| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: trojaner..Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
05.09.2011, 15:08
| #1 |
 |  trojaner.. guten tag erstmal ich habe ein problem und zwar ich hatte irend was in facebook gemacht und auf einmal hatte ich einen schwarzen bildschirm. Es war nur mehr die Taskleiste da. Ich habe dann einen kollegen angerufen und er rat mir system wiederherstellung zu machen. das habe ich dann getan. nachdem dachte ich es funkt wider alles aber als ich in einen ordner ging war nichts mehr da -.- es sieht jetzt so aus das in fast allen ordner die daten weg sind aber wenn ich auf eigenschaften gehe wird mir angezeigt das die Datgen noch da sind.. ich habe dann ein bisschen im forum gesucht bei euch und da fand ich einen der hatte das selber problem. Ich ladete mir mal Malwarebytes herunter und machte ein check. (poste ich dan darunter) könnt ihr mir bitte helfen? ich hätte gerne mein daten wider.. mfg ossi DAS IST DAS PROTOKOLL: OTL logfile created on: 05.09.2011 15:31:12 - Run 1 OTL by OldTimer - Version 3.2.27.0 Folder = C:\Dokumente und Einstellungen\ossi\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 43,14% Memory free 4,84 Gb Paging File | 3,01 Gb Available in Paging File | 62,10% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme Drive C: | 390,63 Gb Total Space | 224,61 Gb Free Space | 57,50% Space Free | Partition Type: NTFS Computer Name: SCHATZ-5FC70784 | User Name: ossi | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.05 15:27:39 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ossi\Eigene Dateien\Downloads\OTL.exe PRC - [2011.09.02 14:50:40 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.08.02 18:27:54 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Programme\Steam\steam.exe PRC - [2011.07.06 19:52:38 | 001,047,656 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe PRC - [2011.07.06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.07.01 14:19:09 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.24 22:56:10 | 000,013,088 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\distnoted.exe PRC - [2011.05.25 14:09:18 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe PRC - [2011.05.25 14:06:20 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2011.04.27 18:59:56 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.12.13 13:54:44 | 000,223,400 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Anti-phishing Domain Advisor\visicom_antiphishing.exe PRC - [2010.11.15 15:00:27 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.07.29 12:54:00 | 000,123,392 | ---- | M] (Saitek) -- C:\Programme\Saitek\SD6\Software\SaiMfd.exe PRC - [2010.07.29 12:53:38 | 000,227,840 | ---- | M] (Saitek) -- C:\Programme\Saitek\SD6\Software\ProfilerU.exe PRC - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe PRC - [2010.05.07 19:43:52 | 000,651,096 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe PRC - [2010.05.07 19:35:22 | 000,165,208 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\LWS\Webcam Software\LWS.exe PRC - [2010.05.07 19:34:58 | 000,168,792 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe PRC - [2010.03.07 14:44:49 | 000,386,872 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jucheck.exe PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe PRC - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe PRC - [2009.04.07 11:22:06 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe PRC - [2009.04.07 10:39:44 | 000,233,472 | ---- | M] (Teruten) -- C:\WINXP\system32\FsUsbExService.Exe PRC - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCSVCHST.EXE PRC - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe PRC - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe PRC - [2008.04.14 11:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINXP\explorer.exe PRC - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () -- C:\AppServ\MySQL\bin\mysqld.exe PRC - [2008.02.12 08:40:00 | 000,394,856 | R--- | M] (WinZip Computing, S.L.) -- C:\Programme\WinZip\WZQKPICK.EXE PRC - [2008.01.18 18:37:38 | 000,126,976 | ---- | M] (Saitek) -- C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe PRC - [2008.01.17 19:37:26 | 000,024,635 | ---- | M] (Apache Software Foundation) -- C:\AppServ\Apache2.2\bin\httpd.exe PRC - [2007.09.04 07:44:34 | 000,087,344 | ---- | M] (AVM Berlin) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE PRC - [2006.11.29 09:28:14 | 000,090,112 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe PRC - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2011.09.02 14:50:34 | 001,846,232 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2011.08.15 13:20:54 | 000,077,312 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCoreGecko6.dll MOD - [2011.08.03 18:23:50 | 014,401,832 | ---- | M] () -- C:\Programme\Steam\bin\libcef.dll MOD - [2011.08.03 18:23:41 | 000,190,248 | ---- | M] () -- C:\Programme\Steam\bin\chromehtml.dll MOD - [2011.08.03 18:23:41 | 000,091,432 | ---- | M] () -- C:\Programme\Steam\bin\avutil-50.dll MOD - [2011.08.03 18:23:40 | 000,914,216 | ---- | M] () -- C:\Programme\Steam\bin\avcodec-52.dll MOD - [2011.08.03 18:23:40 | 000,155,432 | ---- | M] () -- C:\Programme\Steam\bin\avformat-52.dll MOD - [2011.07.08 14:38:52 | 006,271,648 | ---- | M] () -- C:\WINXP\system32\Macromed\Flash\NPSWF32.dll MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2010.12.09 18:02:44 | 000,086,696 | ---- | M] () -- C:\Programme\wbtooltb\wbtoolDx.dll MOD - [2010.05.07 19:43:52 | 000,651,096 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe MOD - [2010.05.07 19:37:50 | 000,290,648 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll MOD - [2010.05.07 19:37:40 | 000,126,808 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll MOD - [2010.05.07 19:37:40 | 000,027,480 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll MOD - [2010.05.07 19:36:54 | 000,340,824 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTXml4.dll MOD - [2010.05.07 19:36:20 | 000,921,944 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QtNetwork4.dll MOD - [2010.05.07 19:35:56 | 007,954,776 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTGui4.dll MOD - [2010.05.07 19:35:44 | 002,143,576 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTCore4.dll MOD - [2010.05.07 19:34:58 | 000,168,792 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe MOD - [2010.01.28 14:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe MOD - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe MOD - [2009.05.27 00:45:56 | 000,357,768 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcnet.dll MOD - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe MOD - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe MOD - [2008.09.08 08:27:14 | 000,102,400 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll MOD - [2008.04.14 11:00:00 | 000,355,112 | ---- | M] () -- C:\WINXP\system32\msjetoledb40.dll MOD - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () -- C:\AppServ\MySQL\bin\mysqld.exe MOD - [2008.01.17 19:17:16 | 000,073,782 | ---- | M] () -- C:\AppServ\Apache2.2\bin\zlib1.dll MOD - [2004.07.26 14:41:50 | 000,028,672 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\DetMethod.dll ========== Win32 Services (SafeList) ========== SRV - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.07.01 14:19:09 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.05.25 14:06:20 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2011.04.27 18:59:56 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2010.01.04 21:55:00 | 003,404,560 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINXP\System32\GameMon.des -- (npggsvc) SRV - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC) SRV - [2009.04.07 10:39:44 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\WINXP\system32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) SRV - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp) SRV - [2008.04.07 10:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () [Auto | Running] -- C:\AppServ\MySQL\bin\mysqld.exe -- (mysql) SRV - [2008.01.17 19:37:26 | 000,024,635 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\AppServ\Apache2.2\bin\httpd.exe -- (Apache2.2) SRV - [2007.09.04 07:44:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL) SRV - [2007.08.22 03:21:00 | 000,055,640 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe -- (comHost) SRV - [2003.07.28 09:58:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - [2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | Disabled | Running] -- C:\WINXP\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2011.07.06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINXP\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.07.01 14:19:10 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINXP\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.01 14:19:10 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINXP\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.08.10 10:40:36 | 000,043,656 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiBus.sys -- (SaiNtBus) DRV - [2010.08.10 10:40:36 | 000,020,744 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiMini.sys -- (SaiMini) DRV - [2010.07.16 11:26:26 | 001,511,936 | R--- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\CM106.sys -- (USBMULCD) DRV - [2010.05.15 00:04:20 | 000,023,904 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvuvcflt.sys -- (FilterService) DRV - [2010.05.15 00:04:02 | 006,842,592 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam C210(UVC) DRV - [2010.05.15 00:02:26 | 000,276,448 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvrs.sys -- (LVRS) DRV - [2010.05.15 00:02:14 | 000,114,784 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvpopflt.sys -- (lvpopflt) DRV - [2010.05.07 19:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2009.08.05 23:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINXP\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2009.06.02 21:12:05 | 000,124,464 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2009.05.11 11:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINXP\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.07 10:39:44 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009.03.20 11:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009.03.20 11:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009.03.20 11:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2009.03.17 10:26:58 | 000,447,024 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv) DRV - [2009.02.19 11:01:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SymIM.sys -- (SymIMMP) DRV - [2009.02.19 11:01:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\SymIM.sys -- (SymIM) DRV - [2009.02.19 11:01:16 | 000,184,496 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINXP\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2009.02.19 11:01:16 | 000,096,560 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMFW.SYS -- (SYMFW) DRV - [2009.02.19 11:01:16 | 000,038,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMIDS.SYS -- (SYMIDS) DRV - [2009.02.19 11:01:16 | 000,037,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS) DRV - [2009.02.19 11:01:16 | 000,022,320 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2009.02.19 11:01:16 | 000,013,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMDNS.SYS -- (SYMDNS) DRV - [2009.02.13 10:05:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.08.01 21:36:26 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2008.08.01 21:36:20 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2008.07.30 15:12:12 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\COH_Mon.sys -- (COH_Mon) DRV - [2008.07.26 06:09:24 | 000,845,184 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2008.02.18 15:21:34 | 000,104,960 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiK0728.sys -- (SaiK0728) DRV - [2008.02.15 00:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\monfilt.sys -- (monfilt) DRV - [2008.01.31 20:51:00 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\srtspl.sys -- (SRTSPL) DRV - [2008.01.31 20:51:00 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\WINXP\system32\drivers\srtsp.sys -- (SRTSP) DRV - [2008.01.31 20:51:00 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINXP\system32\drivers\srtspx.sys -- (SRTSPX) DRV - [2008.01.22 04:00:00 | 000,895,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20080122.037\NAVEX15.SYS -- (NAVEX15) DRV - [2008.01.22 04:00:00 | 000,385,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2008.01.22 04:00:00 | 000,109,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2008.01.22 04:00:00 | 000,082,256 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20080122.037\NAVENG.SYS -- (NAVENG) DRV - [2007.12.17 19:14:00 | 000,012,400 | R--- | M] () [Kernel | System | Running] -- C:\WINXP\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007.09.17 16:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007.08.08 19:39:00 | 000,036,056 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINXP\system32\drivers\CO_Mon.sys -- (CO_Mon) DRV - [2007.04.16 14:16:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINXP\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2004.12.23 02:17:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\ULCDRHlp.sys -- (ULCDRHlp) DRV - [2004.08.14 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.babylon.com/?babsrc=HP_ss&affID=18474&mntrId=d0d76f9700000000000000248cbc505c IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = : ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:2.6.0.15 FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.5.2 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.02 14:50:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.08.17 09:51:47 | 000,000,000 | ---D | M] [2009.06.01 20:22:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Extensions [2011.08.31 19:05:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions [2010.06.25 16:41:10 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.08.15 18:47:35 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.01.29 00:28:04 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.08.02 18:38:31 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} [2011.08.19 15:27:58 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.08.30 20:13:28 | 000,000,000 | ---D | M] (Webblog) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{C3947F4E-8894-4C04-98E0-DF182C706DDF} [2011.08.02 18:38:38 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2009.06.09 16:37:13 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009.09.05 18:48:59 | 000,000,000 | ---D | M] (Mouse Gestures Redox) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0} [2011.05.13 14:23:17 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\engine@conduit.com [2011.08.30 20:13:00 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\plugin@yontoo.com [2009.06.15 21:09:49 | 000,000,681 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\ask.xml [2011.01.29 10:44:47 | 000,000,873 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\conduit.xml [2011.09.03 13:34:30 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-1.xml [2009.10.11 00:14:36 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-10.xml [2009.11.07 13:28:02 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-11.xml [2009.12.20 13:54:32 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-12.xml [2010.01.07 11:02:54 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-13.xml [2010.02.20 14:58:56 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-14.xml [2010.03.19 14:48:09 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-15.xml [2010.03.27 13:58:08 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-16.xml [2010.04.04 11:07:16 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-17.xml [2010.06.25 13:29:34 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-18.xml [2010.07.04 18:19:22 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-19.xml [2009.05.31 20:43:37 | 000,000,949 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-2.xml [2010.07.10 14:27:19 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-20.xml [2010.07.25 15:01:41 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-21.xml [2010.08.06 13:38:11 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-22.xml [2010.09.18 12:46:21 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-23.xml [2010.10.27 15:35:53 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-24.xml [2010.10.29 01:36:01 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-25.xml [2010.12.11 13:09:10 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-26.xml [2011.01.01 20:15:33 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-27.xml [2011.03.25 18:52:08 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-28.xml [2011.05.01 11:50:20 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-29.xml [2009.06.01 23:55:16 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-3.xml [2011.05.13 14:25:24 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-30.xml [2011.06.26 13:03:29 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-31.xml [2011.08.15 14:50:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-32.xml [2009.06.02 09:20:07 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-4.xml [2009.06.15 21:32:03 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-5.xml [2009.07.24 17:47:50 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-6.xml [2009.07.25 04:00:40 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-7.xml [2009.08.06 18:14:26 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-8.xml [2009.09.20 18:49:49 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-9.xml [2009.07.13 17:12:02 | 000,000,944 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin.xml [2009.06.07 14:36:16 | 000,001,632 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\live-search.xml [2011.08.30 20:17:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.06.26 12:57:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.08.30 20:17:05 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\OSSI\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\I8LA9A7Z.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\OSSI\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\I8LA9A7Z.DEFAULT\EXTENSIONS\FFXTLBR@FACEMOODS.COM.XPI [2010.03.07 14:44:50 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.09.02 14:50:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2009.03.31 20:17:26 | 000,324,976 | ---- | M] (Symantec Corporation) -- C:\Programme\mozilla firefox\components\coFFPlgn.dll [2011.05.13 14:19:28 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.08.04 16:30:39 | 000,002,226 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml [2011.05.13 14:19:28 | 000,002,252 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.05.13 14:19:28 | 000,001,153 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2010.10.26 17:57:38 | 000,002,036 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\fcmdSrchppcb.xml [2011.05.13 14:19:28 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2010.12.08 23:21:24 | 000,002,224 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\webblog.xml [2011.05.13 14:19:28 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.13 14:19:28 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.04 12:30:31 | 000,000,867 | RHS- | M]) - C:\WINXP\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (PCCBHO.CPCCBHO) - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Programme\Winferno\PC Confidential\PCCBHO.dll (Capital Intellect Inc) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Gemeinsame Dateien\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O2 - BHO: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Programme\wbtooltb\wbtoolDx.dll () O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Programme\wbtooltb\wbtoolDx.dll () O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security)) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.) O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [Cm106Sound] File not found O4 - HKLM..\Run: [facemoods] C:\Programme\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [LWS] C:\Programme\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINXP\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINXP\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINXP\System32\nwiz.exe () O4 - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4 - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4 - HKLM..\Run: [SaiVolume] C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe (Saitek) O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.) O4 - HKCU..\Run: [AdobeUpdater] C:\Programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [FileHunter Check for updates] C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\FileHunter\update.exe () O4 - HKCU..\Run: [Steam] c:\programme\steam\steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINXP\System32\Macromed\Flash\FlashUtil10r_ActiveX.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.) O8 - Extra context menu item: Translate this web page with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Translate with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc) O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4811F097-7FF2-4337-B0DF-F65FE63F8A9A}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINXP\system32\userinit.exe) - C:\WINXP\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.27 00:28:42 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.09.05 15:29:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Malwarebytes [2011.09.05 15:29:14 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbamswissarmy.sys [2011.09.05 15:29:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2011.09.05 15:29:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2011.09.05 15:29:09 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbam.sys [2011.09.05 15:29:09 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.09.02 14:55:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Eigene Dateien\MUKKE [2011.08.30 20:20:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Google [2011.08.30 20:17:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google [2011.08.30 20:15:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [2011.08.30 20:13:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\antiphishing-webblog1_1dn [2011.08.30 20:13:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Anti-phishing Domain Advisor [2011.08.30 20:13:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EmailNotifier [2011.08.30 20:13:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\wbtooltb [2011.08.30 20:13:16 | 000,000,000 | ---D | C] -- C:\Programme\wbtooltb [2011.08.30 20:12:59 | 000,000,000 | ---D | C] -- C:\Programme\Yontoo Layers Runtime [2011.08.30 20:12:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tarma Installer [2011.08.30 20:12:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\FileHunter [2011.08.30 20:11:32 | 000,000,000 | ---D | C] -- C:\WINXP\System32\appmgmt [2011.08.30 19:11:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Lavalys [2011.08.30 19:11:46 | 000,000,000 | ---D | C] -- C:\Programme\Lavalys [2011.08.29 15:40:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\ossi\Eigene Dateien\My Games [2011.08.17 09:59:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes [2011.08.17 09:59:19 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2011.08.17 09:51:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime [2011.08.17 09:51:25 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime [2011.08.17 09:47:51 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2011.08.08 23:43:42 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\ossi\Recent [4 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ] [2 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.05 15:29:14 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.09.05 14:45:10 | 000,001,090 | -H-- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineUA.job [2011.09.05 14:44:55 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk [2011.09.05 14:30:46 | 000,002,206 | -H-- | M] () -- C:\WINXP\System32\wpa.dbl [2011.09.05 14:30:00 | 000,001,086 | -H-- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineCore.job [2011.09.05 14:29:59 | 000,000,400 | -H-- | M] () -- C:\WINXP\tasks\PCConfidential.job [2011.09.05 14:29:59 | 000,000,368 | -H-- | M] () -- C:\WINXP\tasks\Final Media Player Update Checker.job [2011.09.05 14:29:42 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat [2011.08.30 20:18:43 | 000,002,239 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2011.08.30 20:12:34 | 000,001,001 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Desktop\FileHunter.lnk [2011.08.30 19:11:48 | 000,000,747 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Desktop\EVEREST Home Edition.lnk [2011.08.29 22:38:18 | 000,000,656 | -H-- | M] () -- C:\WINXP\tasks\Norton Internet Security - Systemprüfung ausführen - ossi.job [2011.08.29 22:06:01 | 000,000,276 | ---- | M] () -- C:\WINXP\tasks\AppleSoftwareUpdate.job [2011.08.29 15:39:53 | 000,000,219 | RHS- | M] () -- C:\boot.ini [2011.08.28 15:27:42 | 000,000,077 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Desktop\Borderlands.url [2011.08.18 13:19:22 | 000,000,664 | ---- | M] () -- C:\WINXP\System32\d3d9caps.dat [2011.08.17 10:02:22 | 000,001,842 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Safari.lnk [2011.08.17 09:59:57 | 000,001,518 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2011.08.17 09:51:41 | 000,001,580 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2011.08.08 14:10:06 | 000,204,551 | -H-- | M] () -- C:\WINXP\System32\nvapps.xml [4 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ] [2 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.05 15:29:14 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.08.30 20:15:53 | 000,002,239 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2011.08.30 20:12:34 | 000,001,001 | ---- | C] () -- C:\Dokumente und Einstellungen\ossi\Desktop\FileHunter.lnk [2011.08.30 19:11:48 | 000,000,747 | ---- | C] () -- C:\Dokumente und Einstellungen\ossi\Desktop\EVEREST Home Edition.lnk [2011.08.28 15:27:42 | 000,000,077 | ---- | C] () -- C:\Dokumente und Einstellungen\ossi\Desktop\Borderlands.url [2011.08.18 13:12:59 | 000,000,664 | ---- | C] () -- C:\WINXP\System32\d3d9caps.dat [2011.08.17 10:02:22 | 000,001,842 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Safari.lnk [2011.08.17 09:59:57 | 000,001,518 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2011.08.17 09:51:41 | 000,001,580 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2011.08.17 09:39:43 | 000,000,276 | ---- | C] () -- C:\WINXP\tasks\AppleSoftwareUpdate.job [2011.08.17 09:39:38 | 000,001,826 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Apple Software Update.lnk [2011.06.21 19:54:19 | 000,000,030 | ---- | C] () -- C:\WINXP\Iedit_.INI [2011.06.04 16:47:53 | 000,000,117 | -H-- | C] () -- C:\WINXP\Cm106.ini.cfl [2011.06.04 16:47:32 | 000,001,249 | R--- | C] () -- C:\WINXP\Cm106.ini.cfg [2011.06.04 16:47:18 | 000,000,695 | R--- | C] () -- C:\WINXP\cm106.ini [2011.02.21 16:27:42 | 000,000,008 | -H-- | C] () -- C:\WINXP\System32\nvModes.dat [2010.12.17 22:30:44 | 000,002,512 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2010.05.14 23:56:06 | 010,830,680 | ---- | C] () -- C:\WINXP\System32\LogiDPP.dll [2010.05.14 23:56:06 | 000,102,744 | ---- | C] () -- C:\WINXP\System32\LogiDPPApp.exe [2010.05.14 23:55:58 | 000,290,648 | ---- | C] () -- C:\WINXP\System32\DevManagerCore.dll [2010.05.14 23:47:00 | 000,090,071 | ---- | C] () -- C:\WINXP\System32\lvcoinst.ini [2010.05.07 19:46:36 | 000,014,168 | ---- | C] () -- C:\WINXP\System32\drivers\iKeyLFT2.dll [2010.05.07 19:43:30 | 000,025,824 | ---- | C] () -- C:\WINXP\System32\drivers\LVPr2Mon.sys [2010.03.19 16:02:53 | 000,110,592 | ---- | C] () -- C:\WINXP\System32\FsUsbExDevice.Dll [2010.03.19 16:02:53 | 000,036,608 | ---- | C] () -- C:\WINXP\System32\FsUsbExDisk.Sys [2010.03.19 16:02:36 | 000,002,528 | -H-- | C] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\$_hpcst$.hpc [2010.01.28 21:05:03 | 000,065,916 | -H-- | C] () -- C:\WINXP\System32\mlfcache.dat [2010.01.24 21:28:21 | 000,022,328 | ---- | C] () -- C:\WINXP\System32\drivers\PnkBstrK.sys [2010.01.24 21:28:21 | 000,022,328 | ---- | C] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\PnkBstrK.sys [2010.01.24 21:27:49 | 000,103,736 | ---- | C] () -- C:\WINXP\System32\PnkBstrB.exe [2010.01.24 21:27:32 | 000,066,872 | ---- | C] () -- C:\WINXP\System32\PnkBstrA.exe [2010.01.24 21:27:27 | 000,000,311 | ---- | C] () -- C:\WINXP\game.ini [2010.01.17 21:18:08 | 000,000,111 | ---- | C] () -- C:\WINXP\GMouse.ini [2009.11.24 22:08:28 | 000,056,917 | -H-- | C] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\mdbu.bin [2009.10.11 19:28:38 | 000,394,240 | ---- | C] () -- C:\WINXP\System32\Smab.dll [2009.10.11 19:28:37 | 000,502,784 | ---- | C] () -- C:\WINXP\x2.64.exe [2009.10.11 19:28:37 | 000,240,128 | ---- | C] () -- C:\WINXP\System32\x.264.exe [2009.10.11 19:28:37 | 000,217,073 | ---- | C] () -- C:\WINXP\meta4.exe [2009.10.11 19:28:37 | 000,066,560 | ---- | C] () -- C:\WINXP\MOTA113.exe [2009.10.11 19:28:37 | 000,027,648 | ---- | C] () -- C:\WINXP\System32\AVSredirect.dll [2009.10.09 15:17:41 | 001,073,152 | ---- | C] () -- C:\WINXP\System32\libmysql_c.dll [2009.07.16 23:24:28 | 000,000,039 | -H-- | C] () -- C:\WINXP\popcinfot.dat [2009.06.11 12:34:32 | 000,043,520 | ---- | C] () -- C:\WINXP\System32\CmdLineExt03.dll [2009.05.29 13:18:23 | 000,000,056 | -H-- | C] () -- C:\WINXP\System32\ezsidmv.dat [2009.05.29 13:15:17 | 000,001,156 | -H-- | C] () -- C:\WINXP\mozver.dat [2009.05.27 14:23:30 | 000,000,000 | -H-- | C] () -- C:\WINXP\nsreg.dat [2009.05.27 13:21:08 | 000,007,680 | ---- | C] () -- C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.05.27 00:43:02 | 000,026,448 | ---- | C] () -- C:\WINXP\Ascd_log.ini [2009.05.27 00:40:51 | 000,005,810 | R--- | C] () -- C:\WINXP\System32\drivers\ASACPI.sys [2009.05.27 00:40:45 | 000,026,410 | ---- | C] () -- C:\WINXP\Ascd_tmp.ini [2009.05.27 00:40:45 | 000,010,296 | ---- | C] () -- C:\WINXP\System32\drivers\ASUSHWIO.SYS [2009.05.27 00:31:07 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat [2009.05.27 00:26:20 | 000,021,740 | -H-- | C] () -- C:\WINXP\System32\emptyregdb.dat [2009.05.26 22:39:58 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI [2009.05.26 22:38:59 | 000,336,256 | -H-- | C] () -- C:\WINXP\System32\FNTCACHE.DAT [2009.05.26 20:55:03 | 000,000,394 | ---- | C] () -- C:\WINXP\ODBC.INI [2009.05.26 20:13:53 | 000,024,576 | R--- | C] () -- C:\WINXP\System32\AsIO.dll [2009.05.26 20:13:53 | 000,012,400 | R--- | C] () -- C:\WINXP\System32\drivers\AsIO.sys [2009.05.26 20:13:52 | 000,011,832 | ---- | C] () -- C:\WINXP\System32\drivers\AsInsHelp64.sys [2009.05.26 20:13:52 | 000,010,216 | ---- | C] () -- C:\WINXP\System32\drivers\AsInsHelp32.sys [2009.05.26 19:57:12 | 000,004,984 | RH-- | C] () -- C:\WINXP\System32\drivers\nvphy.bin [2008.10.07 06:43:30 | 000,197,912 | ---- | C] () -- C:\WINXP\System32\physxcudart_20.dll [2008.10.07 06:43:22 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelTraditionalChinese.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSwedish.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSpanish.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelPortugese.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelKorean.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelJapanese.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelGerman.dll [2008.10.07 06:43:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelFrench.dll [2008.08.02 00:48:00 | 001,724,416 | ---- | C] () -- C:\WINXP\System32\nvwdmcpl.dll [2008.08.02 00:48:00 | 001,657,376 | ---- | C] () -- C:\WINXP\System32\nwiz.exe [2008.08.02 00:48:00 | 001,507,328 | ---- | C] () -- C:\WINXP\System32\nview.dll [2008.08.02 00:48:00 | 001,346,080 | ---- | C] () -- C:\WINXP\System32\nvdspsch.exe [2008.08.02 00:48:00 | 001,101,824 | ---- | C] () -- C:\WINXP\System32\nvwimg.dll [2008.08.02 00:48:00 | 000,466,944 | ---- | C] () -- C:\WINXP\System32\nvshell.dll [2008.08.02 00:48:00 | 000,449,056 | ---- | C] () -- C:\WINXP\System32\nvappbar.exe [2008.08.02 00:48:00 | 000,436,768 | ---- | C] () -- C:\WINXP\System32\keystone.exe [2008.08.02 00:48:00 | 000,286,720 | ---- | C] () -- C:\WINXP\System32\nvnt4cpl.dll [2008.05.08 11:15:34 | 000,043,370 | ---- | C] () -- C:\WINXP\php.ini [2008.05.07 21:17:10 | 002,076,672 | ---- | C] () -- C:\WINXP\System32\libmysql.dll [2008.04.14 11:00:00 | 013,107,200 | -H-- | C] () -- C:\WINXP\System32\oembios.bin [2008.04.14 11:00:00 | 000,673,088 | -H-- | C] () -- C:\WINXP\System32\mlang.dat [2008.04.14 11:00:00 | 000,452,740 | -H-- | C] () -- C:\WINXP\System32\perfh007.dat [2008.04.14 11:00:00 | 000,435,990 | -H-- | C] () -- C:\WINXP\System32\perfh009.dat [2008.04.14 11:00:00 | 000,272,128 | -H-- | C] () -- C:\WINXP\System32\perfi009.dat [2008.04.14 11:00:00 | 000,269,480 | -H-- | C] () -- C:\WINXP\System32\perfi007.dat [2008.04.14 11:00:00 | 000,218,003 | -H-- | C] () -- C:\WINXP\System32\dssec.dat [2008.04.14 11:00:00 | 000,081,470 | -H-- | C] () -- C:\WINXP\System32\perfc007.dat [2008.04.14 11:00:00 | 000,068,694 | -H-- | C] () -- C:\WINXP\System32\perfc009.dat [2008.04.14 11:00:00 | 000,046,258 | -H-- | C] () -- C:\WINXP\System32\mib.bin [2008.04.14 11:00:00 | 000,034,478 | -H-- | C] () -- C:\WINXP\System32\perfd007.dat [2008.04.14 11:00:00 | 000,028,626 | -H-- | C] () -- C:\WINXP\System32\perfd009.dat [2008.04.14 11:00:00 | 000,004,569 | -H-- | C] () -- C:\WINXP\System32\secupd.dat [2008.04.14 11:00:00 | 000,004,463 | -H-- | C] () -- C:\WINXP\System32\oembios.dat [2008.04.14 11:00:00 | 000,001,804 | -H-- | C] () -- C:\WINXP\System32\Dcache.bin [2008.04.14 11:00:00 | 000,000,741 | -H-- | C] () -- C:\WINXP\System32\noise.dat [2007.10.25 18:26:10 | 000,005,632 | ---- | C] () -- C:\WINXP\System32\drivers\StarOpen.sys [2003.02.20 15:23:42 | 000,005,702 | ---- | C] () -- C:\WINXP\System32\OUTLPERF.INI < End of report > |
|
05.09.2011, 15:15
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | trojaner..Zitat:
__________________ |
|
05.09.2011, 15:21
| #3 |
| | trojaner.. Malwarebytes' Anti-Malware 1.51.1.1800
__________________www.malwarebytes.org Datenbank Version: 7655 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 05.09.2011 16:00:03 mbam-log-2011-09-05 (16-00-03).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 191876 Laufzeit: 12 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 7 Infizierte Registrierungswerte: 4 Infizierte Dateiobjekte der Registrierung: 3 Infizierte Verzeichnisse: 3 Infizierte Dateien: 9 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileHunter (PUP.FileHunter) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\ToolBand.XTTBPos00.1 (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\ToolBand.XTTBPos00 (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FileHunter Check for updates (PUP.FileHunter) -> Value: FileHunter Check for updates -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_XMLLookup (Hijacker.XMLLookup) -> Value: bak_XMLLookup -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_intl (Hijacker.intl) -> Value: bak_intl -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\XMLLookup (Hijacker.XMLLookup) -> Bad: (hxxp://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (hxxp://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (hxxp://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (hxxp://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\intl (Hijacker.intl) -> Bad: (hxxp://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (hxxp://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\downloads (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\metafiles (PUP.FileHunter) -> Quarantined and deleted successfully. Infizierte Dateien: c:\dokumente und einstellungen\ossi\lokale einstellungen\Temp\1.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\lokale einstellungen\Temp\filehunter-win32.exe (Adware.BHO) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\pumpa.state (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\filehunter.exe (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\pumpa.exe (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\uninstall.exe (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\update.exe (PUP.FileHunter) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\ossi\anwendungsdaten\filehunter\version (PUP.FileHunter) -> Quarantined and deleted successfully. c:\programme\icqtoolbar\toolbaru.dll (Trojan.BHO) -> Delete on reboot. |
|
05.09.2011, 20:59
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | trojaner..Zitat:
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
06.09.2011, 21:39
| #5 |
| | trojaner.. danke das du dir zeit nimmst für mich! Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Datenbank Version: 7655 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 06.09.2011 17:58:54 mbam-log-2011-09-06 (17-58-54).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 359272 Laufzeit: 1 Stunde(n), 29 Minute(n), 31 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) 16:46:54 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:46:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:47:03 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:48:38 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:48:41 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:48:47 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:50:38 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:50:41 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 16:50:47 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:33:15 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:33:18 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:33:24 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:34:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:35:00 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:35:06 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:36:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:37:00 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 17:37:06 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:17:55 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:17:58 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:18:04 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:19:53 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:19:56 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:20:02 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:21:53 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:21:56 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 18:22:02 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:03:52 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:03:55 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:04:01 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:05:51 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:05:54 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:05:59 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:07:51 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:07:53 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:07:59 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:49:50 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:49:53 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:49:59 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:51:48 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:51:51 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:51:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:53:48 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:53:51 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 19:53:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:34:36 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:34:39 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:34:45 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:36:34 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:36:37 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:36:43 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:38:34 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:38:37 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 20:38:43 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:21:12 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:21:15 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:21:21 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:23:10 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:23:13 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:23:19 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:25:10 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:25:13 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 21:25:19 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:10:48 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:10:51 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:10:57 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:12:46 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:12:49 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:12:55 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:14:46 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:14:49 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:14:55 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:23:27 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:23:30 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:23:36 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:25:25 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:25:28 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:25:34 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:27:25 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:27:28 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) 22:27:34 ossi IP-BLOCK 64.120.141.163 (Type: outgoing) |
|
07.09.2011, 10:12
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | trojaner.. Führe auch bitte ESET aus, danach sehen wir weiter. ESET Online Scanner
n.
__________________ --> trojaner.. |
|
07.09.2011, 13:59
| #7 |
| | trojaner.. hmm komisch habe heute den rechner hoch gefahren und auf einmal sind alle daten wider da aber sie sind alle so durch sichtig.. scan läuft gerade Geändert von ossi18 (07.09.2011 um 14:10 Uhr) |
|
07.09.2011, 14:06
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | trojaner.. Ja ist ja schön, was ist jetzt mit ESET?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.09.2011, 14:21
| #9 |
| | trojaner.. scan läuft noch.. |
|
07.09.2011, 14:32
| #10 |
| | trojaner.. ach ja und noch was mein skype geht auch nicht mehr  wenn ich es öffne dann kommt immer die meldung : "Dieses Programm wurde aus Sicherheitsgründen gerschlossen." ist das wegen den Viren? |
|
07.09.2011, 16:57
| #11 |
| | trojaner.. ESET: ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=1 esets_scanner_update returned -1 esets_gle=1 esets_scanner_update returned -1 esets_gle=1 esets_scanner_update returned -1 esets_gle=1 ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=e211be9df37a4249a7548fc86a7a1fa0 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-07 03:03:52 # local_time=2011-09-07 05:03:52 (+0100, Westeuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1797 16775141 100 100 351288 90306252 167543 0 # compatibility_mode=3586 16764906 60 14 72022684 114117468 0 0 # compatibility_mode=8192 67108863 100 0 1131 1131 0 0 # scanned=172591 # found=7 # cleaned=0 # scan_time=7144 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application (unable to clean) 00000000000000000000000000000000 I C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Temp\YontooIEClient.dll a variant of Win32/Adware.Yontoo.A application (unable to clean) 00000000000000000000000000000000 I C:\Programme\Winferno\PC Confidential\PCCBHO.dll Win32/Adware.PCConfidential application (unable to clean) 00000000000000000000000000000000 I C:\Programme\Winferno\PC Confidential\PCConfidential.exe Win32/Adware.PCConfidential application (unable to clean) 00000000000000000000000000000000 I C:\Programme\Winferno\PC Confidential\PCCST.exe Win32/Adware.PCConfidential application (unable to clean) 00000000000000000000000000000000 I C:\Programme\Yontoo Layers Runtime\YontooIEClient.dll a variant of Win32/Adware.Yontoo.A application (unable to clean) 00000000000000000000000000000000 I ${Memory} multiple threats 00000000000000000000000000000000 I |
|
07.09.2011, 19:31
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | trojaner.. CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
07.09.2011, 21:59
| #13 |
| | trojaner.. mhm irgendwie kann ich es nicht posten.. |
|
07.09.2011, 22:00
| #14 |
| | trojaner.. ahh. erster Teil: OTL logfile created on: 07.09.2011 22:28:32 - Run 1 OTL by OldTimer - Version 3.2.27.0 Folder = C:\Dokumente und Einstellungen\ossi\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,65 Gb Available Physical Memory | 55,07% Memory free 4,84 Gb Paging File | 3,46 Gb Available in Paging File | 71,45% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme Drive C: | 390,63 Gb Total Space | 224,89 Gb Free Space | 57,57% Space Free | Partition Type: NTFS Computer Name: SCHATZ-5FC70784 | User Name: ossi | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.07 22:27:19 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\ossi\Eigene Dateien\Downloads\OTL(1).exe PRC - [2011.07.06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.07.01 14:19:09 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.05.25 14:06:20 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2011.04.27 18:59:56 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.12.13 13:54:44 | 000,223,400 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Anti-phishing Domain Advisor\visicom_antiphishing.exe PRC - [2010.11.15 15:00:27 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.07.29 12:54:00 | 000,123,392 | ---- | M] (Saitek) -- C:\Programme\Saitek\SD6\Software\SaiMfd.exe PRC - [2010.07.29 12:53:38 | 000,227,840 | ---- | M] (Saitek) -- C:\Programme\Saitek\SD6\Software\ProfilerU.exe PRC - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe PRC - [2010.05.07 19:43:52 | 000,651,096 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe PRC - [2010.05.07 19:35:22 | 000,165,208 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\LWS\Webcam Software\LWS.exe PRC - [2010.05.07 19:34:58 | 000,168,792 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe PRC - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe PRC - [2009.04.07 11:22:06 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe PRC - [2009.04.07 10:39:44 | 000,233,472 | ---- | M] (Teruten) -- C:\WINXP\system32\FsUsbExService.Exe PRC - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCSVCHST.EXE PRC - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe PRC - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe PRC - [2008.04.14 11:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINXP\explorer.exe PRC - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () -- C:\AppServ\MySQL\bin\mysqld.exe PRC - [2008.02.12 08:40:00 | 000,394,856 | R--- | M] (WinZip Computing, S.L.) -- C:\Programme\WinZip\WZQKPICK.EXE PRC - [2008.01.18 18:37:38 | 000,126,976 | ---- | M] (Saitek) -- C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe PRC - [2008.01.17 19:37:26 | 000,024,635 | ---- | M] (Apache Software Foundation) -- C:\AppServ\Apache2.2\bin\httpd.exe PRC - [2007.09.04 07:44:34 | 000,087,344 | ---- | M] (AVM Berlin) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE PRC - [2006.11.29 09:28:14 | 000,090,112 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe PRC - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE ========== Modules (No Company Name) ========== MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2010.12.09 18:02:44 | 000,086,696 | ---- | M] () -- C:\Programme\wbtooltb\wbtoolDx.dll MOD - [2010.05.07 19:43:52 | 000,651,096 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe MOD - [2010.05.07 19:37:50 | 000,290,648 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll MOD - [2010.05.07 19:37:40 | 000,126,808 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll MOD - [2010.05.07 19:37:40 | 000,027,480 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll MOD - [2010.05.07 19:36:54 | 000,340,824 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTXml4.dll MOD - [2010.05.07 19:36:20 | 000,921,944 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QtNetwork4.dll MOD - [2010.05.07 19:35:56 | 007,954,776 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTGui4.dll MOD - [2010.05.07 19:35:44 | 002,143,576 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTCore4.dll MOD - [2010.05.07 19:34:58 | 000,168,792 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe MOD - [2010.01.28 14:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe MOD - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe MOD - [2009.05.27 00:45:56 | 000,357,768 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcnet.dll MOD - [2008.09.16 17:48:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe MOD - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe MOD - [2008.09.08 08:27:14 | 000,102,400 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll MOD - [2008.04.14 11:00:00 | 000,355,112 | ---- | M] () -- C:\WINXP\system32\msjetoledb40.dll MOD - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () -- C:\AppServ\MySQL\bin\mysqld.exe MOD - [2008.01.17 19:17:16 | 000,073,782 | ---- | M] () -- C:\AppServ\Apache2.2\bin\zlib1.dll MOD - [2004.07.26 14:41:50 | 000,028,672 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\DetMethod.dll ========== Win32 Services (SafeList) ========== SRV - [2011.07.06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.07.01 14:19:09 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.05.25 14:06:20 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2011.04.27 18:59:56 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2010.01.04 21:55:00 | 003,404,560 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINXP\System32\GameMon.des -- (npggsvc) SRV - [2009.06.01 22:20:12 | 000,222,968 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2009.05.27 00:45:56 | 001,245,064 | ---- | M] () [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC) SRV - [2009.04.07 10:39:44 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\WINXP\system32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2008.10.17 13:22:10 | 000,149,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2008.09.08 08:40:20 | 000,450,560 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) SRV - [2008.09.08 08:39:40 | 000,184,320 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp) SRV - [2008.04.07 10:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008.02.13 12:00:20 | 007,336,576 | ---- | M] () [Auto | Running] -- C:\AppServ\MySQL\bin\mysqld.exe -- (mysql) SRV - [2008.01.17 19:37:26 | 000,024,635 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\AppServ\Apache2.2\bin\httpd.exe -- (Apache2.2) SRV - [2007.09.04 07:44:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL) SRV - [2007.08.22 03:21:00 | 000,055,640 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe -- (comHost) SRV - [2003.07.28 09:58:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - [2011.07.06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINXP\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.07.01 14:19:10 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINXP\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.01 14:19:10 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINXP\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.08.10 10:40:36 | 000,043,656 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiBus.sys -- (SaiNtBus) DRV - [2010.08.10 10:40:36 | 000,020,744 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiMini.sys -- (SaiMini) DRV - [2010.07.16 11:26:26 | 001,511,936 | R--- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\CM106.sys -- (USBMULCD) DRV - [2010.05.15 00:04:20 | 000,023,904 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvuvcflt.sys -- (FilterService) DRV - [2010.05.15 00:04:02 | 006,842,592 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam C210(UVC) DRV - [2010.05.15 00:02:26 | 000,276,448 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvrs.sys -- (LVRS) DRV - [2010.05.15 00:02:14 | 000,114,784 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\lvpopflt.sys -- (lvpopflt) DRV - [2010.05.07 19:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2009.08.05 23:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINXP\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2009.06.02 21:12:05 | 000,124,464 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2009.05.11 11:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINXP\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.07 10:39:44 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009.03.20 11:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009.03.20 11:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009.03.20 11:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2009.03.17 10:26:58 | 000,447,024 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv) DRV - [2009.02.19 11:01:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SymIM.sys -- (SymIMMP) DRV - [2009.02.19 11:01:42 | 000,031,280 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\SymIM.sys -- (SymIM) DRV - [2009.02.19 11:01:16 | 000,184,496 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINXP\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2009.02.19 11:01:16 | 000,096,560 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMFW.SYS -- (SYMFW) DRV - [2009.02.19 11:01:16 | 000,038,576 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMIDS.SYS -- (SYMIDS) DRV - [2009.02.19 11:01:16 | 000,037,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS) DRV - [2009.02.19 11:01:16 | 000,022,320 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2009.02.19 11:01:16 | 000,013,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\System32\Drivers\SYMDNS.SYS -- (SYMDNS) DRV - [2009.02.13 10:05:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.08.01 21:36:26 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2008.08.01 21:36:20 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2008.07.30 15:12:12 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\COH_Mon.sys -- (COH_Mon) DRV - [2008.07.26 06:09:24 | 000,845,184 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2008.02.18 15:21:34 | 000,104,960 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\SaiK0728.sys -- (SaiK0728) DRV - [2008.02.15 00:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\monfilt.sys -- (monfilt) DRV - [2008.01.31 20:51:00 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\srtspl.sys -- (SRTSPL) DRV - [2008.01.31 20:51:00 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\WINXP\system32\drivers\srtsp.sys -- (SRTSP) DRV - [2008.01.31 20:51:00 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINXP\system32\drivers\srtspx.sys -- (SRTSPX) DRV - [2008.01.22 04:00:00 | 000,895,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20080122.037\NAVEX15.SYS -- (NAVEX15) DRV - [2008.01.22 04:00:00 | 000,385,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2008.01.22 04:00:00 | 000,109,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2008.01.22 04:00:00 | 000,082,256 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20080122.037\NAVENG.SYS -- (NAVENG) DRV - [2007.12.17 19:14:00 | 000,012,400 | R--- | M] () [Kernel | System | Running] -- C:\WINXP\system32\drivers\AsIO.sys -- (AsIO) DRV - [2007.09.17 16:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINXP\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007.08.08 19:39:00 | 000,036,056 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINXP\system32\drivers\CO_Mon.sys -- (CO_Mon) DRV - [2007.04.16 14:16:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINXP\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2004.12.23 02:17:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\ULCDRHlp.sys -- (ULCDRHlp) DRV - [2004.08.14 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINXP\system32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = : ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:2.6.0.15 FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.5.2 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.02 14:50:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.08.17 09:51:47 | 000,000,000 | ---D | M] [2009.06.01 20:22:07 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Extensions [2011.09.07 14:42:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions [2010.06.25 16:41:10 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.08.15 18:47:35 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.01.29 00:28:04 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.08.02 18:38:31 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} [2011.08.19 15:27:58 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.08.30 20:13:28 | 000,000,000 | ---D | M] (Webblog) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{C3947F4E-8894-4C04-98E0-DF182C706DDF} [2011.08.02 18:38:38 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2011.09.07 14:42:24 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2009.06.09 16:37:13 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009.09.05 18:48:59 | 000,000,000 | ---D | M] (Mouse Gestures Redox) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0} [2011.05.13 14:23:17 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\engine@conduit.com [2011.08.30 20:13:00 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\extensions\plugin@yontoo.com [2009.06.15 21:09:49 | 000,000,681 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\ask.xml [2011.01.29 10:44:47 | 000,000,873 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\conduit.xml [2011.09.03 13:34:30 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-1.xml [2009.10.11 00:14:36 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-10.xml [2009.11.07 13:28:02 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-11.xml [2009.12.20 13:54:32 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-12.xml [2010.01.07 11:02:54 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-13.xml [2010.02.20 14:58:56 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-14.xml [2010.03.19 14:48:09 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-15.xml [2010.03.27 13:58:08 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-16.xml [2010.04.04 11:07:16 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-17.xml [2010.06.25 13:29:34 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-18.xml [2010.07.04 18:19:22 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-19.xml [2009.05.31 20:43:37 | 000,000,949 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-2.xml [2010.07.10 14:27:19 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-20.xml [2010.07.25 15:01:41 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-21.xml [2010.08.06 13:38:11 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-22.xml [2010.09.18 12:46:21 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-23.xml [2010.10.27 15:35:53 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-24.xml [2010.10.29 01:36:01 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-25.xml [2010.12.11 13:09:10 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-26.xml [2011.01.01 20:15:33 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-27.xml [2011.03.25 18:52:08 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-28.xml [2011.05.01 11:50:20 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-29.xml [2009.06.01 23:55:16 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-3.xml [2011.05.13 14:25:24 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-30.xml [2011.06.26 13:03:29 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-31.xml [2011.08.15 14:50:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-32.xml [2009.06.02 09:20:07 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-4.xml [2009.06.15 21:32:03 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-5.xml [2009.07.24 17:47:50 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-6.xml [2009.07.25 04:00:40 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-7.xml [2009.08.06 18:14:26 | 000,000,950 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-8.xml [2009.09.20 18:49:49 | 000,000,961 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin-9.xml [2009.07.13 17:12:02 | 000,000,944 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\icqplugin.xml [2009.06.07 14:36:16 | 000,001,632 | -H-- | M] () -- C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\Mozilla\Firefox\Profiles\i8la9a7z.default\searchplugins\live-search.xml [2011.08.30 20:17:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.06.26 12:57:28 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.08.30 20:17:05 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\OSSI\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\I8LA9A7Z.DEFAULT\EXTENSIONS\FFXTLBR@FACEMOODS.COM.XPI [2010.03.07 14:44:50 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.09.02 14:50:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2009.03.31 20:17:26 | 000,324,976 | ---- | M] (Symantec Corporation) -- C:\Programme\mozilla firefox\components\coFFPlgn.dll [2011.05.13 14:19:28 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.08.04 16:30:39 | 000,002,226 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml [2011.05.13 14:19:28 | 000,002,252 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.05.13 14:19:28 | 000,001,153 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2010.10.26 17:57:38 | 000,002,036 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\fcmdSrchppcb.xml [2011.05.13 14:19:28 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2010.12.08 23:21:24 | 000,002,224 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\webblog.xml [2011.05.13 14:19:28 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.13 14:19:28 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.04 12:30:31 | 000,000,867 | RHS- | M]) - C:\WINXP\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (PCCBHO.CPCCBHO) - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Programme\Winferno\PC Confidential\PCCBHO.dll (Capital Intellect Inc) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Gemeinsame Dateien\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O2 - BHO: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Programme\wbtooltb\wbtoolDx.dll () O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Webblog) - {C3947F4E-8894-4C04-98E0-DF182C706DDF} - C:\Programme\wbtooltb\wbtoolDx.dll () O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Programme\myBabylon_English\prxtbmyB0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security)) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.) O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [Cm106Sound] File not found O4 - HKLM..\Run: [facemoods] C:\Programme\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [LWS] C:\Programme\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINXP\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINXP\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINXP\System32\nwiz.exe () O4 - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek) O4 - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek) O4 - HKLM..\Run: [SaiVolume] C:\Programme\Saitek\CyborgKeyboard\SaiVolume.exe (Saitek) O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.) O4 - HKCU..\Run: [AdobeUpdater] C:\Programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [Steam] c:\programme\steam\steam.exe (Valve Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\ossi\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.) O8 - Extra context menu item: Translate this web page with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O8 - Extra context menu item: Translate with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc) O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINXP\system32\nvLsp.dll (NVIDIA) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4811F097-7FF2-4337-B0DF-F65FE63F8A9A}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINXP\system32\userinit.exe) - C:\WINXP\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\ossi\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.27 00:28:42 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: osCheck - hkey= - key= - C:\Programme\Norton Internet Security\osCheck.exe (Symantec Corporation) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices |
|
07.09.2011, 22:01
| #15 |
| | trojaner.. hat versehendlich 2mal gepostet |
|
| Themen zu trojaner.. |
| 0x00000001, antivir, askbar, avira, bho, bonjour, conduit, converter, desktop, dsl, einstellungen, email, error, firefox, fontcache, format, google, google earth, intrusion prevention, logfile, mozilla, mp3, object, plug-in, problem, registry, scan, security, software, studio, symantec, system, system wiederherstellung, tarma, updates, version=1.0, yontoo |
Textbox.
.
Linear-Darstellung
