18:23:08 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.17 18:12:41 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.07.17 18:12:41 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.17 18:12:41 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.17 18:12:41 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.17 18:12:41 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Programme\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.24 11:06:47 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Rosina\Desktop\OTL.exe
[2010.08.22 22:13:03 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\dies&das
[2010.08.22 22:08:56 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\alles
[2010.08.15 21:38:20 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\love
[2010.08.15 18:55:16 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\ElevatedDiagnostics
[2010.08.15 18:06:21 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.08.15 17:23:38 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\Malwarebytes
[2010.08.15 17:22:56 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2010.08.15 17:04:36 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.15 17:04:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.15 17:04:34 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.15 17:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.10 18:51:47 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\rsghhtmmc
[2010.08.10 18:51:32 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\85F2B4C666F59298924F9D5796066A3A
[2010.08.10 18:40:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.08.10 17:43:12 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\traumprinz
[2010.08.10 17:42:59 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\traumurlaub!!
[2010.08.10 17:42:50 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\kiddis
[2010.08.10 17:42:44 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\tola.inka
[2010.08.10 17:42:15 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\freunde
[2010.08.10 17:42:13 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\italien
[2010.08.10 17:42:05 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\lilli&rosi
[2010.08.10 17:41:53 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\klinik
[2010.08.10 17:41:45 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\co
[2010.08.10 17:40:57 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\svv
[2010.08.10 17:40:46 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\bayern
[2010.08.10 17:40:36 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\family
[2010.08.10 17:27:47 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\ich
[2010.08.10 17:27:15 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Kita
[2010.08.10 17:26:10 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Urlaub2009
[2010.08.08 00:17:45 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Sommer2010.Polen
[2010.08.08 00:16:26 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Kasia&Asia
[2010.07.29 14:42:17 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\Apple Computer
[2010.07.29 14:42:16 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\Apple Computer
[2010.07.29 14:42:04 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\System32\GEARAspi.dll
[2010.07.29 14:42:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2010.07.29 14:41:35 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.07.29 14:41:32 | 000,000,000 | ---D | C] -- C:\iTunes
[2010.07.29 14:41:32 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.07.29 14:40:25 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.07.29 14:40:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010.07.29 14:40:13 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\Apple
[2010.07.29 14:40:08 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2010.07.29 14:39:28 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.07.29 14:39:12 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Apple
[2010.07.29 14:39:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010.07.29 14:36:21 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\AskToolbar
[2010.07.27 21:46:39 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\musik
[2010.07.27 21:43:37 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Documents\LimeWire
[2010.07.27 21:43:06 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\LimeWire
[2010.07.27 21:42:54 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2010.07.27 21:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.07.27 21:42:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2010.07.27 21:42:13 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
[2010.07.27 21:42:13 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.07.27 21:42:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.07.27 21:42:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.07.27 21:41:59 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2010.07.27 21:41:32 | 000,000,000 | ---D | C] -- C:\Programme\LimeWire
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.24 11:09:31 | 000,782,848 | ---- | M] () -- C:\Windows\System32\drivers\pfrhpbfd.sys
[2010.08.24 11:08:42 | 000,775,136 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.24 11:08:42 | 000,645,530 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.24 11:08:42 | 000,167,192 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.24 11:08:42 | 000,140,180 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.24 11:08:41 | 000,004,564 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.24 11:05:26 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.24 11:05:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.24 11:05:16 | 774,299,648 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.23 23:40:13 | 000,009,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.23 23:40:13 | 000,009,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.23 23:40:06 | 001,048,576 | -HS- | M] () -- C:\Users\Rosina\NTUSER.DAT
[2010.08.22 20:07:18 | 000,000,291 | ---- | M] () -- C:\Users\Rosina\Documents\marek grechuta.rtf
[2010.08.18 00:27:18 | 003,776,870 | -H-- | M] () -- C:\Users\Rosina\AppData\Local\IconCache.db
[2010.08.17 16:25:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Rosina\Desktop\OTL.exe
[2010.08.15 18:07:31 | 000,007,896 | ---- | M] () -- C:\Users\Rosina\Desktop\cc_20100815_180726.reg
[2010.08.15 18:06:23 | 000,000,965 | ---- | M] () -- C:\Users\Rosina\Desktop\CCleaner.lnk
[2010.08.15 17:04:39 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.11 10:13:47 | 000,001,612 | ---- | M] () -- C:\Windows\lsrslt.ini
[2010.08.10 18:51:39 | 000,000,005 | ---- | M] () -- C:\zrpt.xml
[2010.07.29 14:42:06 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.29 14:40:36 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.27 21:43:41 | 000,001,821 | ---- | M] () -- C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.07.27 21:42:35 | 000,001,863 | ---- | M] () -- C:\Users\Rosina\Desktop\LimeWire 5.5.10.lnk
[2010.07.27 21:42:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.07.27 21:42:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.07.27 21:42:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.07.27 21:42:02 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
 
========== Files Created - No Company Name ==========
 
[2010.08.22 20:07:18 | 000,000,291 | ---- | C] () -- C:\Users\Rosina\Documents\marek grechuta.rtf
[2010.08.15 18:07:30 | 000,007,896 | ---- | C] () -- C:\Users\Rosina\Desktop\cc_20100815_180726.reg
[2010.08.15 18:06:23 | 000,000,965 | ---- | C] () -- C:\Users\Rosina\Desktop\CCleaner.lnk
[2010.08.15 17:04:39 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.10 20:10:32 | 000,001,612 | ---- | C] () -- C:\Windows\lsrslt.ini
[2010.08.10 18:51:50 | 000,782,848 | ---- | C] () -- C:\Windows\System32\drivers\pfrhpbfd.sys
[2010.08.10 18:51:39 | 000,000,005 | ---- | C] () -- C:\zrpt.xml
[2010.07.29 14:42:05 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.29 14:40:36 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.27 21:43:41 | 000,001,821 | ---- | C] () -- C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.07.27 21:42:35 | 000,001,863 | ---- | C] () -- C:\Users\Rosina\Desktop\LimeWire 5.5.10.lnk
[2010.03.24 19:55:01 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
< End of report >
--- --- ---

--- --- ---OTL Logfile:
Code:
OTL logfile created on: 24.08.2010 11:07:57 - Run 1
OTL by OldTimer - Version 3.2.10.0    Folder = C:\Users\Rosina\Desktop
 Home Basic Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
985,00 Mb Total Physical Memory | 434,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 133,31 Gb Total Space | 116,27 Gb Free Space | 87,22% Space Free | Partition Type: NTFS
Drive D: | 51,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 7,41 Gb Total Space | 4,91 Gb Free Space | 66,34% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ROSINA-PC
Current User Name: Rosina
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Rosina\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Rosina\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) -- C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 59 97 11 B1 EA CA CA 01  [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.8.107
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16050&locale=de_DE&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.29 14:40:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.29 14:40:48 | 000,000,000 | ---D | M]
 
[2010.07.27 21:43:26 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Extensions
[2010.07.27 21:43:26 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org
[2010.08.15 18:23:08 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions
[2010.08.15 18:06:27 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.08.01 21:41:13 | 000,000,000 | ---D | M] -- C:\Users\Rosina\AppData\Roaming\mozilla\Firefox\Profiles\cz20hnhv.default\extensions\toolbar@ask.com
[2010.08.07 23:11:11 | 000,002,253 | ---- | M] () -- C:\Users\Rosina\AppData\Roaming\Mozilla\FireFox\Profiles\cz20hnhv.default\searchplugins\askcom.xml
[2010.08.15 18:23:08 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.17 18:12:41 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.07.17 18:12:41 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.17 18:12:41 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.17 18:12:41 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.17 18:12:41 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - Startup: C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Programme\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.24 11:06:47 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Rosina\Desktop\OTL.exe
[2010.08.22 22:13:03 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\dies&das
[2010.08.22 22:08:56 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\alles
[2010.08.15 21:38:20 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\love
[2010.08.15 18:55:16 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\ElevatedDiagnostics
[2010.08.15 18:06:21 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.08.15 17:23:38 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\Malwarebytes
[2010.08.15 17:22:56 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2010.08.15 17:04:36 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.15 17:04:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.15 17:04:34 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.15 17:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.10 18:51:47 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\rsghhtmmc
[2010.08.10 18:51:32 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\85F2B4C666F59298924F9D5796066A3A
[2010.08.10 18:40:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.08.10 17:43:12 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\traumprinz
[2010.08.10 17:42:59 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\traumurlaub!!
[2010.08.10 17:42:50 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\kiddis
[2010.08.10 17:42:44 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\tola.inka
[2010.08.10 17:42:15 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\freunde
[2010.08.10 17:42:13 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\italien
[2010.08.10 17:42:05 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\lilli&rosi
[2010.08.10 17:41:53 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\klinik
[2010.08.10 17:41:45 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\co
[2010.08.10 17:40:57 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\svv
[2010.08.10 17:40:46 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\bayern
[2010.08.10 17:40:36 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\family
[2010.08.10 17:27:47 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\ich
[2010.08.10 17:27:15 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Kita
[2010.08.10 17:26:10 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Urlaub2009
[2010.08.08 00:17:45 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Sommer2010.Polen
[2010.08.08 00:16:26 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\Kasia&Asia
[2010.07.29 14:42:17 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\Apple Computer
[2010.07.29 14:42:16 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\Apple Computer
[2010.07.29 14:42:04 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\System32\GEARAspi.dll
[2010.07.29 14:42:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2010.07.29 14:41:35 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.07.29 14:41:32 | 000,000,000 | ---D | C] -- C:\iTunes
[2010.07.29 14:41:32 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.07.29 14:40:25 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.07.29 14:40:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010.07.29 14:40:13 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\Apple
[2010.07.29 14:40:08 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update
[2010.07.29 14:39:28 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.07.29 14:39:12 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Apple
[2010.07.29 14:39:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010.07.29 14:36:21 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\AskToolbar
[2010.07.27 21:46:39 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Desktop\musik
[2010.07.27 21:43:37 | 000,000,000 | ---D | C] -- C:\Users\Rosina\Documents\LimeWire
[2010.07.27 21:43:06 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\LimeWire
[2010.07.27 21:42:54 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com
[2010.07.27 21:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.07.27 21:42:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2010.07.27 21:42:13 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
[2010.07.27 21:42:13 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.07.27 21:42:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.07.27 21:42:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.07.27 21:41:59 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2010.07.27 21:41:32 | 000,000,000 | ---D | C] -- C:\Programme\LimeWire
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.24 11:09:31 | 000,782,848 | ---- | M] () -- C:\Windows\System32\drivers\pfrhpbfd.sys
[2010.08.24 11:08:42 | 000,775,136 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.24 11:08:42 | 000,645,530 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.24 11:08:42 | 000,167,192 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.24 11:08:42 | 000,140,180 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.24 11:08:41 | 000,004,564 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.24 11:05:26 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.24 11:05:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.24 11:05:16 | 774,299,648 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.23 23:40:13 | 000,009,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.23 23:40:13 | 000,009,776 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.23 23:40:06 | 001,048,576 | -HS- | M] () -- C:\Users\Rosina\NTUSER.DAT
[2010.08.22 20:07:18 | 000,000,291 | ---- | M] () -- C:\Users\Rosina\Documents\marek grechuta.rtf
[2010.08.18 00:27:18 | 003,776,870 | -H-- | M] () -- C:\Users\Rosina\AppData\Local\IconCache.db
[2010.08.17 16:25:20 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Rosina\Desktop\OTL.exe
[2010.08.15 18:07:31 | 000,007,896 | ---- | M] () -- C:\Users\Rosina\Desktop\cc_20100815_180726.reg
[2010.08.15 18:06:23 | 000,000,965 | ---- | M] () -- C:\Users\Rosina\Desktop\CCleaner.lnk
[2010.08.15 17:04:39 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.11 10:13:47 | 000,001,612 | ---- | M] () -- C:\Windows\lsrslt.ini
[2010.08.10 18:51:39 | 000,000,005 | ---- | M] () -- C:\zrpt.xml
[2010.07.29 14:42:06 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.29 14:40:36 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.27 21:43:41 | 000,001,821 | ---- | M] () -- C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.07.27 21:42:35 | 000,001,863 | ---- | M] () -- C:\Users\Rosina\Desktop\LimeWire 5.5.10.lnk
[2010.07.27 21:42:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.07.27 21:42:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.07.27 21:42:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.07.27 21:42:02 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
 
========== Files Created - No Company Name ==========
 
[2010.08.22 20:07:18 | 000,000,291 | ---- | C] () -- C:\Users\Rosina\Documents\marek grechuta.rtf
[2010.08.15 18:07:30 | 000,007,896 | ---- | C] () -- C:\Users\Rosina\Desktop\cc_20100815_180726.reg
[2010.08.15 18:06:23 | 000,000,965 | ---- | C] () -- C:\Users\Rosina\Desktop\CCleaner.lnk
[2010.08.15 17:04:39 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.10 20:10:32 | 000,001,612 | ---- | C] () -- C:\Windows\lsrslt.ini
[2010.08.10 18:51:50 | 000,782,848 | ---- | C] () -- C:\Windows\System32\drivers\pfrhpbfd.sys
[2010.08.10 18:51:39 | 000,000,005 | ---- | C] () -- C:\zrpt.xml
[2010.07.29 14:42:05 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.07.29 14:40:36 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.07.27 21:43:41 | 000,001,821 | ---- | C] () -- C:\Users\Rosina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010.07.27 21:42:35 | 000,001,863 | ---- | C] () -- C:\Users\Rosina\Desktop\LimeWire 5.5.10.lnk
[2010.03.24 19:55:01 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
< End of report >
--- --- ---

cosinus 24.08.2010 14:30
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
[2010.08.10 18:51:47 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Local\rsghhtmmc
[2010.08.10 18:51:32 | 000,000,000 | ---D | C] -- C:\Users\Rosina\AppData\Roaming\85F2B4C666F59298924F9D5796066A3A
[2010.08.24 11:09:31 | 000,782,848 | ---- | M] () -- C:\Windows\System32\drivers\pfrhpbfd.sys
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:46 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19