|
Plagegeister aller Art und deren Bekämpfung: a.248.e.akamai.netWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.09.2011, 00:54 | #1 | |
| a.248.e.akamai.net hallo habe seit paar tagen das problem das über facebook immer diese meldung kommt a.248.e.akamai.net und denn firefox 6.0.2 nicht mehr macht. ist nen zertifikat problem angeblich. kann mir wer helfen? Zitat:
OTL EXTRAS Logfile: Code:
ATTFilter OTL logfile created on: 23.09.2011 02:17:48 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\drecks04\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,50 Gb Total Physical Memory | 0,65 Gb Available Physical Memory | 43,52% Memory free 3,35 Gb Paging File | 2,58 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 19,07 Gb Total Space | 6,56 Gb Free Space | 34,39% Space Free | Partition Type: NTFS Drive E: | 7,87 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: BORUSSEN-41FVZR | User Name: drecks04 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.23 02:04:41 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\drecks04\Desktop\OTL.exe PRC - [2011.09.11 22:31:33 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.07.01 00:49:09 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.05.17 13:29:46 | 000,395,144 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe PRC - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe PRC - [2011.04.26 22:22:44 | 000,681,840 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.04.08 12:59:52 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.09.23 00:39:14 | 006,277,280 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll MOD - [2011.09.11 22:31:30 | 001,846,232 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2011.07.24 16:13:12 | 000,077,312 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\extensions\{ca4d8f4d-8eac-43a3-96d1-ee2949c907c0}\components\RadioWMPCoreGecko6.dll MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe MOD - [2011.04.26 22:22:44 | 000,681,840 | ---- | M] () -- C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe MOD - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe MOD - [2010.01.28 13:59:50 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2008.04.14 07:53:08 | 000,148,992 | ---- | M] () -- C:\WINDOWS\system32\mpg2splt.ax MOD - [2008.04.14 07:52:18 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011.07.01 00:49:09 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.26 22:23:02 | 000,223,088 | ---- | M] () [Auto | Running] -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper) SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess) ========== Driver Services (SafeList) ========== DRV - [2011.07.01 00:49:13 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.01 00:49:13 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.04.04 14:55:38 | 000,020,480 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp) DRV - [2011.03.31 14:53:22 | 000,024,064 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem) DRV - [2011.02.07 17:36:00 | 000,011,008 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice) DRV - [2010.04.01 14:31:50 | 000,023,424 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet) DRV - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.09.29 16:05:15 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.05.08 11:56:12 | 000,042,752 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev) DRV - [2009.01.29 17:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl) DRV - [2009.01.29 17:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService) DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008.02.12 03:42:38 | 000,232,472 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm) DRV - [2008.02.05 01:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2) DRV - [2007.11.02 15:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService) DRV - [2007.02.16 02:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL) DRV - [2005.03.22 20:36:40 | 000,028,672 | ---- | M] (ULi Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ULILAN51.SYS -- (ULI5261XP) DRV - [2004.08.02 21:09:18 | 000,635,281 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2004.02.24 11:08:52 | 000,400,384 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.de.maxiwe.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.de.maxiwe.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.de.maxiwe.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.de.maxiwe.com IE - HKCU\..\URLSearchHook: {ca4d8f4d-8eac-43a3-96d1-ee2949c907c0} - C:\Programme\Reganam-DE\prxtbRega.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Reganam-DE Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2691089&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2691089&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Programme\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.67\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.67\npGoogleUpdate3.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.11 22:31:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.06.29 22:57:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Extensions [2011.09.11 22:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\extensions [2011.08.30 17:28:41 | 000,000,000 | ---D | M] (Reganam-DE Community Toolbar) -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\extensions\{ca4d8f4d-8eac-43a3-96d1-ee2949c907c0} [2011.09.11 22:31:48 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2011.09.03 21:59:44 | 000,000,000 | ---D | M] ("Nero Toolbar") -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\extensions\toolbar@ask.com [2011.07.24 16:13:12 | 000,000,923 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\searchplugins\conduit.xml [2011.08.07 20:00:53 | 000,001,801 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Mozilla\Firefox\Profiles\5q7o5fhe.default\searchplugins\search-the-web.xml [2011.08.28 22:38:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.25 21:20:51 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.08.28 22:38:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.07.21 00:28:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.08.20 00:54:44 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\Programme\Mozilla Firefox\extensions\adapter@babylontc.com [2011.08.20 00:54:41 | 000,000,000 | ---D | M] (Babylon OCR) -- C:\Programme\Mozilla Firefox\extensions\ocr@babylon.com [2011.07.21 00:27:55 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.09.11 22:31:33 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - Extension: Skype Extension = C:\Dokumente und Einstellungen\drecks04\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\ O1 HOSTS File: ([2011.09.22 11:45:37 | 000,437,691 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 15053 more lines... O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - F:\1 above\Babylon\Utils\BabylonIEPI.dll File not found O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Reganam-DE Toolbar) - {ca4d8f4d-8eac-43a3-96d1-ee2949c907c0} - C:\Programme\Reganam-DE\prxtbRega.dll (Conduit Ltd.) O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Reganam-DE Toolbar) - {ca4d8f4d-8eac-43a3-96d1-ee2949c907c0} - C:\Programme\Reganam-DE\prxtbRega.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Reganam-DE Toolbar) - {CA4D8F4D-8EAC-43A3-96D1-EE2949C907C0} - C:\Programme\Reganam-DE\prxtbRega.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Babylon Client] F:\1 above\Babylon\Babylon.exe -AutoStart File not found O4 - HKLM..\Run: [CloneCDTray] C:\Programme\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" File not found O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Translate this web page with Babylon - res://F:\1 above\Babylon\Utils\BabylonIEPI.dll/ActionTU.htm File not found O8 - Extra context menu item: Translate with Babylon - res://F:\1 above\Babylon\Utils\BabylonIEPI.dll/Action.htm File not found O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://F:\1 above\Babylon\Utils\BabylonIEPI.dll/ActionTU.htm File not found O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://F:\1 above\Babylon\Utils\BabylonIEPI.dll/ActionTU.htm File not found O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08BF5D66-CBCA-4D59-9DD6-A9998F8497D9}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.06.29 21:19:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.09.23 02:04:38 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\drecks04\Desktop\OTL.exe [2011.09.22 11:10:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy [2011.09.22 11:10:20 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy [2011.09.22 11:10:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy [2011.09.22 01:36:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2011.09.15 00:27:23 | 000,011,008 | ---- | C] (Motorola Inc) -- C:\WINDOWS\System32\drivers\motusbdevice.sys [2011.09.15 00:27:22 | 000,023,424 | ---- | C] (Motorola) -- C:\WINDOWS\System32\drivers\Motousbnet.sys [2011.09.15 00:27:22 | 000,006,016 | ---- | C] (Motorola Inc) -- C:\WINDOWS\System32\drivers\motfilt.sys [2011.09.15 00:27:20 | 000,024,064 | ---- | C] (Motorola) -- C:\WINDOWS\System32\drivers\motmodem.sys [2011.09.15 00:27:18 | 000,020,480 | ---- | C] (Motorola) -- C:\WINDOWS\System32\drivers\motccgp.sys [2011.09.15 00:27:18 | 000,008,320 | ---- | C] (Motorola) -- C:\WINDOWS\System32\drivers\motccgpfl.sys [2011.09.15 00:27:18 | 000,006,400 | ---- | C] (Motorola) -- C:\WINDOWS\System32\drivers\motswch.sys [2011.09.15 00:26:57 | 000,042,752 | ---- | C] (Motorola Inc) -- C:\WINDOWS\System32\drivers\motodrv.sys [2011.09.15 00:26:57 | 000,015,616 | ---- | C] (Motorola) -- C:\WINDOWS\System32\mot_ci.dll [2011.09.15 00:26:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE [2011.09.15 00:26:12 | 000,000,000 | ---D | C] -- C:\Program Files [2011.09.15 00:26:12 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Motorola Shared [2011.09.15 00:26:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Motorola [2011.09.15 00:26:05 | 000,000,000 | ---D | C] -- C:\Programme\Motorola [2011.09.04 14:25:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Google [2011.09.04 14:23:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Earth [2011.09.03 23:17:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\TeamViewer [2011.09.03 23:17:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TeamViewer 6 [2011.09.03 23:17:36 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer [2011.08.31 20:16:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2011.08.31 18:27:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\vlc [2011.08.31 18:19:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\VideoLAN [2011.08.31 18:17:37 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN [2011.08.30 21:22:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\OpenOffice.org [2011.08.30 17:30:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Lokale Einstellungen\Anwendungsdaten\MPlayer [2011.08.30 17:29:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\.3gpplayer [2011.08.30 17:27:45 | 000,000,000 | ---D | C] -- C:\Programme\Conduit [2011.08.30 17:27:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Lokale Einstellungen\Anwendungsdaten\Reganam-DE [2011.08.30 17:27:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\3GP Player 2011 [2011.08.30 17:27:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Lokale Einstellungen\Anwendungsdaten\Conduit [2011.08.30 17:26:56 | 000,000,000 | ---D | C] -- C:\Programme\Reganam-DE [2011.08.30 17:26:56 | 000,000,000 | ---D | C] -- C:\Programme\3GPplayer2011 [2011.08.28 22:43:24 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice.org 3.3 [2011.08.28 22:39:01 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice.org 3 [2011.08.28 22:29:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Neuer Ordner [2011.08.25 21:20:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.23 02:04:41 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\drecks04\Desktop\OTL.exe [2011.09.23 02:04:17 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\defogger_reenable [2011.09.23 02:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2011.09.23 02:00:13 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\Defogger.exe [2011.09.23 01:32:00 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.09.23 00:34:07 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.09.23 00:08:58 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.09.23 00:08:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.09.23 00:08:55 | 1609,879,552 | -HS- | M] () -- C:\hiberfil.sys [2011.09.22 11:45:37 | 000,437,691 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2011.09.22 11:10:43 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\Spybot - Search & Destroy.lnk [2011.09.15 01:19:45 | 000,001,896 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\RSD Lite.lnk [2011.09.15 01:04:24 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motfilt_01007.Wdf [2011.09.15 01:04:23 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2011.09.15 01:04:04 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motmodem_01007.Wdf [2011.09.15 01:03:40 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2011.09.15 00:51:25 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2011.09.15 00:51:25 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motccgp_01007.Wdf [2011.09.15 00:51:21 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2011.09.15 00:47:36 | 000,472,488 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.09.15 00:47:36 | 000,451,942 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.09.15 00:47:36 | 000,089,740 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.09.15 00:47:36 | 000,073,956 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.09.13 20:30:44 | 000,003,729 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokumenttest.rtf [2011.09.11 22:22:17 | 000,002,215 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokument.rtf [2011.09.06 13:04:16 | 000,003,194 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokument12347.rtf [2011.09.03 23:17:43 | 000,000,787 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 6.lnk [2011.09.03 21:44:27 | 000,002,161 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\bluterte.rtf [2011.09.01 00:13:13 | 000,118,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.08.31 18:20:01 | 000,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2011.08.30 17:34:58 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011.08.30 17:27:29 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\3GP Player 2011.lnk [2011.08.28 22:43:35 | 000,000,861 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk [2011.08.28 13:36:46 | 000,186,460 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\gesamt.pdf [2011.08.28 01:49:40 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.08.25 21:20:06 | 000,001,870 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2011.08.25 21:12:25 | 000,000,989 | ---- | M] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokument123.rtf [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.23 02:04:17 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\defogger_reenable [2011.09.23 02:00:12 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\Defogger.exe [2011.09.22 11:10:43 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\Spybot - Search & Destroy.lnk [2011.09.15 01:19:45 | 000,002,295 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RSD Lite.lnk [2011.09.15 01:19:45 | 000,001,896 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\RSD Lite.lnk [2011.09.15 01:04:24 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motfilt_01007.Wdf [2011.09.15 01:04:23 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2011.09.15 01:04:04 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motmodem_01007.Wdf [2011.09.15 01:03:40 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2011.09.15 00:51:25 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2011.09.15 00:51:25 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_motccgp_01007.Wdf [2011.09.15 00:51:21 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf [2011.09.13 20:30:44 | 000,003,729 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokumenttest.rtf [2011.09.06 13:04:16 | 000,003,194 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokument12347.rtf [2011.09.04 14:21:46 | 000,001,094 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.09.04 14:21:45 | 000,001,090 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.09.03 23:17:43 | 000,000,787 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 6.lnk [2011.09.01 00:11:36 | 000,002,161 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\bluterte.rtf [2011.08.31 18:20:01 | 000,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2011.08.30 17:27:29 | 000,000,699 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Desktop\3GP Player 2011.lnk [2011.08.30 17:23:03 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011.08.30 17:11:12 | 000,186,460 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\gesamt.pdf [2011.08.28 22:43:35 | 000,000,861 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\OpenOffice.org 3.3.lnk [2011.08.28 01:49:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.08.25 21:20:06 | 000,001,870 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2011.08.25 21:12:24 | 000,000,989 | ---- | C] () -- C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Dokument123.rtf [2011.08.14 22:06:15 | 000,000,041 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib [2011.07.28 01:45:00 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2011.06.29 23:08:33 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2011.06.29 23:08:30 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2011.06.29 22:57:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2011.06.29 22:41:52 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\UnLAN.exe [2011.06.29 21:53:02 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2011.06.29 21:49:40 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2011.06.29 21:45:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2011.06.29 21:41:06 | 000,118,952 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.06.29 21:15:47 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.12.31 07:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2003.07.30 11:49:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2003.07.30 11:48:28 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2003.04.02 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2003.04.02 14:00:00 | 000,472,488 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2003.04.02 14:00:00 | 000,451,942 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2003.04.02 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2003.04.02 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2003.04.02 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2003.04.02 14:00:00 | 000,089,740 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2003.04.02 14:00:00 | 000,073,956 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2003.04.02 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2003.04.02 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2003.04.02 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2003.04.02 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2003.04.02 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat ========== LOP Check ========== [2011.09.11 22:29:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon [2011.08.11 19:07:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess [2011.07.28 01:45:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited [2011.07.28 01:04:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\AskToolbar [2011.09.02 21:01:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Babylon [2011.07.28 01:45:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\Canneverbe Limited [2011.08.30 21:22:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\OpenOffice.org [2011.09.03 23:22:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\TeamViewer [2011.08.13 04:30:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\drecks04\Anwendungsdaten\TS3Client [2011.09.23 02:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 24 bytes -> C:\WINDOWS:429114DC960FA026 < End of report > --- --- ---OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 23.09.2011 02:17:48 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\drecks04\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,50 Gb Total Physical Memory | 0,65 Gb Available Physical Memory | 43,52% Memory free 3,35 Gb Paging File | 2,58 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 19,07 Gb Total Space | 6,56 Gb Free Space | 34,39% Space Free | Partition Type: NTFS Drive E: | 7,87 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: BORUSSEN-41FVZR | User Name: drecks04 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\teamspeak3-server_win32-3.0.0-rc1\teamspeak3-server_win32\ts3server_win32.exe" = C:\teamspeak3-server_win32-3.0.0-rc1\teamspeak3-server_win32\ts3server_win32.exe:*:Enabled:TeamSpeak 3 Server "C:\Programme\Teamspeak2_RC2\server_windows.exe" = C:\Programme\Teamspeak2_RC2\server_windows.exe:*:Enabled:Server -- () "C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Downloads\teamspeak3-server_win32-3.0.0-rc1\teamspeak3-server_win32\ts3server_win32.exe" = C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Downloads\teamspeak3-server_win32-3.0.0-rc1\teamspeak3-server_win32\ts3server_win32.exe:*:Enabled:TeamSpeak 3 Server -- (TeamSpeak Systems GmbH) "C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Downloads\teamspeak3-server_win32-3.0.0\teamspeak3-server_win32\ts3server_win32.exe" = C:\Dokumente und Einstellungen\drecks04\Eigene Dateien\Downloads\teamspeak3-server_win32-3.0.0\teamspeak3-server_win32\ts3server_win32.exe:*:Enabled:TeamSpeak 3 Server -- (TeamSpeak Systems GmbH) "C:\Programme\TeamViewer\Version6\TeamViewer.exe" = C:\Programme\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH) "C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH) "C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google) "C:\Programme\Motorola\RSD Lite\SDL.exe" = C:\Programme\Motorola\RSD Lite\SDL.exe:*:Enabled:SDL -- (Motorola) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended "{143BE018-D8F8-4014-8CB6-AF63F5799D21}" = ULi LAN Driver "{1D76A52C-87A6-4AB0-A7B0-08C8D5DF1D75}" = Motorola Mobile Drivers Installation 5.2.0 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22 "{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26 "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03 "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8CA199A8-574E-432F-A98F-A55741E233D1}_is1" = 3GP Player 2011 "{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in "{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5 "{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1 "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype "{C53CFB2A-B76B-4C8E-842F-9961EFE760EB}" = RSDLite "{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Babylon" = Babylon "CloneCD" = CloneCD "Foxit Reader_is1" = Foxit Reader 5.0 "Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281) "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack "MotoHelper" = MotoHelper 2.0.51 Driver 5.2.0 "Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de) "Reganam-DE Toolbar" = Reganam-DE Toolbar "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "TeamSpeak 2 Server_is1" = TeamSpeak 2 Server RC2 "TeamSpeak 3 Client" = TeamSpeak 3 Client "TeamViewer 6" = TeamViewer 6 "VLC media player" = VLC media player 1.1.11 "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR 4.01 (32-Bit) ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 22.09.2011 20:11:16 | Computer Name = BORUSSEN-41FVZR | Source = Application Hang | ID = 1002 Description = Stillstehende Anwendung OTL.exe, Version 3.2.29.1, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000. [ System Events ] Error - 04.09.2011 18:19:42 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 06.09.2011 07:06:19 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 13.09.2011 14:33:00 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 13.09.2011 14:35:30 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 19.09.2011 19:32:33 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 22.09.2011 18:02:03 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 22.09.2011 18:04:55 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error - 22.09.2011 18:07:02 | Computer Name = BORUSSEN-41FVZR | Source = DCOM | ID = 10010 Description = Der Server "{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. < End of report > |
23.09.2011, 11:19 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | a.248.e.akamai.net Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Führe danach auch bitte ESET aus, danach sehen wir weiter. ESET Online Scanner
n.
__________________ |
Themen zu a.248.e.akamai.net |
0x00000001, 32-bit, alternate, application/pdf, application/pdf:, babylon, cdburnerxp, conduit, facebook, firefox, google earth, meldung, nicht mehr, plug-in, problem, remote control, safer networking, shell32.dll, shortcut, tagen, version=1.0, zertifikat |