| |
| |||||||
Log-Analyse und Auswertung: BKA Trojaner, verdächtige Anwendung gelöscht, System läuft wieder und nu?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
12.08.2011, 00:36
| #1 | ||
| |  BKA Trojaner, verdächtige Anwendung gelöscht, System läuft wieder und nu? Hallo! In Stichworten ist folgendes passiert: -beim surfen verlangt jashl.exe zugriff zum internet -zugriff verweigert (zone alarm) -BKA/Kinderporno/bezahl100Euro Ukash-screen taucht auf -im abgesicherten modus gestartet -jashl im roaming entdeckt und manuell gelöscht -entsprechenden eintrag im autostart deaktiviert -persönliche Daten gesichert -von einem sauberen PC meine Passwörter geändert -neu gestartet -System läuft problemlos Logfile: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 01:14:58, on 12.08.2011 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18639) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Windows\CNYHKey.exe C:\Windows\ModLEDKey.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Alwil Software\Avast5\AvastUI.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Philips\GoGear ARIA Device Manager\GoGear_Aria_DeviceManager.exe C:\Users\Linus\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\CheckPoint\ZAForceField\ForceField.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\regedit.exe C:\Users\Linus\Downloads\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2613550 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll O1 - Hosts: ::1 localhost O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll O3 - Toolbar: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe O4 - HKLM\..\Run: [MoLed] ModLEDKey.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [AuditVista] O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: Dropbox.lnk = C:\Users\Linus\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Philips GoGear ARIA Device Manager.lnk = ? O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Linus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 9060 bytes Was soll das bedeuten....alles Ok, oder wie ich denke auf jeden Fall platt machen? Für alle Forenregelverletzungen im Voraus...Sorry, es ist spät! Wäre toll wenn sich jemand meiner annimmt! Gruß! Static Hier der aktuelle OTL Log (habe zu spät gesehen dass HijackThis nicht mehr erwünscht ist):OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.08.2011 08:50:31 - Run 1 OTL by OldTimer - Version 3.2.26.1 Folder = c:\Users\Linus\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 47,91% Memory free 4,23 Gb Paging File | 2,93 Gb Available in Paging File | 69,29% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 454,10 Gb Total Space | 86,21 Gb Free Space | 18,99% Space Free | Partition Type: NTFS Drive H: | 999,63 Mb Total Space | 746,16 Mb Free Space | 74,64% Space Free | Partition Type: FAT Computer Name: LINUS-PC | User Name: Linus | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.12 01:56:56 | 000,579,584 | ---- | M] (OldTimer Tools) -- c:\Users\Linus\Downloads\OTL.exe PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe PRC - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe PRC - [2011.06.21 15:30:18 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.05.25 22:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\Linus\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2011.02.18 17:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Windows\System32\ZoneLabs\vsmon.exe PRC - [2011.02.18 17:28:38 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe PRC - [2011.02.15 17:25:42 | 000,738,808 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe PRC - [2010.10.27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe PRC - [2010.08.25 11:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac PRC - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2009.07.06 16:52:24 | 001,611,152 | ---- | M] (Philips) -- C:\Philips\GoGear ARIA Device Manager\GoGear_Aria_DeviceManager.exe PRC - [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.05.02 06:15:46 | 000,015,872 | ---- | M] () -- C:\Programme\Unlocker\UnlockerAssistant.exe PRC - [2008.01.18 23:38:40 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.18 23:33:40 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.18 23:33:40 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.18 23:33:32 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2007.10.15 11:15:08 | 001,410,344 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe PRC - [2007.10.15 11:14:48 | 000,202,024 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe PRC - [2007.10.01 11:53:50 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.09.20 10:51:46 | 001,836,328 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe PRC - [2006.11.09 17:15:06 | 000,053,248 | ---- | M] (Chicony) -- C:\Windows\ModLEDKey.exe PRC - [2006.11.09 17:01:02 | 005,585,408 | ---- | M] (Chicony) -- C:\Windows\CNYHKey.exe PRC - [2006.11.02 21:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe ========== Modules (SafeList) ========== MOD - [2011.08.12 01:56:56 | 000,579,584 | ---- | M] (OldTimer Tools) -- c:\Users\Linus\Downloads\OTL.exe MOD - [2011.07.04 13:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\snxhk.dll MOD - [2011.02.15 17:25:56 | 000,640,504 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll MOD - [2010.08.31 17:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll MOD - [2008.07.27 20:03:14 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.3053_none_d08d7bba442a9b36\msvcr80.dll MOD - [2008.07.27 20:03:14 | 000,558,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.3053_none_d08d7bba442a9b36\msvcp80.dll MOD - [2008.05.02 06:15:35 | 000,004,608 | ---- | M] () -- C:\Programme\Unlocker\UnlockerHook.dll ========== Win32 Services (SafeList) ========== SRV - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2011.02.18 17:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon) SRV - [2011.02.15 17:25:48 | 000,488,952 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc) SRV - [2010.07.26 16:01:58 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R) SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2009.08.24 14:16:12 | 000,378,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Disabled | Stopped] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0) SRV - [2006.12.14 02:21:20 | 000,045,056 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV) SRV - [2006.12.14 02:02:08 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV) SRV - [2006.12.14 01:46:16 | 000,057,344 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR) SRV - [2006.11.02 21:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing) SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) ========== Driver Services (SafeList) ========== DRV - [2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011.07.04 13:32:20 | 000,054,104 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2011.02.15 17:25:36 | 000,026,872 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL) DRV - [2010.05.15 16:30:46 | 000,457,304 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant) DRV - [2009.11.12 23:42:16 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss) DRV - [2009.07.25 19:20:37 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2009.05.20 02:24:13 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05) DRV - [2008.11.19 17:09:10 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2008.11.19 17:09:08 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2008.11.19 17:09:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) DRV - [2007.12.05 05:08:10 | 003,351,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.09.17 23:17:36 | 000,098,816 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.04.17 21:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi) DRV - [2007.04.03 11:43:28 | 001,131,136 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32) DRV - [2007.03.26 20:46:00 | 000,827,776 | ---- | M] (Hauppauge Computer Works inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HCW713x.sys -- (HCW713x) DRV - [2007.02.27 16:46:12 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) DRV - [2006.12.22 21:05:34 | 000,449,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athrusb.sys -- (athrusb) DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD) DRV - [2006.10.30 17:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2613550 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13" FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6e: C:\Program Files\VideoLAN\VLC\npvlc.dll File not found FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009.12.28 16:48:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.06.18 13:33:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.21 15:30:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.06.03 22:44:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Linus\AppData\Roaming\mozilla\Extensions [2011.07.30 17:26:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Linus\AppData\Roaming\mozilla\Firefox\Profiles\ygq55tz2.default\extensions [2011.07.30 17:26:45 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Linus\AppData\Roaming\mozilla\Firefox\Profiles\ygq55tz2.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.06.18 13:12:07 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Users\Linus\AppData\Roaming\mozilla\Firefox\Profiles\ygq55tz2.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} [2011.05.25 16:10:48 | 000,000,943 | ---- | M] () -- C:\Users\Linus\AppData\Roaming\Mozilla\Firefox\Profiles\ygq55tz2.default\searchplugins\conduit.xml [2011.07.05 11:24:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.06.20 11:17:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.07.05 11:24:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} File not found (No name found) -- [2011.06.20 11:17:32 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.07.05 11:24:51 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} () (No name found) -- C:\USERS\LINUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YGQ55TZ2.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI () (No name found) -- C:\USERS\LINUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YGQ55TZ2.DEFAULT\EXTENSIONS\{DF4E4DF5-5CB7-46B0-9AEF-6C784C3249F8}.XPI [2009.09.02 03:02:01 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011.06.21 15:30:18 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [AuditVista] File not found O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software) O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies) O4 - HKLM..\Run: [ledpointer] C:\Windows\CNYHKey.exe (Chicony) O4 - HKLM..\Run: [MoLed] C:\Windows\ModLEDKey.exe (Chicony) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - Startup: C:\Users\Linus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Linus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Linus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Programme\WordPerfect Office X3\Programs\WPLauncher.hta () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Linus\Pictures\FOTOS\100KZ730\100_1673.JPG O24 - Desktop BackupWallPaper: C:\Users\Linus\Pictures\FOTOS\100KZ730\100_1673.JPG O28 - HKLM ShellExecuteHooks: {3CF9ECE0-1A9F-11D2-8C73-00C06C2005DE} - C:\Programme\GPSoftware\Directory Opus\dopuslib.dll (GP Software) O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{010e9285-942a-11e0-8c37-001e8c804c7e}\Shell - "" = AutoRun O33 - MountPoints2\{010e9285-942a-11e0-8c37-001e8c804c7e}\Shell\AutoRun\command - "" = L:\LGAutoRun.exe O33 - MountPoints2\{1112d993-7940-11de-a83d-001e8c804c7e}\Shell - "" = AutoRun O33 - MountPoints2\{1112d993-7940-11de-a83d-001e8c804c7e}\Shell\AutoRun\command - "" = J:\Memento_setup.exe O33 - MountPoints2\{55317822-f8aa-11dd-ad52-001e8c804c7e}\Shell - "" = AutoRun O33 - MountPoints2\{55317822-f8aa-11dd-ad52-001e8c804c7e}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a O33 - MountPoints2\{9b0af3c9-d6fb-11df-8783-001e8c804c7e}\Shell\AutoRun\command - "" = K:\Menu.exe O33 - MountPoints2\{b18177ef-1660-11de-9cf0-001e8c804c7e}\Shell\AutoRun\command - "" = q0dhfjf.exe O33 - MountPoints2\{b18177ef-1660-11de-9cf0-001e8c804c7e}\Shell\open\Command - "" = q0dhfjf.exe O33 - MountPoints2\K\Shell - "" = AutoRun O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.08.11 20:10:42 | 000,000,000 | ---D | C] -- C:\Users\Linus\Desktop\desktop aktuell [2011.08.11 19:58:37 | 000,000,000 | ---D | C] -- C:\Users\Linus\Neuer Ordner [2011.08.11 19:47:37 | 000,000,000 | ---D | C] -- C:\Users\Linus\Documents\aufräum [2011.08.09 22:39:30 | 000,000,000 | ---D | C] -- C:\Users\Linus\Desktop\Sören [2011.08.02 12:41:38 | 000,000,000 | ---D | C] -- C:\Users\Linus\AppData\Local\Miro [2011.07.30 17:27:06 | 000,000,000 | ---D | C] -- C:\Users\Linus\AppData\Roaming\DVDVideoSoft [2011.07.29 18:13:42 | 000,000,000 | ---D | C] -- C:\Users\Linus\Documents\restore [2011.07.29 17:53:36 | 000,000,000 | ---D | C] -- C:\ProgramData\tmp [2011.07.29 17:53:31 | 000,000,000 | ---D | C] -- C:\ProgramData\hps [2011.07.29 17:53:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BUDNI Fotowelt [2011.07.29 17:49:23 | 000,000,000 | ---D | C] -- C:\Program Files\BUDNI Fotowelt [2011.07.27 12:27:46 | 000,000,000 | R--D | C] -- C:\Users\Linus\Dropbox [2011.07.27 12:26:29 | 000,000,000 | ---D | C] -- C:\Users\Linus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2011.07.27 12:25:43 | 000,000,000 | ---D | C] -- C:\Users\Linus\AppData\Roaming\Dropbox [2011.07.27 11:29:11 | 000,000,000 | ---D | C] -- C:\Users\Linus\AppData\Roaming\FileZilla [2011.07.27 11:29:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client [2011.07.27 11:29:06 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client [2011.07.20 02:01:42 | 000,000,000 | ---D | C] -- C:\Users\Linus\Desktop\Neuer Ordner (5) [2009.08.31 17:00:18 | 004,301,928 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Slim(2).exe [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.08.12 07:28:10 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.08.12 07:28:10 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.08.12 03:35:57 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.08.12 03:35:57 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.08.12 03:35:57 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.08.12 03:35:57 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.08.12 03:28:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.08.12 00:50:40 | 241,355,582 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011.08.12 00:42:45 | 000,000,155 | ---- | M] () -- C:\Windows\NeroDigital.ini [2011.08.12 00:42:44 | 000,182,272 | ---- | M] () -- C:\Users\Linus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.08.11 21:23:16 | 000,000,680 | ---- | M] () -- C:\Users\Linus\AppData\Local\d3d9caps.dat [2011.08.10 18:55:57 | 000,000,900 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys [2011.08.04 22:33:32 | 000,175,446 | ---- | M] () -- C:\Users\Linus\Documents\Rückseite.ai [2011.08.04 13:18:53 | 000,606,602 | ---- | M] () -- C:\Users\Linus\Documents\cd cover Kopie.pdf [2011.08.04 13:17:35 | 000,458,408 | ---- | M] () -- C:\Users\Linus\Documents\Rückseite Kopie.pdf [2011.08.04 13:01:50 | 000,153,713 | ---- | M] () -- C:\Users\Linus\Documents\cd tracklist.jpg [2011.08.03 18:19:14 | 000,224,596 | ---- | M] () -- C:\Users\Linus\Documents\JGA Cover.ai [2011.08.03 18:18:39 | 000,185,205 | ---- | M] () -- C:\Users\Linus\Documents\tracklist.ai [2011.08.03 15:55:37 | 000,002,509 | ---- | M] () -- C:\Users\Linus\Documents\wedding sampler 1 neu.axp [2011.08.03 15:54:24 | 000,001,891 | ---- | M] () -- C:\Users\Linus\Documents\wedding sampler 2 neu.axp [2011.08.03 15:03:38 | 000,068,081 | ---- | M] () -- C:\Users\Linus\Documents\sjga.dxp [2011.08.03 10:36:39 | 000,002,144 | ---- | M] () -- C:\Users\Linus\Documents\Wedding Sampler 2.axp [2011.08.03 09:57:10 | 000,002,318 | ---- | M] () -- C:\Users\Linus\Documents\Wedding Sampler 1.axp [2011.08.03 09:56:49 | 000,002,318 | ---- | M] () -- C:\Users\Linus\Documents\Wedding Sampler.axp [2011.07.28 16:16:41 | 000,020,120 | ---- | M] () -- C:\Users\Linus\Documents\72292-B9CC628707F2F8D4603481E020FD59C4.qis1.pdf [2011.07.28 08:28:58 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2011.07.27 12:26:40 | 000,000,921 | ---- | M] () -- C:\Users\Linus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.07.21 12:05:48 | 000,013,536 | ---- | M] () -- C:\Users\Linus\Documents\Arbeit und Verdienst.odt [2011.07.13 09:19:20 | 000,308,816 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.08.11 20:08:19 | 000,000,680 | ---- | C] () -- C:\Users\Linus\AppData\Local\d3d9caps.dat [2011.08.04 13:18:34 | 000,606,602 | ---- | C] () -- C:\Users\Linus\Documents\cd cover Kopie.pdf [2011.08.04 13:17:33 | 000,458,408 | ---- | C] () -- C:\Users\Linus\Documents\Rückseite Kopie.pdf [2011.08.04 13:10:18 | 000,175,446 | ---- | C] () -- C:\Users\Linus\Documents\Rückseite.ai [2011.08.04 12:59:46 | 000,153,713 | ---- | C] () -- C:\Users\Linus\Documents\cd tracklist.jpg [2011.08.03 18:19:11 | 000,224,596 | ---- | C] () -- C:\Users\Linus\Documents\JGA Cover.ai [2011.08.03 18:18:30 | 000,185,205 | ---- | C] () -- C:\Users\Linus\Documents\tracklist.ai [2011.08.03 15:23:53 | 000,001,891 | ---- | C] () -- C:\Users\Linus\Documents\wedding sampler 2 neu.axp [2011.08.03 15:21:47 | 000,002,509 | ---- | C] () -- C:\Users\Linus\Documents\wedding sampler 1 neu.axp [2011.08.03 15:03:35 | 000,068,081 | ---- | C] () -- C:\Users\Linus\Documents\sjga.dxp [2011.08.03 10:36:39 | 000,002,144 | ---- | C] () -- C:\Users\Linus\Documents\Wedding Sampler 2.axp [2011.08.03 09:57:09 | 000,002,318 | ---- | C] () -- C:\Users\Linus\Documents\Wedding Sampler 1.axp [2011.08.02 17:02:40 | 000,002,318 | ---- | C] () -- C:\Users\Linus\Documents\Wedding Sampler.axp [2011.07.28 16:16:41 | 000,020,120 | ---- | C] () -- C:\Users\Linus\Documents\72292-B9CC628707F2F8D4603481E020FD59C4.qis1.pdf [2011.07.27 12:26:40 | 000,000,921 | ---- | C] () -- C:\Users\Linus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.07.21 10:22:28 | 000,013,536 | ---- | C] () -- C:\Users\Linus\Documents\Arbeit und Verdienst.odt [2011.04.20 15:51:40 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2011.04.20 15:51:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.10.13 21:54:49 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI [2010.06.03 22:44:12 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.01.03 01:13:37 | 000,073,728 | ---- | C] () -- C:\Windows\System32\VistaInfo32.dll [2009.06.08 13:43:02 | 000,000,425 | ---- | C] () -- C:\Windows\BeatBox.INI [2009.05.23 21:47:27 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat [2009.05.13 02:55:07 | 000,000,155 | ---- | C] () -- C:\Windows\NeroDigital.ini [2009.01.16 23:25:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.09.19 23:57:34 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.09.19 23:54:18 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll [2008.05.20 15:02:54 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2008.05.20 15:02:54 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2008.04.20 16:21:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll [2008.04.20 16:20:21 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2008.04.20 16:19:47 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini [2008.04.04 11:43:17 | 000,000,540 | ---- | C] () -- C:\Windows\Tcsofla.INI [2008.04.04 00:24:50 | 000,000,900 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys [2008.04.03 21:27:16 | 000,182,272 | ---- | C] () -- C:\Users\Linus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.04.03 19:18:01 | 000,000,173 | ---- | C] () -- C:\Windows\KPCMS.INI [2008.04.03 19:17:46 | 000,040,129 | ---- | C] () -- C:\Windows\iccsigs.dat [2008.04.03 19:17:36 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL [2008.04.03 18:54:59 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.04.03 18:26:55 | 000,016,384 | ---- | C] () -- C:\Windows\System32\FileOps.exe [2008.02.08 10:50:27 | 000,000,381 | ---- | C] () -- C:\Windows\WISO.INI [2008.02.08 10:02:12 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI [2008.02.08 09:58:43 | 000,006,212 | ---- | C] () -- C:\Windows\HCWPNP.INI [2008.02.07 11:22:55 | 000,049,152 | ---- | C] () -- C:\Windows\CNYUSB.dll [2008.02.07 11:22:55 | 000,005,120 | ---- | C] () -- C:\Windows\HKCYDLL.dll [2008.02.07 11:22:55 | 000,000,360 | ---- | C] () -- C:\Windows\CNYHKey.ini [2008.02.07 11:17:29 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll [2008.02.07 11:17:29 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe [2008.02.07 11:17:29 | 000,016,384 | ---- | C] () -- C:\Windows\System32\InsDrvZD64.DLL [2008.02.07 11:17:29 | 000,013,312 | ---- | C] () -- C:\Windows\System32\VistaRundll.exe [2008.02.07 10:56:55 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys [2008.02.07 10:47:21 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2008.02.07 10:34:22 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat [2007.12.05 04:56:40 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2007.10.30 22:25:23 | 000,158,081 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2007.08.22 00:51:16 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe [2007.08.21 22:36:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe [2006.11.02 21:40:12 | 000,174,656 | ---- | C] () -- C:\Windows\System32\PSIService.exe [2006.11.02 17:33:31 | 000,628,504 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,126,054 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,308,816 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2004.09.29 13:39:00 | 002,890,320 | ---- | C] () -- C:\Program Files\CADtools.aip ========== Alternate Data Streams ========== @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B606BA34 < End of report > Ich habe wohl einen Trojaner der Goingonearth verlinkt und Mircosoft Security Essentials deaktivieren. Ich habe gestern nacht viel in diesem Forum gelesen und vieles versucht den Virus zu entfernen. Aber ich bin am Ende es klappt einfach nicht oder die programme finden ihn nicht. Meine Frage an euch: Könnt ihr mir vielleicht weiter helfen und einen brauchbaren Tipp geben? Hab mir OTL, aswMBR, SuperAntiSpyware geladen zusammen mit AnitMaleware und SPybot search Destroy durchlaufen lassen. Hier und da wurden wohl kleine Trojaner gefunden aber nicht das goinonearth Teil. SPybot search Destroy findet jedes mal "Microsoft.Windows.SecurityCenter_disabled" aber wirklich behoben wird das problem nicht. Die SecurityCenter bleibt trotzdem deaktiviert. hier ein pic und ein Paar logs... wäre euch echt verbunden wenn mir einer ein Tipp geben kann. Hab noch mal OTL mit einen paar Script hier aus dem Forum durch laufen lassen und dann noch "Trojan Remover" runtergeladen und durchlaufen lassen. Das Programm hat bei 2 Sachen aufgepiept, die andere programme nicht angezeigt haben. Die 2 wurden überschrieben (endung war irgendwas mit "C:windows./.../.. .sys) und nach dem Neustart gab es keine probleme mehr beim googlen "goingonearth" suche blieb aus. Also Trojan Remover = daumen hoch! Allerdings hab ich immer noch das Problem das sich der Sicherheitscenter nicht automatisch aktivieren lassen will... ..ich versuch es nun mal mit dem programm "HitmanPro". HitmanPro hat auch noch was gefunden "Trojan.Win32.Swisyn!IK" id="Ikarus unter Zitat:
Zitat:
+ goingonearth ~ scheint weg zu sein + Micrsoft Sercurity Essetails ~ geht wieder + Defender könnte ich auch wieder aktivieren - Windows-Sicherheitscenterdienst ~ lässt sich nur nicht mehr im Wartungscenter Aktivieren. Aber egal stört mich jetzt nicht. Gruß |
|
15.08.2011, 19:06
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  BKA Trojaner, verdächtige Anwendung gelöscht, System läuft wieder und nu?Zitat:
Bitte danach routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL-Custom im normalen Windows-Modus (kein OTLPE!) CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ |
|
| Themen zu BKA Trojaner, verdächtige Anwendung gelöscht, System läuft wieder und nu? |
| acedrv05.sys, adobe, alternate, antivirus, aswmbr, avast, bho, bka ukash, checkpoint, converter, defender, euro, explorer, firefox, hijack, hijackthis, internet explorer, jashla, locker, mozilla, mp3, msvcrt, nicht angezeigt, photoshop, plug-in, rojaner gefunden, rundll, safer networking, security, server, software, sptd.sys, start menu, studio, surfen, system, trojaner, trojaner gefunden, vista, windows, wmp, zone alarm |
Textbox.
.
Linear-Darstellung
