Trojaner-Board
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Deutsche Bank Trojaner (https://www.trojaner-board.de/91779-deutsche-bank-trojaner.html)

Burg1 14.10.2010 17:11
hier aber der OTL log:OTL Logfile:
Code:
OTL logfile created on: 14.10.2010 18:05:14 - Run 2
OTL by OldTimer - Version 3.2.15.2    Folder = C:\Burghard
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 122,86 Gb Total Space | 91,08 Gb Free Space | 74,14% Space Free | Partition Type: NTFS
Drive D: | 26,18 Gb Total Space | 26,18 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: CAROLIN3-PC | User Name: carolin3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Prevx\prevx.exe (Prevx)
PRC - C:\Burghard\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10k_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Buhl finance\tax 2010 Professional\taxaktuell.exe ()
PRC - c:\Programme\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
PRC - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Burghard\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (RoxLiveShare9) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe File not found
SRV - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (hpqcxs08) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)
SRV - (hpqddsvc) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (catchme) -- C:\Users\carolin3\AppData\Local\Temp\catchme.sys File not found
DRV - (pxrts) -- C:\Windows\System32\drivers\pxrts.sys (Prevx)
DRV - (pxscan) -- C:\Windows\System32\drivers\pxscan.sys (Prevx)
DRV - (pxkbf) -- C:\Windows\System32\drivers\pxkbf.sys (Prevx)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (netr28) -- C:\Windows\System32\drivers\netr28.sys (Ralink Technology, Corp.)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc)
DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 37 9C 55 D8 C8 6A CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.30 00:41:10 | 000,000,000 | ---D | M]
 
[2010.02.01 13:27:36 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions
[2010.02.01 13:27:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2008.12.30 00:41:59 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Firefox\Profiles\sfu17z5e.default\extensions
[2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.12.30 00:40:25 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\Windows\System32\PxSecure.dll (Prevx)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [HP Software Update] C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ScanSoft PDF Create! 4-reminder] C:\Program Files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.14 17:43:25 | 000,070,192 | ---- | C] (Prevx) -- C:\Windows\System32\PxSecure.dll
[2010.10.14 17:43:24 | 000,074,624 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys
[2010.10.14 17:43:24 | 000,030,320 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys
[2010.10.14 17:43:23 | 000,024,400 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys
[2010.10.14 17:43:23 | 000,000,000 | ---D | C] -- C:\Programme\Prevx
[2010.10.14 17:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI
[2010.10.14 10:19:56 | 000,000,000 | ---D | C] -- C:\Users\carolin3\DoctorWeb
[2010.10.13 13:20:40 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.10.13 13:19:37 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010.10.13 13:05:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.10.13 13:05:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.10.13 13:05:40 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.10.13 13:05:17 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.10.13 13:05:14 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010.10.13 13:04:28 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.10.13 13:01:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.10.13 12:49:48 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.10.11 17:40:30 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Roaming\Malwarebytes
[2010.10.11 17:40:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.10.11 17:40:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.10.11 17:40:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.10.11 17:40:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.29 00:59:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.09.26 18:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2010.09.15 08:25:12 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[1996.11.18 23:15:46 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\IMPLODE.DLL
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.14 18:02:08 | 000,002,623 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Word.lnk
[2010.10.14 17:43:25 | 000,070,192 | ---- | M] (Prevx) -- C:\Windows\System32\PxSecure.dll
[2010.10.14 17:43:24 | 000,074,624 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys
[2010.10.14 17:43:24 | 000,030,320 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys
[2010.10.14 17:43:23 | 000,024,400 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys
[2010.10.14 17:41:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.10.14 17:22:28 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.14 17:22:28 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.14 15:45:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.14 15:45:39 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.10.14 13:30:46 | 000,002,651 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Excel.lnk
[2010.10.14 13:29:10 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.10.14 13:22:59 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.10.14 13:22:44 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.10.14 11:14:09 | 241,519,418 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.10.13 19:51:17 | 000,016,896 | ---- | M] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.13 18:07:22 | 000,000,940 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010.10.11 20:14:07 | 000,248,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.11 17:40:23 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.30 14:44:55 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
 
========== Files Created - No Company Name ==========
 
[2010.10.14 11:14:09 | 241,519,418 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.10.13 13:05:40 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.10.13 13:05:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.10.13 13:05:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.10.13 13:05:40 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.10.13 13:05:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.10.11 17:40:23 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.30 14:44:55 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.05.31 16:15:41 | 000,000,032 | --S- | C] () -- C:\Users\carolin3\AppData\Local\770160558.dat
[2009.09.27 10:30:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.04.12 21:16:57 | 000,007,916 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d9caps.dat
[2009.03.04 11:43:24 | 000,000,182 | ---- | C] () -- C:\Windows\wininit.ini
[2008.12.13 16:48:31 | 000,000,012 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\settings.xml
[2008.12.13 16:48:30 | 000,000,235 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\devices.xml
[2008.10.26 18:25:14 | 000,028,672 | ---- | C] () -- C:\Windows\System32\nnr.dll
[2008.10.26 11:49:15 | 000,000,552 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d8caps.dat
[2008.08.09 11:46:50 | 000,016,896 | ---- | C] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.28 13:12:14 | 000,000,924 | ---- | C] () -- C:\Windows\wiso.ini
[2008.07.25 10:58:04 | 000,000,096 | ---- | C] () -- C:\Users\carolin3\AppData\Local\fusioncache.dat
[2008.07.24 10:08:54 | 000,000,249 | ---- | C] () -- C:\Windows\BUHL.INI
[2008.07.24 09:53:08 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1998.05.11 00:00:00 | 000,748,160 | ---- | C] () -- C:\Windows\System32\CO2C40EN.DLL
[1996.11.18 23:15:52 | 000,131,072 | ---- | C] () -- C:\Windows\System32\P2SODBC.DLL
[1996.11.18 23:15:50 | 000,054,272 | ---- | C] () -- C:\Windows\System32\P2IRDAO.DLL
[1996.11.18 23:15:50 | 000,050,176 | ---- | C] () -- C:\Windows\System32\P2CTDAO.DLL
[1996.11.18 23:15:50 | 000,036,352 | ---- | C] () -- C:\Windows\System32\P2BBND.DLL

< End of report >
--- --- ---

Chris4You 15.10.2010 07:23
Hi,

es sind im RkU einige redirections drin (da werden wir die Files bei virustotal auf patches untersuchen lassen) und viele versteckte Files...
Ein direktes Rootkit ist mir nicht aufgefallen, werde mich mal schlau machen bzw. einen anderen Kompetenzler bitten mal drüberzuschauen (vielleicht sehe ich den Wald vor lauter Bäumen ja nicht)...


Fix für OTL:
  • Doppelklick auf die OTL.exe, um das Programm auszuführen.
  • Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.
  • Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"
http://oldtimer.geekstogo.com/OTL/OTL_Main_Tutorial.gif
Code:

:OTL
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

:Commands
[emptytemp]
[EMPTYFLASH]
[purity]
[Reboot]
  • Den roten Run Fixes! Button anklicken.
  • Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.
  • Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:
  • %systemroot%\_OTL

Versuchen wir mal die Hiddenfiles loszuwerden...
Anleitung & Download: http://www.trojaner-board.de/51464-a...-ccleaner.html
Installation des cCleaners ohne die Toolbar! Benutzerdefinierte Installation wählen. Dann startest du den Rechner im normalen Modus neu.

Screenshot von Prevx:
Auf der rechten Seite findest Du eien Taste "Druck" auf der Tastatur, die erstellt ein Bildschirmfoto. Dann öffnest Du Paint (oder sonst ein Bildbearbeitungsprogramm) und machst dort "Einfügen", dann den Ausschnitt mit dem PrevX-Fenster ausschneiden und hier posten.

Suche folgende Dateien und lasse sie bei virustotal untersuchen, bei Funden log posten (wobei ich denke die sind sauber):
IEShims.dll (wahrscheinlich in dem Ordner: Program Files\Internet Explorer)
ieframe.dll (wahrscheinlich in dem Ordner: C:\Windows\System32

Wie hängst Du am Internet, per Router oder direkt?

chris

Burg1 15.10.2010 09:04
Deutsche Bank Trojaner
 
hier der OTL log:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: carolin3
->Temp folder emptied: 29161486 bytes
->Temporary Internet Files folder emptied: 50539731 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1551 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 151556 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 76,00 mb


[EMPTYFLASH]

User: All Users

User: carolin3
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.15.2 log created on 10152010_095810

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

595MB mit CC gelöscht....

screenshot von Prevx geht nicht, hier daher folgender Eintarg manuel...:

icactvol.dll in c:/otl/movedfiles/10132010_124948/C_users

die beiden Dateien wurden nicht mehr gefunden, vermutlich durch den CC entfernt...

IEShims.dll
ieframe.dll

Hänge per WLAN am Internet... jetzt scheint wieder alles zu laufen, vielleicht ist jetzt alles bereinigt?

Chris4You 15.10.2010 09:59
Hi,

die Datei, die gefunden wurde von PrevX (icactvol.dll) ist der Banking-Trojaner, der laut einem parallel-Thread tatsächlich zumindest auch EBay-Passwörter mit "abgreift". Die Datei befindet sich im Backupverzeichnis von OTL, da wir sie dahin verschoben haben (sie ist da ungefährlich, wenn wir fertig sind müssen wir nur dran denken das _olt-Verzeichnis zu löschen)
D. h. für uns, sobald wir eine Infektion dieser Art erkennen, müssen wir den User darauf hinweisen, sofort alle Passwörter von einem sauberen Rechner aus zu ändern...

Ich warte noch auf das Feedback eines Kollegen bezüglich dem RuH-Logs, dann melde ich mich wieder...

Und -wie gesagt- ist die Empfehlung Neuaufzusetzen nach dieser Infektion ...

chris

Burg1 15.10.2010 12:56
in Ordnung....Wie entfernen ich denn das olt-Verzeichnis mit dem Trojaner am Besten, oder soll ich noch warten? Gruss

Chris4You 15.10.2010 21:09
Hi,

nach Anregung vom Kollegen neuer Anlauf...

temp. FileCleaner (TFC)
Lade Dir TFC runter (http://filepony.de/download-tfc/) und speichere ihn auf dem Desktop.
Falls Du noch nicht Deine Arbeit/offene Files gespeichert hast, jetzt durchführen, alle anderen
Anwendungen schließen (sonst übernimmt TFC das inklusive Browser, speichert aber nicht!)
Start jetzt die TFC.exe (Vista/Win7-User als Admin starten! [Rechtsklick und "Als Administrator ausführen"]).
Beginne mit der Bereinigung durch "Start", nicht unterbrechen. TFC wird Dich auffordern den Rechner neu zu starten, das sofort machen.

Lösche den alten Combofix und lade Dir Ihn neu runter (er wird jeden Tag neu zusammengebaut) http://download.bleepingcomputer.com/sUBs/ComboFix.exe und lass ihn laufen (ggf. im abgesicherten Modus)...

Danach:
Downloade Dir bitte Rorschach's Custom Scan.txt von GeeksToGo.com und speichere diese als Scan.txt dort, wo sich auch die OTL.exe befindet.
Starte nun OTL und klicke in die Custom Scans/Fixes Box. Wähle nun die zuvor gedownloadete Scan.txt aus und klicke OK.
Danach klicke in OTL auf Scan. Poste bitte die OTL.txt

chris

Burg1 16.10.2010 18:47
hier schonmal der log von Combofix:

ComboFix 10-10-15.04 - carolin3 16.10.2010 19:31:25.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.2165 [GMT 2:00]
ausgeführt von:: c:\users\carolin3\Downloads\ComboFix.exe
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((( Dateien erstellt von 2010-09-16 bis 2010-10-16 ))))))))))))))))))))))))))))))
.

2010-10-16 17:41 . 2010-10-16 17:41 -------- d-----w- c:\users\carolin3\AppData\Local\temp
2010-10-16 17:41 . 2010-10-16 17:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-15 21:29 . 2010-09-09 22:52 6084944 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A67CF9FA-F5DC-442C-B8DB-A92AB4178E4E}\mpengine.dll
2010-10-15 08:07 . 2010-10-15 08:08 -------- d-----w- C:\CCleaner
2010-10-14 21:54 . 2010-08-31 13:27 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-10-14 21:48 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
2010-10-14 21:48 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-14 21:48 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-10-14 15:43 . 2010-10-14 15:43 70192 ----a-w- c:\windows\system32\PxSecure.dll
2010-10-14 15:43 . 2010-10-14 15:43 74624 ----a-w- c:\windows\system32\drivers\pxrts.sys
2010-10-14 15:43 . 2010-10-14 15:43 30320 ----a-w- c:\windows\system32\drivers\pxscan.sys
2010-10-14 15:43 . 2010-10-14 15:43 24400 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2010-10-14 15:43 . 2010-10-14 15:43 -------- d-----w- c:\program files\Prevx
2010-10-14 08:19 . 2010-10-14 08:19 -------- d-----w- c:\users\carolin3\DoctorWeb
2010-10-13 10:49 . 2010-10-16 17:03 -------- d-----w- C:\_OTL
2010-10-11 15:40 . 2010-10-11 15:40 -------- d-----w- c:\users\carolin3\AppData\Roaming\Malwarebytes
2010-10-11 15:40 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-11 15:40 . 2010-10-11 15:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-11 15:40 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-28 22:59 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-28 22:59 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-26 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"ScanSoft PDF Create! 4-reminder"="c:\program files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe" [2006-11-16 35368]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-29 185872]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1094224]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
t@x aktuell.lnk - c:\program files\Buhl finance\tax 2010 Professional\taxaktuell.exe [2010-1-22 558376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 135664]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2006-04-06 264704]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2010-10-14 30320]
S0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\DRIVERS\Si3531.sys [2007-06-01 210736]
S1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2010-10-14 74624]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2010-10-14 6407728]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2007-11-21 327168]
S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2010-10-14 24400]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners

2010-10-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-24 10:10]

2010-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:31]

2010-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-31 15:31]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-10-16 19:45:04
ComboFix-quarantined-files.txt 2010-10-16 17:45

Vor Suchlauf: 18 Verzeichnis(se), 95.906.652.160 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 95.885.148.160 Bytes frei

Burg1 16.10.2010 19:09
und hier der log von OTL:OTL Logfile:
Code:
OTL logfile created on: 16.10.2010 19:58:44 - Run 3
OTL by OldTimer - Version 3.2.15.2    Folder = C:\Burghard
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 122,86 Gb Total Space | 89,33 Gb Free Space | 72,71% Space Free | Partition Type: NTFS
Drive D: | 26,18 Gb Total Space | 26,18 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: CAROLIN3-PC | User Name: carolin3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Prevx\prevx.exe (Prevx)
PRC - C:\Burghard\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10k_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - c:\Programme\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Burghard\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msshsq.dll (Microsoft Corporation)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Windows\System32\SLC.dll (Microsoft Corporation)
MOD - C:\Windows\System32\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\System32\duser.dll (Microsoft Corporation)
MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (RoxLiveShare9) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe File not found
SRV - (CSIScanner) -- C:\Program Files\Prevx\prevx.exe (Prevx)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (hpqcxs08) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)
SRV - (hpqddsvc) -- C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (catchme) -- C:\Users\carolin3\AppData\Local\Temp\catchme.sys File not found
DRV - (pxrts) -- C:\Windows\System32\drivers\pxrts.sys (Prevx)
DRV - (pxscan) -- C:\Windows\System32\drivers\pxscan.sys (Prevx)
DRV - (pxkbf) -- C:\Windows\System32\drivers\pxkbf.sys (Prevx)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (netr28) -- C:\Windows\System32\drivers\netr28.sys (Ralink Technology, Corp.)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) -- C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc)
DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 37 9C 55 D8 C8 6A CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.12.30 00:41:10 | 000,000,000 | ---D | M]
 
[2010.02.01 13:27:36 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions
[2010.02.01 13:27:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carolin3\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2008.12.30 00:41:59 | 000,000,000 | ---D | M] -- C:\Users\carolin3\AppData\Roaming\mozilla\Firefox\Profiles\sfu17z5e.default\extensions
[2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.12.30 00:40:25 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\Windows\System32\PxSecure.dll (Prevx)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [HP Software Update] C:\Programme\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ScanSoft PDF Create! 4-reminder] C:\Program Files\ScanSoft\PDF Create! 4\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
 
SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.16 19:45:07 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.10.16 19:45:07 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Local\temp
[2010.10.16 19:44:04 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010.10.16 19:28:08 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010.10.16 19:26:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.10.15 10:07:57 | 000,000,000 | ---D | C] -- C:\CCleaner
[2010.10.14 23:55:57 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.10.14 23:55:35 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.10.14 23:55:17 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.10.14 23:55:11 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.10.14 23:55:10 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.10.14 23:55:10 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.10.14 23:55:09 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.10.14 23:55:08 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.10.14 23:55:08 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.10.14 23:55:07 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.10.14 23:55:07 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.10.14 23:55:07 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.10.14 23:55:07 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.10.14 23:55:07 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.10.14 23:55:07 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.10.14 23:55:07 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.10.14 23:55:07 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.10.14 23:55:07 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.10.14 23:55:06 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.10.14 23:55:06 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.10.14 23:55:04 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.10.14 23:55:02 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.10.14 23:54:48 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.10.14 23:48:46 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.10.14 23:48:40 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.10.14 17:43:25 | 000,070,192 | ---- | C] (Prevx) -- C:\Windows\System32\PxSecure.dll
[2010.10.14 17:43:24 | 000,074,624 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys
[2010.10.14 17:43:24 | 000,030,320 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys
[2010.10.14 17:43:23 | 000,024,400 | ---- | C] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys
[2010.10.14 17:43:23 | 000,000,000 | ---D | C] -- C:\Programme\Prevx
[2010.10.14 17:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI
[2010.10.14 10:19:56 | 000,000,000 | ---D | C] -- C:\Users\carolin3\DoctorWeb
[2010.10.13 13:05:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.10.13 13:05:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.10.13 13:05:40 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.10.13 13:05:17 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.10.13 13:01:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.10.13 12:49:48 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.10.11 17:40:30 | 000,000,000 | ---D | C] -- C:\Users\carolin3\AppData\Roaming\Malwarebytes
[2010.10.11 17:40:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.10.11 17:40:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.10.11 17:40:16 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.10.11 17:40:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.29 00:59:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.09.26 18:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[1996.11.18 23:15:46 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\IMPLODE.DLL
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.16 19:41:26 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.10.16 19:41:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.10.16 19:18:09 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.10.16 19:16:25 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.10.16 19:16:24 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.10.16 19:15:53 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.16 19:15:52 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.16 19:15:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.16 16:58:16 | 000,002,651 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Excel.lnk
[2010.10.16 13:45:11 | 000,002,623 | ---- | M] () -- C:\Users\carolin3\Desktop\Microsoft Word.lnk
[2010.10.15 09:11:11 | 000,248,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.14 17:43:25 | 000,070,192 | ---- | M] (Prevx) -- C:\Windows\System32\PxSecure.dll
[2010.10.14 17:43:24 | 000,074,624 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxrts.sys
[2010.10.14 17:43:24 | 000,030,320 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxscan.sys
[2010.10.14 17:43:23 | 000,024,400 | ---- | M] (Prevx) -- C:\Windows\System32\drivers\pxkbf.sys
[2010.10.13 19:51:17 | 000,016,896 | ---- | M] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.13 18:07:22 | 000,000,940 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010.10.11 17:40:23 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.30 14:44:55 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
 
========== Files Created - No Company Name ==========
 
[2010.10.13 13:05:40 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.10.13 13:05:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.10.13 13:05:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.10.13 13:05:40 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.10.13 13:05:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.10.11 17:40:23 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.30 14:44:55 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.05.31 16:15:41 | 000,000,032 | --S- | C] () -- C:\Users\carolin3\AppData\Local\770160558.dat
[2009.09.27 10:30:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.04.12 21:16:57 | 000,007,916 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d9caps.dat
[2009.03.04 11:43:24 | 000,000,182 | ---- | C] () -- C:\Windows\wininit.ini
[2008.12.13 16:48:31 | 000,000,012 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\settings.xml
[2008.12.13 16:48:30 | 000,000,235 | ---- | C] () -- C:\Users\carolin3\AppData\Roaming\devices.xml
[2008.10.26 18:25:14 | 000,028,672 | ---- | C] () -- C:\Windows\System32\nnr.dll
[2008.10.26 11:49:15 | 000,000,552 | ---- | C] () -- C:\Users\carolin3\AppData\Local\d3d8caps.dat
[2008.08.09 11:46:50 | 000,016,896 | ---- | C] () -- C:\Users\carolin3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.28 13:12:14 | 000,000,924 | ---- | C] () -- C:\Windows\wiso.ini
[2008.07.25 10:58:04 | 000,000,096 | ---- | C] () -- C:\Users\carolin3\AppData\Local\fusioncache.dat
[2008.07.24 10:08:54 | 000,000,249 | ---- | C] () -- C:\Windows\BUHL.INI
[2008.07.24 09:53:08 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1998.05.11 00:00:00 | 000,748,160 | ---- | C] () -- C:\Windows\System32\CO2C40EN.DLL
[1996.11.18 23:15:52 | 000,131,072 | ---- | C] () -- C:\Windows\System32\P2SODBC.DLL
[1996.11.18 23:15:50 | 000,054,272 | ---- | C] () -- C:\Windows\System32\P2IRDAO.DLL
[1996.11.18 23:15:50 | 000,050,176 | ---- | C] () -- C:\Windows\System32\P2CTDAO.DLL
[1996.11.18 23:15:50 | 000,036,352 | ---- | C] () -- C:\Windows\System32\P2BBND.DLL
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2008.03.24 21:38:45 | 000,271,100 | ---- | M] () -- C:\10_FelixGabriel.pdf
[2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2003.04.02 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008.07.23 13:05:04 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2010.10.16 19:45:05 | 000,007,833 | ---- | M] () -- C:\ComboFix.txt
[2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008.06.09 09:56:19 | 000,000,531 | ---- | M] () -- C:\hpfr3420 (1).xml
[2007.03.26 15:23:21 | 000,001,002 | ---- | M] () -- C:\hpfr3420.log
[2008.07.23 11:10:46 | 000,000,000 | ---- | M] () -- C:\hpfr3420.xml
[2008.06.09 09:56:19 | 000,833,913 | ---- | M] () -- C:\hpfr3425 (1).log
[2008.07.23 11:10:48 | 000,024,881 | ---- | M] () -- C:\hpfr3425.log
[2007.09.02 12:30:20 | 000,001,088 | -H-- | M] () -- C:\hpothb07.dat
[2007.09.02 12:30:20 | 000,010,711 | -H-- | M] () -- C:\hpothb07.tif
[2006.11.23 23:40:38 | 000,000,558 | ---- | M] () -- C:\INSTALL.LOG
[2008.03.07 17:24:05 | 000,000,426 | ---- | M] () -- C:\InstallHelper (1).log
[2010.08.30 10:03:34 | 000,003,290 | ---- | M] () -- C:\InstallHelper.log
[2009.11.06 13:41:10 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008.03.19 17:04:32 | 007,171,614 | ---- | M] () -- C:\mgakat.pdf
[2009.11.06 13:41:10 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010.10.16 19:15:24 | 3533,373,440 | -HS- | M] () -- C:\pagefile.sys
[2008.04.02 16:47:45 | 000,018,103 | ---- | M] () -- C:\PaketscheinServletInt
[2008.05.19 08:07:50 | 000,024,927 | ---- | M] () -- C:\pdf
[2010.10.14 11:13:11 | 000,056,578 | ---- | M] () -- C:\TDSSKiller.2.4.4.0_14.10.2010_11.10.26_log.txt
[2007.09.23 13:48:51 | 000,500,898 | ---- | M] () -- C:\vcredist_x86.log
[2005.08.26 17:14:06 | 000,000,440 | ---- | M] () -- C:\Verknüpfung mit Eigene Dateien.lnk
 
< %systemroot%\Fonts\*.com >
[2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010.03.06 13:25:54 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\Fonts\*.exe >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.01.19 09:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg  >
 
< %systemroot%\*.jpg  >
 
< %systemroot%\*.png  >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.*  >
 
< %PROGRAMFILES%\*.* >
[2008.08.10 10:24:47 | 000,000,174 | -HS- | M] () -- C:\Programme\desktop.ini
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\System32\config\*.sav  >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %PROGRAMFILES%\bak. /s >
 
< %systemroot%\system32\bak. /s >
 
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x  >
 
< %systemroot%\system32\config\systemprofile\*.dat /x >
 
< %systemroot%\*.config >
 
< %systemroot%\system32\*.db >
 
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009.06.20 15:15:36 | 000,000,574 | -HS- | M] () -- C:\Users\carolin3\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
 
< %USERPROFILE%\Desktop\*.exe >
 
< %PROGRAMFILES%\Common Files\*.* >
 
< %systemroot%\*.src >
 
< %systemroot%\install\*.* >
 
< %systemroot%\system32\DLL\*.* >
 
< %systemroot%\system32\HelpFiles\*.* >
 
< %systemroot%\system32\rundll\*.* >
 
< %systemroot%\winn32\*.* >
 
< %systemroot%\Java\*.* >
 
< %systemroot%\system32\test\*.* >
 
< %systemroot%\system32\Rundll32\*.* >
 
< %systemroot%\AppPatch\Custom\*.* >
 
< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >
 
< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >
 
< %PROGRAMFILES%\Internet Explorer\*.tmp >
 
< %PROGRAMFILES%\Internet Explorer\*.dat >
 
< %USERPROFILE%\My Documents\*.exe >
 
< %USERPROFILE%\*.exe >
 
< %systemroot%\ADDINS\*.* >
 
< %systemroot%\assembly\*.bak2 >
 
< %systemroot%\Config\*.* >
 
< %systemroot%\REPAIR\*.bak2 >
 
< %systemroot%\SECURITY\Database\*.sdb /x >
 
< %systemroot%\SYSTEM\*.bak2 >
 
< %systemroot%\Web\*.bak2 >
 
< %systemroot%\Driver Cache\*.* >
 
< %PROGRAMFILES%\Mozilla Firefox\0*.exe >
 
< %ProgramFiles%\Microsoft Common\*.* >
 
< %ProgramFiles%\TinyProxy. >
 
< %USERPROFILE%\Favorites\*.url /x >
[2008.09.18 16:02:06 | 000,000,402 | -HS- | M] () -- C:\Users\carolin3\Favorites\desktop.ini
 
< %systemroot%\system32\*.bk >
 
< %systemroot%\*.te >
 
< %systemroot%\system32\system32\*.* >
 
< %ALLUSERSPROFILE%\*.dat /x >
[2010.09.10 13:45:19 | 000,002,204 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2009.06.20 16:14:46 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010.10.16 19:16:24 | 000,035,189 | ---- | M] () -- C:\ProgramData\nvModes.001
 
< %systemroot%\system32\drivers\*.rmv >
 
< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
 
< dir /b "%systemroot%\*.exe" | find /i " " /c >
 
< %PROGRAMFILES%\Microsoft\*.* >
 
< %systemroot%\System32\Wbem\proquota.exe >
 
< %PROGRAMFILES%\Mozilla Firefox\*.dat >
 
< %USERPROFILE%\Cookies\*.txt /x >
 
< %SystemRoot%\system32\fonts\*.* >
 
< %systemroot%\system32\winlog\*.* >
 
< %systemroot%\system32\Language\*.* >
 
< %systemroot%\system32\Settings\*.* >
 
< %systemroot%\system32\*.quo >
 
< %SYSTEMROOT%\AppPatch\*.exe >
 
< %SYSTEMROOT%\inf\*.exe >
 
< %SYSTEMROOT%\Installer\*.exe >
 
< %systemroot%\system32\config\*.bak2 >
 
< %systemroot%\system32\Computers\*.* >
 
< %SystemRoot%\system32\Sound\*.* >
 
< %SystemRoot%\system32\SpecialImg\*.* >
 
< %SystemRoot%\system32\code\*.* >
 
< %SystemRoot%\system32\draft\*.* >
 
< %SystemRoot%\system32\MSSSys\*.* >
 
< %ProgramFiles%\Javascript\*.* >
 
< %systemroot%\pchealth\helpctr\System\*.exe /s >
 
< %systemroot%\Web\*.exe >
 
< %systemroot%\system32\msn\*.* >
 
< %systemroot%\system32\*.tro >
 
< %AppData%\Microsoft\Installer\msupdates\*.* >
 
< %ProgramFiles%\Messenger\*.exe >
 
< %systemroot%\system32\systhem32\*.* >
 
< %systemroot%\system\*.exe >
 
< %USERPROFILE%\Templates\*.tmp >
 
< %SYSTEMDRIVE%\explorexxx.exe\*.* >
 
< %Windir%\Installer\*.tmp >
[4 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]
 
< %systemroot%\System32\*.xco >
 
< %ProgramFiles%\system32\*.* >
 
< %systemroot%\System32\windos\*.* >
 
< %SystemRoot%\system32\sandbox\*.* >
 
< %SystemRoot%\system32\*.amo >
 
< %SystemRoot%\system32\Windows Live\*.* >
 
< %ProgramFiles%\logs\*.* >
 
< %ProgramFiles%\Bifrost\*.* >
 
< %SystemRoot%\system32\*.goo >
 
< %systemroot%\system32\IME\*.* >
 
< %systemroot%\BackUp\*.* >
 
< %systemroot%\system32\*.ico >
[2006.09.18 23:31:55 | 000,107,620 | ---- | M] () -- C:\Windows\System32\acwizard.ico
 
< %systemroot%\system\*.dat >
 
< %systemroot%\system\*.exe >
 
< %AppData%\Macromedia\Common\*.* >
 
< %SYSTEMDRIVE%\dir\*.* /s >
 
< %systemroot%\system32\ras\*.exe >
 
< %SYSTEMDRIVE%\MFILES\*.* >
 
< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >
 
< %systemroot%\system32\services\*.* >
 
< %systemroot%\Spooler\*.* >
 
< %ProgramFiles%\system32\*.* >
 
< %systemroot%\system32\Setup\*.dll /x >
 
< %systemroot%\system32\*.mine  >
 
< %SYSTEMDRIVE%\cleansweep.exe\*.* >
 
< %systemroot%\system32\ras\*.dll  >
 
< %systemroot%\system32\ras\*.drv >
 
< %systemroot%\*.iq  >
 
< %systemroot%\system32\XP\*.* >
 
< %SYSTEMDRIVE%\Extracted\*.* >
 
< %systemroot%\system32\windows\*.* >
 
< %systemroot%\logs\*.* >
 
< %SYSTEMDRIVE%\Win.Msi\*.* >
 
< %systemroot%\regedit\*.* >
 
< %systemroot%\system32\skype\*.* >
 
< %AppData%\Adobe\dlluplwin25\*.* >
 
< %UserProfile%\*.dat >
[2010.10.16 20:05:38 | 003,407,872 | -HS- | M] () -- C:\Users\carolin3\ntuser.dat
[2008.07.23 13:31:57 | 000,524,288 | -HS- | M] () -- C:\Users\carolin3\ntuser.dat_previous
 
< %UserProfile%\*.dll >
 
< %systemroot%\system32\*.sxo >
 
< %SYSTEMDRIVE%\Gazma\*.* /s >
 
< %systemroot%\system32\spynet\*.* >
 
< %systemroot%\system32\System\*.* >
 
< %appdata%\Microsoft\Windows\*.* >
 
< %systemroot%\system32\WinDir\*.* >
 
< %systemroot%\_\*.* >
 
< %systemroot%\system32\windows32\*.* >
 
< %ProgramFiles%\win\*.* >
 
< %AppData%\Microsoft\CD Burning\*.* >
 
< %systemroot%\*.cab >
 
< %systemroot%\K.Backup\*.* >
 
< %ProgramFiles%\Massenger\*.* >
 
< %systemroot%\System32\*.doc >
 
< %systemroot%\Office12\*.* >
 
< %systemroot%\System32\Rundl32.exe\*.* >
 
< %ProgramFiles%\yahoo.net\*.* >
 
< %systemroot%\system32\*.igo >
 
< %systemroot%\*.rew >
 
< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
 
< %USERPROFILE%\.COMMgr\*.* >
 
< %USERPROFILE%\Desktop\*.bat >
 
< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >
[2008.12.30 00:41:08 | 000,043,008 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\Annabelle.rpv
[2008.12.30 00:41:08 | 000,080,384 | ---- | M] () -- C:\Programme\Common Files\Real\Visualizations\CosmicBelt.rpv
[2008.12.30 00:41:08 | 000,007,168 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\Fire.rpv
[2008.12.30 00:41:08 | 000,007,680 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Visualizations\FreqBands.rpv
[2008.12.30 00:41:08 | 000,069,632 | ---- | M] () -- C:\Programme\Common Files\Real\Visualizations\Nebula.rpv
 
< %PROGRAMFILES%\Internet Explorer\*.Jmp >
 
< %PROGRAMFILES%\Windows NT\system\*.dll >
 
< %systemroot%\system32\*.ext >
 
< %systemroot%\system32\Com\*.cfg >
 
< %systemroot%\system32\btz\*.* >
 
< %systemroot%\system32\EMP\*.* >
 
< %systemroot%\system32\expo\*.* >
 
< %systemroot%\system32\inet2\*.* >
 
< %systemroot%\system32\xrem\*.* >
 
< %ProgramFiles%\Microsoft\*.* >
 
< %systemroot%\usgwmt\*.* >
 
< %ProgramFiles%\B\*.* >
 
< %SYSTEMDRIVE%\lspp\*.* >
 
< %systemroot%\Kral\*.* >
 
< %SYSTEMDRIVE%\windowsdvd.exe\*.* >
 
< %systemroot%\system32\*.ipo >
 
< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >
 
< %systemroot%\system32\*.mof >
 
< %systemroot%\*.atm >
 
< %systemroot%\system32\svhost\*.* >
 
< %ProgramFiles%\system32\*.* >
 
< %ProgramFiles%\Docmentt\*.* >
 
< %systemroot%\Help\*.vbs >
 
< %ProgramFiles%\Windows WinSxs\*.* /s >
 
< %ProgramFiles%\Outlook Express\IDT\*.* /s >
 
< %ProgramFiles%\Microsoft Office\365\*.* /s >
 
< %ProgramFiles%\Windows Live\*.* >
 
< %systemroot%\system32\win32\*.* >
 
< %SYSTEMDRIVE%\RECYCLER\*.* >
 
< %systemroot%\Fresh1\*.* >
 
< %ProgramFiles%\Kekj\*.* /s >
 
< %systemroot%\GDU\*.* >
 
< %systemroot%\KA\*.* >
 
< %systemroot%\R\*.* >
 
< %systemroot%\system32\*.fyo >
 
< %USERPROFILE%\System\*.* >
 
< %systemroot%\Source\*.* >
 
< %systemroot%\system32\ac\*.* >
 
< %ProgramFiles%\MSDN\*.* >
 
< %AppData%\AdobeUM\winvcldll54\*.* /s >
 
< %ProgramFiles%\Internet Explorer\*.ico >
 
< %systemroot%\system32\*.ojo >
 
< %systemroot%\system32\d323s\*.* >
 
< %systemroot%\system32\re\*.* >
 
< %UserProfile%\Microsoft\*.dll >
 
< %UserProfile%\Microsoft\*.log >
 
< %systemroot%\Bios\*.* >
 
< %ProgramFiles%\Spool\*.* >
 
< %ProgramFiles%\promp3\*.* >
 
< %SYSTEMDRIVE%\Driver\*.* /s >
 
< %SYSTEMDRIVE%\inetserver.exe\*.* >
 
< %systemroot%\java\trustlib\*.* >
 
< %ProgramFiles%\Common Files\designer\*.exe >
 
< %ProgramFiles%\*. >
[2010.07.26 17:07:33 | 000,000,000 | ---D | M] -- C:\Programme\Adobe
[2009.03.04 09:55:41 | 000,000,000 | ---D | M] -- C:\Programme\avmwlanstick
[2008.07.29 09:21:33 | 000,000,000 | ---D | M] -- C:\Programme\BMWi
[2010.01.22 10:47:20 | 000,000,000 | ---D | M] -- C:\Programme\Buhl finance
[2010.10.16 19:36:24 | 000,000,000 | ---D | M] -- C:\Programme\Common Files
[2008.04.25 05:40:50 | 000,000,000 | ---D | M] -- C:\Programme\CyberLink
[2008.06.09 19:20:10 | 000,000,000 | ---D | M] -- C:\Programme\eBay
[2008.06.10 17:57:36 | 000,000,000 | ---D | M] -- C:\Programme\FRITZ!Box
[2008.06.10 17:58:20 | 000,000,000 | ---D | M] -- C:\Programme\FRITZ!DSL
[2009.03.04 10:12:42 | 000,000,000 | ---D | M] -- C:\Programme\fun communications GmbH
[2008.07.23 12:27:20 | 000,000,000 | -HSD | M] -- C:\Programme\Gemeinsame Dateien
[2010.10.11 19:41:45 | 000,000,000 | ---D | M] -- C:\Programme\Google
[2010.07.01 17:33:12 | 000,000,000 | ---D | M] -- C:\Programme\Hewlett-Packard
[2008.04.25 05:48:14 | 000,000,000 | ---D | M] -- C:\Programme\HomeCinema
[2010.07.01 17:31:49 | 000,000,000 | ---D | M] -- C:\Programme\HP
[2010.10.11 20:08:03 | 000,000,000 | -H-D | M] -- C:\Programme\InstallShield Installation Information
[2008.04.24 08:50:45 | 000,000,000 | ---D | M] -- C:\Programme\Intel
[2010.10.15 09:08:18 | 000,000,000 | ---D | M] -- C:\Programme\Internet Explorer
[2008.07.26 11:48:52 | 000,000,000 | ---D | M] -- C:\Programme\K-Lab
[2008.04.25 04:59:21 | 000,000,000 | ---D | M] -- C:\Programme\Launch Manager
[2008.06.10 17:08:02 | 000,000,000 | ---D | M] -- C:\Programme\Logitech
[2010.10.11 17:40:24 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware
[2008.06.10 17:08:02 | 000,000,000 | ---D | M] -- C:\Programme\MGI
[2009.07.21 23:57:38 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft
[2008.06.13 03:03:25 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft CAPICOM 2.1.0.2
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Games
[2008.06.10 17:08:15 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Office
[2010.10.13 18:07:26 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Security Essentials
[2010.06.26 03:02:22 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft.NET
[2010.08.13 14:37:11 | 000,000,000 | ---D | M] -- C:\Programme\Movie Maker
[2009.03.04 11:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\MSBuild
[2010.01.17 15:14:37 | 000,000,000 | ---D | M] -- C:\Programme\MSECache
[2008.06.13 03:01:18 | 000,000,000 | ---D | M] -- C:\Programme\MSXML 4.0
[2008.04.25 05:08:28 | 000,000,000 | ---D | M] -- C:\Programme\Nero
[2009.08.06 17:16:14 | 000,000,000 | ---D | M] -- C:\Programme\NetObjects
[2010.04.23 17:48:02 | 000,000,000 | ---D | M] -- C:\Programme\NVIDIA Corporation
[2010.10.14 17:43:23 | 000,000,000 | ---D | M] -- C:\Programme\Prevx
[2009.01.02 11:30:30 | 000,000,000 | ---D | M] -- C:\Programme\QuickTime
[2008.12.30 00:40:57 | 000,000,000 | ---D | M] -- C:\Programme\Real
[2008.04.24 11:33:09 | 000,000,000 | ---D | M] -- C:\Programme\Realtek
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Reference Assemblies
[2009.09.30 12:26:37 | 000,000,000 | ---D | M] -- C:\Programme\Research In Motion
[2008.06.09 19:43:01 | 000,000,000 | ---D | M] -- C:\Programme\ScanSoft
[2008.04.25 04:46:52 | 000,000,000 | ---D | M] -- C:\Programme\Softex
[2008.04.25 04:34:29 | 000,000,000 | ---D | M] -- C:\Programme\Synaptics
[2006.11.02 15:01:55 | 000,000,000 | -H-D | M] -- C:\Programme\Uninstall Information
[2010.03.06 13:33:36 | 000,000,000 | ---D | M] -- C:\Programme\Windows Calendar
[2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Collaboration
[2010.03.06 13:33:34 | 000,000,000 | ---D | M] -- C:\Programme\Windows Defender
[2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Journal
[2009.07.21 23:57:33 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live
[2009.07.21 23:57:19 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live SkyDrive
[2010.09.17 21:30:54 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mail
[2010.10.15 09:08:19 | 000,000,000 | ---D | M] -- C:\Programme\Windows Media Player
[2008.07.23 12:27:20 | 000,000,000 | ---D | M] -- C:\Programme\Windows NT
[2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Photo Gallery
[2010.03.08 10:51:57 | 000,000,000 | ---D | M] -- C:\Programme\Windows Portable Devices
[2010.03.06 13:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Sidebar
[2009.11.22 13:29:09 | 000,000,000 | ---D | M] -- C:\Programme\WinRAR
 
< %systemroot%\system32\*.tso >
 
< %ALLUSERSPROFILE%\Documents\Server\*.* >
 
< %systemroot%\*.pif >
[2006.09.18 23:43:58 | 000,000,707 | ---- | M] () -- C:\Windows\_default.pif
 
< %systemroot%\system32\n7533\*.* >
 
< %systemroot%\Us18336\*.* >
 
< %systemroot%\system32\*.zip >
 
< %systemroot%\system32\*.wgo >
 
< %ProgramFiles%\Microsoft Office\OFFICE11\*.* >
 
< %systemroot%\system32\dllcache\*.com >
 
< %systemroot%\system32\dllchache\*.* >
 
< %systemroot%\system32\038840\*.* >
 
< %systemroot%\system32\13E92A\*.* >
 
< %systemroot%\system32\1CB5AD\*.* >
 
< %systemroot%\system32\52682A\*.* >
 
< %USERPROFILE%\My Documents\*.htm  >
 
< %SYSTEMDRIVE%\Mr_CF\*.* >
 
< %USERPROFILE%\My Documents\*.dll >
 
< %USERPROFILE%\My Documents\*.ccc >
 
< %systemroot%\system32\Sis\*.* >
 
< %systemroot%\Microsft\*.* >
 
< %SYSTEMDRIVE%\driverwinx.exe\*.* >
 
< %systemroot%\BifroXx\*.* >
 
< %SYSTEMDRIVE%\TSTP\*.* >
 
< %systemroot%\winsn\*.* >
 
< %ProgramFiles%\windata\*.* >
 
< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >
 
< %systemroot%\system32\*.sao >
 
< %systemroot%\system32\*.iem  >
 
< %systemroot%\system32\*.mdd >
 
< %systemroot%\system32\*.wlo >
 
< %systemroot%\system32\*.skn >
 
< %SYSTEMDRIVE%\Winup\*.* >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-15 07:07:25

< End of report >
--- --- ---


Ist damit alles wieder in Ordnung? mir sagt das leider nichts....

Burg1 16.10.2010 19:11
.... und soll ich noch über OTL bereinigen??? Gruss Burg

Chris4You 16.10.2010 20:23
Hi,

mir ist nur ein arg großes, steinaltes Icon aufgefallen
Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:
  • Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“
    und suche folgende Datei/Dateien:
Code:
C:\Windows\System32\acwizard.ico
  • Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
  • Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
  • Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

chris

Burg1 16.10.2010 23:22
Deutsche Bank Trojaner
 
File name: acwizard.ico
Submission date: 2009-09-13 22:32:38 (UTC)
Current status: finished
Result: 0 /41 (0.0%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.09.13 -
AhnLab-V3 5.0.0.2 2009.09.13 -
AntiVir 7.9.1.14 2009.09.11 -
Antiy-AVL 2.0.3.7 2009.09.11 -
Authentium 5.1.2.4 2009.09.13 -
Avast 4.8.1351.0 2009.09.13 -
AVG 8.5.0.412 2009.09.13 -
BitDefender 7.2 2009.09.13 -
CAT-QuickHeal 10.00 2009.09.12 -
ClamAV 0.94.1 2009.09.13 -
Comodo 2308 2009.09.13 -
DrWeb 5.0.0.12182 2009.09.13 -
eSafe 7.0.17.0 2009.09.13 -
eTrust-Vet 31.6.6733 2009.09.11 -
F-Prot 4.5.1.85 2009.09.13 -
F-Secure 8.0.14470.0 2009.09.13 -
Fortinet 3.120.0.0 2009.09.13 -
GData 19 2009.09.13 -
Ikarus T3.1.1.72.0 2009.09.13 -
Jiangmin 11.0.800 2009.09.13 -
K7AntiVirus 7.10.843 2009.09.12 -
Kaspersky 7.0.0.125 2009.09.13 -
McAfee 5740 2009.09.13 -
McAfee+Artemis 5740 2009.09.13 -
McAfee-GW-Edition 6.8.5 2009.09.13 -
Microsoft 1.5005 2009.09.13 -
NOD32 4422 2009.09.13 -
Norman 6.01.09 2009.09.11 -
nProtect 2009.1.8.0 2009.09.12 -
Panda 10.0.2.2 2009.09.13 -
PCTools 4.4.2.0 2009.09.11 -
Prevx 3.0 2009.09.13 -
Rising 21.46.61.00 2009.09.13 -
Sophos 4.45.0 2009.09.13 -
Sunbelt 3.2.1858.2 2009.09.13 -
Symantec 1.4.4.12 2009.09.13 -
TheHacker 6.3.4.4.402 2009.09.12 -
TrendMicro 8.950.0.1094 2009.09.13 -
VBA32 3.12.10.10 2009.09.13 -
ViRobot 2009.9.12.1932 2009.09.12 -
VirusBuster 4.6.5.0 2009.09.13 -
Additional informationShow all
MD5 : 7be52d9078078a5a8730eee4021a7b82
SHA1 : 8b7c5af14a17ce70934075d23ad6683fb6ecf1c2
SHA256: 30159b62a44712d9c567c56b187169eb898ee53a6aab693319911c09027facb9
ssdeep: 3072:lKfL4cccrGKFNe9209gItp/FghzyAJc6bPjmb1Q:lAMcccrGmNzLGpdg19bPym
File size : 107620 bytes
First seen: 2009-03-11 22:42:19
Last seen : 2009-09-13 22:32:38
Magic: MS Windows icon resource - 15 icons, 16-colors
TrID:
Windows Icon (57.2%)
MPEG Video (42.7%)
PEiD: -
RDS: NSRL Reference Data Set

Microsoft
Installed Vista Ultimate, NSRL: acwizard.ico




VT Community

0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

MD5: 7be52d9078078a5a8730eee4021a7b82
Date first seen: 2009-03-11 22:42:19 (UTC)
Date last seen: 2009-09-13 22:32:38 (UTC)
Detection ratio: 0/41

What do you wish to do?

dann scheints jetzt zu passen?

weiss net obs von Belang ist, aber Microsoft Defender hat gestern Mittag plötzlich einen Trojaner gemeldet: win32/ursnif. Hab den dann löschen lassen...

Chris4You 17.10.2010 20:02
Hi,

wo und welcher Dateiname...?

chris

Burg1 17.10.2010 21:34
Deutsche Bank Trojaner
 
weiss ich nicjt, da steht nur Trojanspy:Win32/Ursnif

Meinst Du denn, dass jetzt alles wieder ok ist? Gruss Burg

Hallo,

muss Euch nochmals nerven. Auf einmal wird meine Festplatte immer voller obwohl ich keine neuen Programme oder ähnliches speichere. Pro Tag ca. 1-2GB. Was könnte da los sein? Gruss Burg

Chris4You 22.10.2010 06:38
Hi,

prüfe hiermit wo der Speicher "verbraten" wird.
JAM Software - Windows Freeware - Nützliche Tools für Windows
Du kannst auch probehalber die Systemwiederherstellung ausschalten..

chris


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:53 Uhr.
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55