Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/Kazy.mekml.1 Auch ich bin betroffen. Eingabe OTL? (https://www.trojaner-board.de/98160-tr-kazy-mekml-1-betroffen-eingabe-otl.html)

Himan1 26.04.2011 07:52
TR/Kazy.mekml.1 Auch ich bin betroffen. Eingabe OTL?
 
Hallo,

habe mir auch diesen Virus TR/Kazy.mekml.1 eingefangen. Ich habe im Prinzip nur das Problem, dass ich nicht weiß was ich in das OTL Tool eingeben muss, weil ich die Logfiles nicht selber auslesen kann. Der Rest wurde ja netterweise schon oft beschrieben.

Danke im Voraus für eure Antworten! Auch ein riesen großes Dankeschön an das Board-Kompetenz-Team!

Hier das Logfile Extras txt:

OTL Extras logfile created on: 26.04.2011 08:45:57 - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = D:\
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,10 Gb Total Space | 61,96 Gb Free Space | 61,90% Space Free | Partition Type: NTFS
Drive D: | 197,89 Gb Total Space | 188,50 Gb Free Space | 95,25% Space Free | Partition Type: NTFS

Computer Name: ASUS-PC | User Name: ASUS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{15B25B2C-1EF7-4EB1-99CC-2ABFB2B43F24}" = Investox XL Serviceupdate Version 5.9.6
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 22
"{38F8D823-008D-4E5A-BBCE-867A86C2BF2B}" = Sound Blaster Audigy HD
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{49224688-E31D-46D7-8782-6856A0555DA3}" = Investox XL Serviceupdate Version 5.9.4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5U8xx Media Driver ver.3.62.02
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{77010645-5170-4FC3-90E9-9C7EE79E45E4}" = Joulemeter
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{793A260C-CDBF-499C-ABBA-B51E8E076867}_is1" = Uniblue PowerSuite
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{A2A6A590-4AEA-4944-A9C2-FCB5EF4150A9}" = Investox RTT Service-Update 2.10.5
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{BC0ECDD2-78F5-4754-9381-E4C85AB233F0}" = EASY Office
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{E775DA63-C47A-4C36-A8D3-92CC457A0530}" = Investox XL Version 5.7.0 und RTT Version 2.9.7
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3B8C819-B917-4133-B927-E365D6E89117}" = Investox RTT Service-Update 2.10.3
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FE6241A3-46EB-4D95-A33D-E52C634E818D}" = Automatic Data Mining Gate Version 6
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"Foxit Reader" = Foxit Reader
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.00" = GPL Ghostscript 9.00
"Hardlock Gerätetreiber" = Hardlock Gerätetreiber
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Mozilla Thunderbird (3.1.6)" = Mozilla Thunderbird (3.1.6)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"QuoteTracker_is1" = QuoteTracker
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"TeamViewer 6" = TeamViewer 6
"Trader Workstation 4.0" = Trader Workstation 4.0
"TWS Interoperability Components" = TWS Interoperability Components
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.9
"WinRAR archiver" = WinRAR

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Himan1 26.04.2011 07:53
und hier das das OTL.txt:OTL Logfile:
Code:
OTL logfile created on: 26.04.2011 08:45:57 - Run 3
OTL by OldTimer - Version 3.2.22.3    Folder = D:\
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 3070 3070 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,10 Gb Total Space | 61,96 Gb Free Space | 61,90% Space Free | Partition Type: NTFS
Drive D: | 197,89 Gb Total Space | 188,50 Gb Free Space | 95,25% Space Free | Partition Type: NTFS
 
Computer Name: ASUS-PC | User Name: ASUS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\33087240.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Programme\ASUS\ControlDeck\ControlDeckStartUp.exe ()
PRC - C:\Programme\P4G\BatteryLife.exe (ATK)
PRC - C:\Programme\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Programme\ASUS\Splendid\ACMON.exe (ATK)
PRC - C:\Programme\ASUS\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\WerFault.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Programme\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Programme\ATKGFNEX\GFNEXSrv.exe ()
PRC - C:\Programme\ASUS\NB Probe\SPM\spmgr.exe ()
PRC - C:\Windows\System32\ACEngSvr.exe (ASUSTeK)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TeamViewer6) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (Samsung UPD Service) -- C:\Windows\System32\SUPDSvc.exe (Samsung Electronics CO., LTD.)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Joulemeter Service) -- C:\Program Files\Microsoft Research\Joulemeter\JoulemeterService.exe (Microsoft Research)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (ATKGFNEXSrv) -- C:\Programme\ATKGFNEX\GFNEXSrv.exe ()
SRV - (spmgr) -- C:\Programme\ASUS\NB Probe\SPM\spmgr.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (Btcsrusb) -- C:\Windows\System32\drivers\btcusb.sys (IVT Corporation.)
DRV - (ghaio) -- C:\Programme\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ASUS)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (akshasp) -- C:\Windows\System32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (Hardlock) -- C:\Windows\system32\drivers\hardlock.sys (SafeNet Inc.)
DRV - (aksusb) -- C:\Windows\System32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ASMMAP) -- C:\Programme\ATKGFNEX\ASMMAP.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?gcht=HC&o=101702&l=dis
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A C0 83 0B 0E 72 CB 01  [binary data]
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.01.22 20:59:06 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.01.22 20:59:07 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.23 19:03:46 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.23 19:03:46 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.11.22 13:08:55 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.10.22 21:30:05 | 000,000,000 | -H-D | M]
 
[2011.01.06 09:36:49 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\Extensions
[2010.10.22 19:37:52 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.04.24 11:41:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\Firefox\Profiles\vnzzd7op.default\extensions
[2011.04.26 07:02:22 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.01.13 20:01:13 | 000,000,000 | -H-D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.12.03 20:14:08 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 20:14:08 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 20:14:08 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 20:14:08 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 20:14:08 | 000,001,105 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\..\Toolbar\WebBrowser: (Foxit Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ATKOSD2] C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HControlUser] C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [RunDLLEntry] C:\Windows\System32\AmbRunE.DLL (Creative Technology Ltd.)
O4 - HKLM..\Run: [SysMetrix]  File not found
O4 - HKU\S-1-5-21-745330349-2447009524-2147196550-1000..\Run: [jhbHQbuAdnkPg] C:\ProgramData\jhbHQbuAdnkPg.exe (WinTrust)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-21-745330349-2447009524-2147196550-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\ASUS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.26 08:31:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.26 08:31:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.04.26 08:31:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.26 08:31:47 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.04.26 08:05:34 | 000,000,000 | -H-D | C] -- C:\Windows\Minidump
[2011.04.26 07:29:29 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery
[2011.04.26 07:04:42 | 000,569,344 | -H-- | C] (WinTrust) -- C:\ProgramData\jhbHQbuAdnkPg.exe
[2011.04.22 22:30:31 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Local\Microsoft Research
[2011.04.22 22:03:41 | 000,000,000 | -H-D | C] -- C:\Programme\Microsoft Research
[2011.04.22 22:03:41 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Joulemeter
[2011.04.22 21:25:55 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RightMark CPU Clock Utility
[2011.04.22 21:25:55 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RightMark CPU Clock Utility
[2011.04.22 21:19:23 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SysMetrix
[2011.04.22 21:19:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SysMetrix
[2011.04.21 10:47:56 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\vlc
[2011.04.21 10:47:41 | 000,000,000 | -H-D | C] -- C:\Programme\VideoLAN
[2011.04.20 22:25:17 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\Canneverbe Limited
[2011.04.20 22:25:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\Canneverbe Limited
[2011.04.20 22:25:09 | 000,000,000 | -H-D | C] -- C:\Programme\CDBurnerXP
[2011.04.20 22:19:30 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\Documents\DVDFab Passkey
[2011.04.20 22:04:42 | 000,000,000 | -H-D | C] -- C:\Programme\Elaborate Bytes
[2011.04.17 16:49:28 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\Malwarebytes
[2011.04.17 16:49:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes
[2011.04.16 21:07:50 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.16 21:07:50 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.16 21:07:48 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.16 21:07:44 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.16 21:07:44 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.16 21:07:32 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.16 21:07:32 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.16 21:07:32 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.04.16 21:07:32 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.16 21:07:32 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.04.16 21:07:31 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.04.16 21:07:31 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.16 21:07:31 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.04.16 21:07:31 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.04.16 21:07:31 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.04.16 21:07:31 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.04.16 21:07:13 | 002,331,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.16 21:07:12 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2011.04.16 21:07:10 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011.04.16 21:07:06 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.16 21:07:06 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.08 19:44:52 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.04.08 19:44:50 | 000,000,000 | -H-D | C] -- C:\Users\ASUS\Documents\DVDVideoSoft
[2011.04.08 19:44:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011.04.08 19:44:40 | 000,000,000 | -H-D | C] -- C:\Programme\DVDVideoSoft
[2011.04.08 19:44:40 | 000,000,000 | -H-D | C] -- C:\Programme\Common Files\DVDVideoSoft
[2011.03.29 14:28:24 | 000,102,400 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSESystemOptimierung5.dll
[2011.03.29 14:28:24 | 000,098,304 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSENNTraining5.dll
[2011.03.29 14:28:22 | 003,887,104 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEChart5.ocx
[2011.03.29 14:28:08 | 002,007,040 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEOrdermodul5.dll
[2011.03.29 14:28:02 | 007,536,640 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEIndikatoren5.dll
[2011.03.29 14:27:24 | 002,625,536 | -H-- | C] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEImportExport5.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.26 08:31:51 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.26 08:13:08 | 000,014,592 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.26 08:13:08 | 000,014,592 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.26 08:07:45 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~33087240r
[2011.04.26 08:07:45 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~33087240
[2011.04.26 08:05:39 | 000,000,336 | -H-- | M] () -- C:\ProgramData\33087240
[2011.04.26 08:05:38 | 000,487,424 | ---- | M] () -- C:\ProgramData\33087240.exe
[2011.04.26 08:05:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.26 08:05:32 | 203,305,020 | -H-- | M] () -- C:\Windows\MEMORY.DMP
[2011.04.26 08:05:27 | 2415,357,952 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.26 07:29:29 | 000,000,631 | -H-- | M] () -- C:\Users\ASUS\Desktop\Windows Recovery.lnk
[2011.04.26 07:29:27 | 000,000,336 | -H-- | M] () -- C:\ProgramData\33283848
[2011.04.26 07:29:24 | 008,405,015 | -H-- | M] () -- C:\Windows\hlktmp
[2011.04.26 07:04:42 | 000,569,344 | -H-- | M] (WinTrust) -- C:\ProgramData\jhbHQbuAdnkPg.exe
[2011.04.26 06:52:19 | 000,696,634 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.26 06:52:19 | 000,651,912 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.26 06:52:19 | 000,147,838 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.26 06:52:19 | 000,120,784 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.26 06:52:05 | 000,045,056 | -H-- | M] () -- C:\Windows\System32\acovcnt.exe
[2011.04.25 20:09:27 | 000,104,402 | -H-- | M] () -- C:\Users\ASUS\Desktop\kurve.png
[2011.04.22 21:04:21 | 000,007,606 | -H-- | M] () -- C:\Users\ASUS\AppData\Local\Resmon.ResmonCfg
[2011.04.21 10:47:50 | 000,001,024 | -H-- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2011.04.20 22:25:11 | 000,001,895 | -H-- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2011.04.20 22:20:17 | 000,000,085 | -HS- | M] () -- C:\ProgramData\.zreglib
[2011.04.17 16:18:30 | 000,000,043 | -H-- | M] () -- C:\Users\ASUS\AppData\Roaming\1.gif
[2011.04.17 08:21:32 | 000,308,040 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.08 19:44:44 | 000,001,356 | -H-- | M] () -- C:\Users\ASUS\Desktop\Free YouTube to MP3 Converter.lnk
[2011.03.29 14:42:08 | 000,081,920 | -H-- | M] () -- C:\Windows\System32\KSESinoUeberwachung5.exe
[2011.03.29 14:28:24 | 000,102,400 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSESystemOptimierung5.dll
[2011.03.29 14:28:24 | 000,098,304 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSENNTraining5.dll
[2011.03.29 14:28:22 | 003,887,104 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEChart5.ocx
[2011.03.29 14:28:08 | 002,007,040 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEOrdermodul5.dll
[2011.03.29 14:28:02 | 007,536,640 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEIndikatoren5.dll
[2011.03.29 14:27:24 | 002,625,536 | -H-- | M] (Knöpfel Software GmbH) -- C:\Windows\System32\KSEImportExport5.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.26 08:31:51 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.26 08:07:45 | 000,000,152 | -H-- | C] () -- C:\ProgramData\~33087240r
[2011.04.26 08:07:45 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~33087240
[2011.04.26 08:05:39 | 000,000,336 | -H-- | C] () -- C:\ProgramData\33087240
[2011.04.26 08:05:38 | 000,487,424 | ---- | C] () -- C:\ProgramData\33087240.exe
[2011.04.26 08:05:32 | 203,305,020 | -H-- | C] () -- C:\Windows\MEMORY.DMP
[2011.04.26 07:29:29 | 000,000,631 | -H-- | C] () -- C:\Users\ASUS\Desktop\Windows Recovery.lnk
[2011.04.26 07:29:27 | 000,000,336 | -H-- | C] () -- C:\ProgramData\33283848
[2011.04.26 07:29:24 | 008,405,015 | -H-- | C] () -- C:\Windows\hlktmp
[2011.04.23 15:28:53 | 000,104,402 | -H-- | C] () -- C:\Users\ASUS\Desktop\kurve.png
[2011.04.21 10:47:50 | 000,001,024 | -H-- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2011.04.20 22:25:11 | 000,001,895 | -H-- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2011.04.20 22:25:11 | 000,001,845 | -H-- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2011.04.20 22:05:13 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.04.17 16:18:30 | 000,000,043 | -H-- | C] () -- C:\Users\ASUS\AppData\Roaming\1.gif
[2011.04.08 19:44:44 | 000,001,356 | -H-- | C] () -- C:\Users\ASUS\Desktop\Free YouTube to MP3 Converter.lnk
[2011.03.29 14:42:08 | 000,081,920 | -H-- | C] () -- C:\Windows\System32\KSESinoUeberwachung5.exe
[2011.02.27 11:26:47 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\acovcnt.exe
[2011.01.13 20:36:26 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.01.12 11:10:56 | 000,049,152 | -H-- | C] () -- C:\Windows\System32\inditool32_2.dll
[2011.01.06 09:36:43 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2010.11.21 20:16:27 | 000,282,624 | -H-- | C] () -- C:\Windows\System32\DscPnt.dll
[2010.11.21 20:16:27 | 000,260,464 | -H-- | C] () -- C:\Windows\SUPDRun.exe
[2010.11.21 20:16:27 | 000,026,624 | -H-- | C] () -- C:\Windows\System32\spd__l.dll
[2010.11.19 16:59:26 | 000,253,952 | -H-- | C] () -- C:\Windows\ddedll.dll
[2010.11.12 23:28:14 | 000,028,672 | -H-- | C] () -- C:\Windows\System32\hlduinst.exe
[2010.11.12 23:28:13 | 000,153,088 | -H-- | C] () -- C:\Windows\System32\UNWISE.EXE
[2010.11.12 23:28:13 | 000,006,836 | -H-- | C] () -- C:\Windows\System32\UNWISE.INI
[2010.10.22 22:00:39 | 000,007,606 | -H-- | C] () -- C:\Users\ASUS\AppData\Local\Resmon.ResmonCfg
[2010.10.22 20:34:15 | 001,635,840 | -H-- | C] () -- C:\Windows\System32\iPostCtl.dll
[2010.10.22 20:34:15 | 001,502,720 | -H-- | C] () -- C:\Windows\System32\PDFCtrl.dll
[2010.10.22 20:34:14 | 001,868,288 | -H-- | C] () -- C:\Windows\System32\iFaxCtrl.dll
[2010.10.22 20:34:14 | 000,072,704 | -H-- | C] () -- C:\Windows\System32\CTRLSRV.EXE
[2010.10.22 19:58:10 | 000,000,042 | -H-- | C] () -- C:\Windows\ib.ini
[2010.10.22 19:58:09 | 000,026,624 | -H-- | C] () -- C:\Windows\GetIe.dll
[2010.10.22 19:39:27 | 000,116,224 | -H-- | C] () -- C:\Windows\System32\redmonnt.dll
[2010.10.22 19:39:27 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\unredmon.exe
[2010.10.22 18:05:06 | 000,000,024 | -H-- | C] () -- C:\Windows\ATKPF.ini
[2010.10.22 17:40:45 | 000,148,480 | -H-- | C] () -- C:\Windows\System32\APOMngr.DLL
[2010.10.22 17:40:45 | 000,073,728 | -H-- | C] () -- C:\Windows\System32\CmdRtr.DLL
[2010.10.22 17:40:45 | 000,004,352 | -H-- | C] () -- C:\Windows\System32\cfgfx.ini
[2010.10.22 17:40:45 | 000,000,735 | -H-- | C] () -- C:\Windows\FF05_Render_Spk_Hp.ini
[2010.10.22 17:40:45 | 000,000,508 | -H-- | C] () -- C:\Windows\FF05_not_Spk_Hp.ini
[2010.03.16 17:31:32 | 000,098,304 | -H-- | C] () -- C:\Windows\System32\KSEIBUeberwachung5.exe
[2009.12.03 09:27:30 | 000,080,416 | -H-- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.08.03 13:16:46 | 000,475,238 | -H-- | C] () -- C:\Windows\System32\KSEBasisBerechnungen5.dll
[2009.07.14 10:47:43 | 000,696,634 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,147,838 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,308,040 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,651,912 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,120,784 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.12.04 01:25:14 | 000,022,723 | -H-- | C] () -- C:\Windows\System32\sugo3l3.dll
[2006.11.21 16:41:40 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\KSEConsorsÜberwachung.exe
[2004.02.10 19:42:42 | 000,000,249 | -H-- | C] () -- C:\Windows\Comcenter.ini
[2003.03.27 12:38:44 | 000,040,960 | -H-- | C] () -- C:\Windows\System32\ddeimp32_2.dll
[2000.08.18 12:26:08 | 000,423,424 | -H-- | C] () -- C:\Windows\System32\NWPDLL.DLL
[1999.05.27 12:15:00 | 000,221,184 | -H-- | C] () -- C:\Windows\System32\TPAccess.dll

< End of report >
--- --- ---

markusg 26.04.2011 19:10
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\ProgramData\33087240.exe ()
O4 - HKU\S-1-5-21-745330349-2447009524-2147196550-1000..\Run: [jhbHQbuAdnkPg] C:\ProgramData\jhbHQbuAdnkPg.exe (WinTrust)

:Files
C:\ProgramData\33087240.exe
C:\ProgramData\jhbHQbuAdnkPg.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

lade unhide:
http://filepony.de/download-unhide/
doppelklicken, dateien werden sichtbar
öffne computer, öffne D: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131