|
Plagegeister aller Art und deren Bekämpfung: Trojner Scarware BundespolizeiWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.08.2011, 14:23 | #16 |
| Trojner Scarware Bundespolizei Achso Okay. Ja also wenn ich was Sicheren würde dann nur die Bilder und Dokumente und keine Programme u.s.w. Und zu der Frage mit dem Betriebssystem da hab ich geschaut also der Lap erreicht zumindest mal die mindestanforderung für Windows 7 |
02.08.2011, 14:25 | #17 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Trojner Scarware BundespolizeiZitat:
__________________ |
02.08.2011, 14:30 | #18 |
| Trojner Scarware Bundespolizei Ja also ich brauch den nicht für Spiele oder änliche Programme wo viel Ram brauchen.
__________________Ich Brauch ihn Hauptsächlich für die Schule sprich Word und Excel. |
02.08.2011, 14:47 | #19 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Trojner Scarware BundespolizeiZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
02.08.2011, 17:05 | #20 |
| Trojner Scarware Bundespolizei Stimmt muss nicht unbedingt Windows sein Ich bin dir aber jetzt erstmal zu richtig Großem Danke verpflichtet, dass ich mein Lap Top wieder verwenden kann ( Nach der Neuinstallation ). Wirklich vielen Danke für deine schnelle und vorallem Kompetente Hilfe. |
09.08.2011, 19:18 | #21 |
| Trojner Scarware Bundespolizei Hallo, mei Scan hier ! OTL Logfile:OTL Logfile: Code:
ATTFilter OTL logfile created on: 8/9/2011 9:11:06 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 992.00 Mb Total Physical Memory | 809.00 Mb Available Physical Memory | 82.00% Memory free 883.00 Mb Paging File | 828.00 Mb Available in Paging File | 94.00% Paging File free Paging file location(s): D:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 9.32 Gb Total Space | 0.34 Gb Free Space | 3.69% Space Free | Partition Type: NTFS Drive D: | 363.29 Gb Total Space | 86.33 Gb Free Space | 23.76% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet002 ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled] -- -- (NMIndexingService) SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2011/07/18 02:11:44 | 000,208,264 | ---- | M] ( ) [Auto] -- C:\Programme\GbPlugin\gbpsv.exe -- (GbpSv) SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2007/01/17 06:20:10 | 000,061,440 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2003/11/14 14:17:38 | 000,966,656 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\GPVSvr.exe -- (VAIOMediaPlatform-VideoServer-AppServer) SRV - [2003/11/14 10:24:06 | 000,118,784 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\halsv.exe -- (Sony TV Tuner Controller) SRV - [2003/11/14 10:23:20 | 000,090,112 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\RM_SV.exe -- (Sony TV Tuner Manager) SRV - [2003/11/14 10:23:20 | 000,077,824 | ---- | M] (Sony Corporation) [Auto] -- C:\Programme\Sony\giga pocket\shwserv.exe -- (Giga Pocket Hardware Detector) SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-VideoServer-UPnP) VAIO Media Video Server (UPnP) SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-PhotoServer-UPnP) VAIO Media Photo Server (UPnP) SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-MusicServer-UPnP) VAIO Media Music Server (UPnP) SRV - [2003/09/19 16:29:14 | 000,540,749 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\vaio media music server\SSSvr.exe -- (VAIOMediaPlatform-MusicServer-AppServer) SRV - [2003/07/28 12:31:14 | 000,065,536 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\Sptisrv.exe -- (SPTISRV) SRV - [2003/06/24 05:08:06 | 000,860,160 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\photo server\appsrv\PhotoAppSrv.exe -- (VAIOMediaPlatform-PhotoServer-AppServer) SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\sony shared\vaio media platform\SV_Httpd.exe -- (VAIOMediaPlatform-VideoServer-HTTP) VAIO Media Video Server (HTTP) SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\sony shared\vaio media platform\SV_Httpd.exe -- (VAIOMediaPlatform-PhotoServer-HTTP) VAIO Media Photo Server (HTTP) SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\sv_httpd.exe -- (VAIOMediaPlatform-MusicServer-HTTP) VAIO Media Music Server (HTTP) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | Boot] -- -- (nielprt) DRV - File not found [Kernel | On_Demand] -- -- (NielGfx) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2011/07/18 02:13:36 | 000,043,600 | ---- | M] (GAS Tecnologia) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\gbpkm.sys -- (GbpKm) DRV - [2010/04/28 01:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2007/06/17 06:43:50 | 000,186,592 | ---- | M] (Jungo) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\windrvr6.sys -- (WinDriver6) DRV - [2005/05/27 03:46:22 | 000,913,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) QuickCam IM(PID_08A0) DRV - [2005/05/27 03:38:00 | 000,007,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter) DRV - [2005/05/27 03:31:28 | 000,022,016 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2003/11/24 05:54:10 | 000,011,264 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp) DRV - [2003/10/30 06:20:54 | 000,766,848 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smrt.sys -- (smrt) DRV - [2003/10/13 18:57:34 | 000,426,752 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315) DRV - [2003/09/02 10:07:50 | 000,058,112 | ---- | M] (SMSC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SMSCMS.SYS -- (SMSCMS) DRV - [2003/07/22 13:24:16 | 000,015,126 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LCcfltr.sys -- (LCcfltr) DRV - [2003/07/22 13:23:44 | 000,073,368 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2) DRV - [2003/07/22 13:22:42 | 000,026,072 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFlt2.Sys -- (LHidFlt2) DRV - [2003/07/22 13:22:02 | 000,037,782 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb) DRV - [2003/06/15 07:31:00 | 000,175,744 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys -- (HSFHWSIS) DRV - [2003/06/15 07:28:28 | 000,631,552 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2003/06/15 07:27:18 | 001,063,296 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP) DRV - [2003/01/13 05:43:56 | 000,030,720 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SISAGPX.SYS -- (sisagp) DRV - [2002/06/13 06:37:16 | 000,045,568 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139) DRV - [2000/12/05 10:18:02 | 000,003,952 | R--- | M] (Sony Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\DMICall.sys -- (DMICall) DRV - [2000/11/09 14:15:08 | 000,048,896 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SonyNC.sys -- (SNC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/ IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/ IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 33 53 41 9C 90 CA 01 [binary data] IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\Marcus.Marzi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/ IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) O1 HOSTS File: ([2011/06/11 12:41:16 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (no name) - {B3CC3ACF-0C2C-410F-AE7A-9C1FF9887FE9} - File not found O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Easy-WebPrint\Toolband.dll () O3 - HKU\Marcus.Marzi_ON_C\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\Marcus.Marzi_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKU\Marcus.Marzi_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKU\Marcus.Marzi_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\Marcus.Marzi_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.) O4 - HKLM..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKServ.exe (Sony Corporation) O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.) O4 - HKLM..\Run: [OpwareSE2] D:\OpwareSE2.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [SiS Tray] File not found O4 - HKU\Marcus.Marzi_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] File not found O4 - HKLM..\RunOnce: [ GbPluginBb] C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Remocon-Treiber.lnk = C:\Programme\Sony\usbsircs\USBsircs.exe (Sony Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Timer Recording Manager.lnk = C:\Programme\Sony\giga pocket\ReserveModule.exe (Sony Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VAIO Action Setup (Server).lnk = C:\Programme\Sony\VAIO Action Setup\VAServ.exe (Sony Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Marcus.Marzi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKU\Marcus.Marzi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\Marcus.Marzi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O12 - Plugin for: .spop - C:\Programme\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\MARCUS~1.MAR\LOKALE~1\Temp\R66v.exe) - C:\Dokumente und Einstellungen\Marcus.Marzi\Lokale Einstellungen\Temp\R66v.exe (Shots Sheer Mites Caruso) O20 - Winlogon\Notify\ GbPluginBb: DllName - C:\Programme\GbPlugin\gbieh.dll - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil) O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003/11/06 06:43:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/08/05 02:38:44 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll [2011/08/05 02:37:55 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01007.dll [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/08/09 13:40:30 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011/08/09 13:40:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011/08/09 04:58:05 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011/08/07 10:48:14 | 000,000,550 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0 (2).lnk [2011/08/05 04:52:57 | 000,000,510 | ---- | M] () -- C:\Dokumente und Einstellungen\Marcus.Marzi\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Easy-PhotoPrint (2).lnk [2011/08/05 02:39:15 | 000,000,000 | ---- | M] () -- C:\extensions.sqlite [2011/08/05 02:38:56 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_nielprt_01007.Wdf [2011/08/05 02:38:54 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2011/08/05 02:38:52 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011/08/02 08:56:20 | 000,000,550 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0.lnk [2011/07/28 04:06:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011/07/18 02:13:36 | 000,043,600 | ---- | M] (GAS Tecnologia) -- C:\WINDOWS\System32\drivers\gbpkm.sys [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/08/07 10:48:14 | 000,000,550 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0 (2).lnk [2011/08/05 04:52:57 | 000,000,510 | ---- | C] () -- C:\Dokumente und Einstellungen\Marcus.Marzi\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Easy-PhotoPrint (2).lnk [2011/08/05 02:39:15 | 000,000,000 | ---- | C] () -- C:\extensions.sqlite [2011/08/05 02:38:56 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_nielprt_01007.Wdf [2011/08/05 02:38:54 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2011/04/17 05:38:29 | 000,000,384 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI [2011/04/16 06:10:24 | 000,000,215 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2010/07/30 02:49:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\InstMed.exe [2010/07/30 02:49:48 | 000,009,255 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2010/05/08 19:05:14 | 000,234,193 | ---- | C] () -- C:\Dokumente und Einstellungen\+Lokale Einstellungen\Anwendungsdaten\yefjn_nav.dat [2010/05/08 19:05:14 | 000,003,254 | ---- | C] () -- C:\Dokumente und Einstellungen\+\Lokale Einstellungen\Anwendungsdaten\yefjn.dat [2010/05/08 19:05:14 | 000,001,391 | ---- | C] () -- C:\Dokumente und Einstellungen\+\Lokale Einstellungen\Anwendungsdaten\yefjn_navps.dat [2010/05/08 19:05:13 | 000,438,272 | ---- | C] () -- C:\Dokumente und Einstellungen\+Lokale Einstellungen\Anwendungsdaten\yefjn.exe [2010/01/18 09:14:58 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2009/09/25 04:45:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI [2008/09/14 07:48:19 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL [2008/03/25 12:03:03 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2008/03/14 15:09:22 | 000,000,091 | ---- | C] () -- C:\Dokumente und Einstellungen\+\default.pls [2008/03/13 13:34:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini [2008/03/13 13:31:17 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe [2008/03/13 13:24:10 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/03/13 12:59:49 | 000,079,360 | ---- | C] () -- C:\Dokumente und Einstellungen\+\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/03/01 12:22:33 | 000,001,295 | ---- | C] () -- C:\WINDOWS\System32\Px.ini [2008/03/01 12:18:22 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll [2008/03/01 12:16:44 | 000,262,416 | ---- | C] () -- C:\WINDOWS\System32\ASFV2.DLL [2008/03/01 12:15:56 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll [2004/08/02 09:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2003/11/25 04:43:11 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis740.bin [2003/11/25 04:43:11 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis650.bin [2003/11/06 09:44:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2003/11/06 06:54:52 | 000,034,403 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini [2003/11/06 06:54:52 | 000,016,558 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini [2003/11/06 06:53:54 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\setuplib.dll [2003/11/06 06:53:54 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\waitwnd.exe [2003/11/06 06:48:39 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pxhpinst.exe [2003/11/06 06:47:00 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2003/11/06 06:46:07 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2003/11/06 06:44:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2003/11/06 06:42:42 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2003/11/06 06:40:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2003/11/06 06:39:57 | 000,147,608 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2003/11/06 06:29:50 | 000,002,862 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/11/06 06:29:42 | 000,449,132 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2003/11/06 06:29:42 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2003/11/06 06:29:42 | 000,080,456 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2003/11/06 06:29:42 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2003/11/06 06:29:17 | 000,432,806 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2003/11/06 06:29:17 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2003/11/06 06:29:17 | 000,067,762 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2003/11/06 06:29:17 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2003/11/06 06:29:16 | 000,004,530 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2003/11/06 06:29:15 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2003/11/06 06:29:13 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2003/11/06 06:29:06 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2003/11/06 06:29:06 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2003/11/06 06:28:58 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2003/11/06 06:28:52 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2003/11/05 04:31:12 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\cbldrm.dll [2002/08/06 05:55:37 | 000,024,576 | ---- | C] () -- C:\WINDOWS\ml-WA3Shutdown.exe [2002/04/02 11:08:36 | 000,372,749 | ---- | C] () -- C:\WINDOWS\ml-uninstall-v10.exe [2002/04/02 11:08:34 | 000,311,590 | ---- | C] () -- C:\WINDOWS\ml-cleanup.exe [2002/04/02 11:08:32 | 000,036,868 | ---- | C] () -- C:\WINDOWS\ml-winamp-shutdown.exe ========== LOP Check ========== [2008/03/07 11:08:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\Canon [2011/04/17 05:26:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\InterTrust [2008/03/14 07:04:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\InterVideo [2011/04/17 05:38:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\ScanSoft [2010/12/09 05:00:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\Start [2011/07/04 05:54:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\+\Anwendungsdaten\TP [2011/07/28 04:06:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GbPlugin [2008/03/14 07:57:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe [2011/06/27 03:59:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files [2011/04/17 05:38:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir [2011/04/17 05:38:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard [2010/10/08 17:22:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 8 bytes -> C:\WINDOWS\System32\drivers:IncompleteBoot.cnt @Alternate Data Stream - 2 bytes -> C:\WINDOWS\system32:73CE1F90_Bb.gbp @Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 @Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84 < End of report > Geändert von ManiacKill (09.08.2011 um 19:26 Uhr) |
09.08.2011, 19:33 | #22 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Trojner Scarware Bundespolizei Bitte mach - wie jeder andere hier auch - für Dein Anliegen einen eigenen Strang auf! Nur so ist sichergestellt, dass jedem übersichtlich und indivuell geholfen werden werden! Thread wird dichtgemacht!
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Trojner Scarware Bundespolizei |
100 euro, abend, behebung, bezahlen, bundespolizei, euro, foren, guten, immer wieder, lap top, otlpe, probleme, programm, recht, scareware, spiel, thema, verändern, wirklich |