| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Spy.Banker.iuq.3 in C:\Users\Username\AppData\Roaming\appconf32.exeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.11.2011, 17:49
| #1 |
| |  TR/Spy.Banker.iuq.3 in C:\Users\Username\AppData\Roaming\appconf32.exe Hallo zusammen, Seit gestern findet der kostenlose Avira Antivirus den o.g. Trojaner. Entfernen oder in Quarantäne verschieben klappt nicht, zumindest kommt die Meldung sofort wieder. Hatte heute auch mehrere Phishing Attacks in meinem Email-Postfach, weiß aber nicht ob das im Zusammenhang steht. Meine Fragen: Wie bekomme ich den wieder runter? Und was macht der Trojaner eigentlich? Muss ich meine Online-Banking-Daten etc. ändern? Vielen Dank! (Gamer läuft gerade noch; sobald er fertig ist lade ich auch da die Logdatei hoch) OTL logfile created on: 05.11.2011 16:40:41 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Username\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,99 Gb Total Physical Memory | 1,62 Gb Available Physical Memory | 54,20% Memory free 6,22 Gb Paging File | 4,77 Gb Available in Paging File | 76,75% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 222,75 Gb Total Space | 102,79 Gb Free Space | 46,15% Space Free | Partition Type: NTFS Drive D: | 10,00 Gb Total Space | 4,63 Gb Free Space | 46,27% Space Free | Partition Type: NTFS Computer Name: User-PC | User Name: Username | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.05 16:19:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Yvonne\Desktop\OTL.exe PRC - [2011.06.29 06:05:49 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.04.27 11:43:34 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.05 17:23:09 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 21:10:54 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.09.06 12:38:06 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2009.06.13 11:08:16 | 002,521,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\Updater6\Adobe_Updater.exe PRC - [2009.05.19 16:11:52 | 000,136,544 | ---- | M] (CANON INC.) -- C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe PRC - [2009.04.11 07:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 07:27:39 | 000,299,520 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\ieuser.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2009.02.10 17:01:49 | 000,116,104 | ---- | M] () -- C:\Programme\Canon\IJPLM\ijplmsvc.exe PRC - [2009.01.28 08:39:02 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version4\TeamViewer_Service.exe PRC - [2008.10.04 13:58:04 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtsvc.exe PRC - [2008.10.04 13:58:02 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtcmd.exe PRC - [2008.09.23 22:09:52 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Programme\Dell\DellDock\DockLogin.exe PRC - [2008.07.17 11:23:04 | 000,442,433 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe PRC - [2008.07.17 11:23:02 | 000,221,239 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f091b975\stacsv.exe PRC - [2008.07.17 11:22:56 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f091b975\AEstSrv.exe PRC - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.21 03:23:43 | 000,056,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wermgr.exe ========== Modules (No Company Name) ========== MOD - [2011.07.08 12:53:06 | 004,550,656 | ---- | M] () -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll MOD - [2011.05.04 12:53:15 | 003,182,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2010.09.25 19:34:21 | 005,242,880 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll MOD - [2009.03.30 05:42:20 | 002,048,000 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2009.03.30 05:42:19 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll MOD - [2008.11.24 10:16:14 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll MOD - [2008.11.20 11:19:52 | 000,055,808 | ---- | M] () -- C:\Windows\System32\bcmwlrmt.dll ========== Win32 Services (SafeList) ========== SRV - [2011.06.29 06:05:49 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.04.27 11:43:34 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.09.06 12:38:06 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2009.02.10 17:01:49 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Programme\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC) SRV - [2009.01.28 14:12:36 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist) SRV - [2009.01.28 08:39:02 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4) SRV - [2008.10.04 13:58:04 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) SRV - [2008.09.23 22:09:52 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService) SRV - [2008.07.17 11:23:02 | 000,221,239 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f091b975\stacsv.exe -- (STacSV) SRV - [2008.07.17 11:22:56 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f091b975\AEstSrv.exe -- (AESTFilters) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.06.29 06:05:49 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.06.29 06:05:49 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.11.12 12:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2009.05.11 09:12:50 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.12.26 17:05:00 | 000,279,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid) DRV - [2008.11.26 06:02:04 | 000,133,472 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd) DRV - [2008.11.24 10:16:10 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2008.11.24 10:16:10 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008.11.20 11:19:34 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY) DRV - [2008.07.28 10:46:32 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2008.07.17 13:00:14 | 000,170,032 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2008.07.17 11:23:06 | 000,379,904 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA) DRV - [2008.07.03 09:58:26 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2008.07.03 09:58:24 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2008.07.03 09:58:22 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2008.05.29 12:03:34 | 000,203,264 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) Broadcom NetLink (TM) DRV - [2008.01.21 03:23:25 | 000,251,904 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2) DRV - [2008.01.21 03:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R) DRV - [2007.05.02 11:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm) DRV - [2007.05.02 11:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl) DRV - [2007.05.02 11:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) DRV - [2006.10.15 15:59:32 | 000,067,672 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwusb.sys -- (BTWUSB) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=3090128 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://aolwebmail.aol.de/landing-page" FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Yvonne\AppData\Roaming\5037 [2011.10.25 06:11:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.01 00:03:29 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.06 06:24:13 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Yvonne\AppData\Roaming\5037 [2011.10.25 06:11:02 | 000,000,000 | ---D | M] [2009.08.30 12:55:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Extensions [2011.10.28 07:25:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions [2010.04.28 11:13:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.09.27 19:23:53 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.07.24 20:23:13 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.05.06 19:37:17 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions\engine@conduit.com [2011.10.28 07:25:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\5r0asppr.default\extensions\trash [2010.10.26 16:42:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions [2009.08.30 14:14:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.10.26 16:42:59 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.07.30 13:09:13 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.07.24 20:23:13 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2009.08.30 14:14:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yvonne\AppData\Roaming\mozilla\Firefox\Profiles\rfw81ok8.default\extensions\staged-xpis [2011.11.01 13:34:36 | 000,001,056 | ---- | M] () -- C:\Users\Yvonne\AppData\Roaming\Mozilla\Firefox\Profiles\5r0asppr.default\searchplugins\icqplugin.xml [2010.01.30 23:33:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.10.25 06:11:02 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\YVONNE\APPDATA\ROAMING\5037 [2011.10.01 00:03:29 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.05.06 06:24:04 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.06 06:24:04 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.05.06 06:24:04 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.05.06 06:24:04 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.06 06:24:04 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.06 06:24:04 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (no name) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - No CLSID value found. O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Dell\BAE\BAE.dll (Dell Inc.) O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.) O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [Sidebar] C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10w_Plugin.exe (Adobe Systems, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8 - Extra context menu item: Free YouTube Download - C:\Users\Yvonne\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Yvonne\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKCU\..Trusted Domains: fritz.repeater ([]* in Lokales Intranet) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O15 - HKCU\..Trusted Ranges: Range2 ([*] in Lokales Intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{88E2C635-AC84-4C19-8356-717D0AC31E48}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E918F6DA-C4D6-4A48-B35F-9AD3920BC6D8}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll) - C:\Programme\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.) O24 - Desktop WallPaper: C:\Users\Yvonne\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Yvonne\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{483fef15-ae34-11e0-8ef6-00217089124e}\Shell - "" = AutoRun O33 - MountPoints2\{483fef15-ae34-11e0-8ef6-00217089124e}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{5028f17e-67ed-11de-85d2-002219ddc462}\Shell - "" = AutoRun O33 - MountPoints2\{5028f17e-67ed-11de-85d2-002219ddc462}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{6788e796-c88f-11df-a403-00217089124e}\Shell\AutoRun\command - "" = SYSTEM\G-923-321232-3232-32211-23\driver.exe O33 - MountPoints2\{6788e796-c88f-11df-a403-00217089124e}\Shell\open\command - "" = SYSTEM\G-923-321232-3232-32211-23\driver.exe O33 - MountPoints2\{a091686c-57f7-11de-8c2f-002219ddc462}\Shell - "" = AutoRun O33 - MountPoints2\{a091686c-57f7-11de-8c2f-002219ddc462}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk - C:\Programme\Dell\QuickSet\quickset.exe - (Dell Inc.) MsConfig - StartUpFolder: C:^Users^Yvonne^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dell Dock.lnk - C:\Programme\Dell\DellDock\DellDock.exe - (Stardock Corporation) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Apoint - hkey= - key= - C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) MsConfig - StartUpReg: avgnt - hkey= - key= - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) MsConfig - StartUpReg: CanonSolutionMenu - hkey= - key= - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) MsConfig - StartUpReg: Dell DataSafe Online - hkey= - key= - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe () MsConfig - StartUpReg: Dell Webcam Central - hkey= - key= - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe (Creative Technology Ltd.) MsConfig - StartUpReg: dellsupportcenter - hkey= - key= - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) MsConfig - StartUpReg: EA Core - hkey= - key= - File not found MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - File not found MsConfig - StartUpReg: ICQ - hkey= - key= - File not found MsConfig - StartUpReg: PCMService - hkey= - key= - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.) MsConfig - StartUpReg: SightSpeed - hkey= - key= - C:\Program Files\Dell Video Chat\DellVideoChat.exe (Dell Inc. and SightSpeed Inc.) MsConfig - StartUpReg: StartCCC - hkey= - key= - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) MsConfig - StartUpReg: swg - hkey= - key= - File not found MsConfig - StartUpReg: SysTrayApp - hkey= - key= - File not found MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) MsConfig - StartUpReg: ZoneAlarm Client - hkey= - key= - File not found MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.05 16:19:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Yvonne\Desktop\OTL.exe [2011.11.05 14:28:31 | 000,000,000 | ---D | C] -- C:\avrescue [2011.10.31 11:51:47 | 000,232,400 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\Yvonne\AppData\Roaming\AcroIEHelpe044.dll [2011.10.25 06:11:02 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5037 [2011.10.21 17:54:32 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5036 [2011.10.18 19:40:52 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5035 [2011.10.14 14:05:09 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5034 [2011.10.13 18:54:40 | 000,000,000 | ---D | C] -- C:\xmldm [2011.10.12 19:33:18 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5033 [2011.10.10 18:39:52 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5032 [2011.10.07 12:43:21 | 000,000,000 | ---D | C] -- C:\Users\Yvonne\AppData\Roaming\5031 [2009.07.31 11:57:22 | 004,855,808 | ---- | C] (Dell, Inc. ) -- C:\Users\Yvonne\AppData\Roaming\DataSafeDotNet.exe [2 C:\Users\Yvonne\AppData\Roaming\*.tmp files -> C:\Users\Yvonne\AppData\Roaming\*.tmp -> ] [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.05 16:32:29 | 000,000,000 | ---- | M] () -- C:\Users\Yvonne\defogger_reenable [2011.11.05 16:20:58 | 000,302,592 | ---- | M] () -- C:\Users\Yvonne\Desktop\qnju65nd.exe [2011.11.05 16:19:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Yvonne\Desktop\OTL.exe [2011.11.05 16:19:10 | 000,050,477 | ---- | M] () -- C:\Users\Yvonne\Desktop\Defogger.exe [2011.11.05 15:46:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.05 15:08:13 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.05 15:08:13 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.03 17:10:43 | 000,052,000 | ---- | M] () -- C:\Users\Yvonne\AppData\Roaming\loaupdt.jpg [2011.11.03 15:30:39 | 000,000,036 | ---- | M] () -- C:\Users\Yvonne\AppData\Roaming\blckdom.res [2011.11.01 18:59:00 | 000,023,591 | ---- | M] () -- C:\Users\Yvonne\.recently-used.xbel [2011.10.20 18:52:09 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.10.20 18:52:09 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.10.20 18:52:09 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.10.20 18:52:09 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.10.20 06:23:19 | 005,167,067 | ---- | M] () -- C:\Users\Yvonne\Desktop\IMG_0803789798.JPG [2011.10.20 06:04:06 | 005,252,279 | ---- | M] () -- C:\Users\Yvonne\Desktop\IMG_0803.JPG [2011.10.15 16:57:56 | 000,153,088 | ---- | M] () -- C:\Users\Yvonne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.14 02:30:56 | 000,303,104 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.10.13 20:13:07 | 000,000,063 | ---- | M] () -- C:\Users\Yvonne\AppData\Roaming\urhtps.dat [2 C:\Users\Yvonne\AppData\Roaming\*.tmp files -> C:\Users\Yvonne\AppData\Roaming\*.tmp -> ] [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.05 16:32:29 | 000,000,000 | ---- | C] () -- C:\Users\Yvonne\defogger_reenable [2011.11.05 16:20:58 | 000,302,592 | ---- | C] () -- C:\Users\Yvonne\Desktop\qnju65nd.exe [2011.11.05 16:19:09 | 000,050,477 | ---- | C] () -- C:\Users\Yvonne\Desktop\Defogger.exe [2011.11.03 17:10:43 | 000,052,000 | ---- | C] () -- C:\Users\Yvonne\AppData\Roaming\loaupdt.jpg [2011.11.01 18:59:00 | 000,023,591 | ---- | C] () -- C:\Users\Yvonne\.recently-used.xbel [2011.10.20 06:23:17 | 005,167,067 | ---- | C] () -- C:\Users\Yvonne\Desktop\IMG_0803789798.JPG [2011.10.20 06:04:05 | 005,252,279 | ---- | C] () -- C:\Users\Yvonne\Desktop\IMG_0803.JPG [2011.10.14 14:05:02 | 000,000,036 | ---- | C] () -- C:\Users\Yvonne\AppData\Roaming\blckdom.res [2011.09.17 13:22:48 | 000,000,063 | ---- | C] () -- C:\Users\Yvonne\AppData\Roaming\urhtps.dat [2011.05.14 15:15:21 | 000,000,000 | ---- | C] () -- C:\Windows\HOZ.INI [2011.05.14 15:15:21 | 000,000,000 | ---- | C] () -- C:\Windows\DAISY.INI [2011.05.14 15:15:19 | 000,000,063 | ---- | C] () -- C:\Windows\VDDS_MMI.INI [2011.05.14 15:09:42 | 000,000,000 | ---- | C] () -- C:\Windows\dbsetup.INI [2011.05.14 15:08:22 | 000,000,122 | ---- | C] () -- C:\Windows\ODBC.INI [2010.10.20 20:25:59 | 000,001,940 | ---- | C] () -- C:\Users\Yvonne\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini [2010.04.20 10:53:58 | 000,016,183 | ---- | C] () -- C:\Windows\System32\SELF32.INI [2010.04.20 10:53:49 | 000,000,517 | ---- | C] () -- C:\Windows\pbl.ini [2009.10.22 11:39:08 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.10.22 11:39:08 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.05 22:48:01 | 000,418,071 | ---- | C] () -- C:\Users\Yvonne\AppData\Roaming\UserTile.png [2009.08.30 20:39:03 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2009.08.30 20:32:45 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2009.02.10 19:15:59 | 000,000,680 | ---- | C] () -- C:\Users\Yvonne\AppData\Local\d3d9caps.dat [2009.02.09 19:55:22 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt [2009.02.09 19:43:05 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys [2009.02.09 19:35:05 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009.01.31 17:13:10 | 000,153,088 | ---- | C] () -- C:\Users\Yvonne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.01.28 22:29:53 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat [2009.01.28 22:29:53 | 000,174,819 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2009.01.28 22:29:53 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2009.01.28 22:29:53 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe [2009.01.28 22:26:20 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2009.01.28 14:38:17 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2009.01.28 14:05:34 | 000,000,075 | RHS- | C] () -- C:\Windows\CT4CET.bin [2009.01.28 13:58:53 | 000,055,808 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll [2009.01.28 13:58:51 | 000,024,064 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE [2008.12.09 16:23:13 | 000,052,000 | ---- | C] () -- C:\Users\Yvonne\AppData\Roaming\appconf32.exe [2008.11.06 17:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.11.06 17:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll [2008.01.21 08:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 08:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,303,104 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2011.09.10 20:34:36 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5025 [2011.09.16 14:15:19 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5026 [2011.09.23 16:56:54 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5027 [2011.09.26 13:57:26 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5028 [2011.09.28 12:27:38 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5029 [2011.10.03 15:28:31 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5030 [2011.10.07 12:43:21 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5031 [2011.10.10 18:39:52 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5032 [2011.10.12 19:33:18 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5033 [2011.10.14 14:05:10 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5034 [2011.10.18 19:40:52 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5035 [2011.10.21 17:54:32 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5036 [2011.10.25 06:11:02 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\5037 [2010.04.09 19:31:56 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\Canneverbe Limited [2010.10.21 20:23:05 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\Canon [2011.07.22 11:44:09 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\DVDVideoSoft [2011.05.06 20:28:53 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\DVDVideoSoftIEHelpers [2011.11.01 18:59:00 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\gtk-2.0 [2011.11.05 14:53:03 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\ICQ [2011.09.10 20:34:23 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\kock [2009.02.09 19:56:45 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\Samsung [2009.09.05 22:43:10 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\TeamViewer [2010.06.16 11:41:35 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\Tific [2011.09.17 14:23:53 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\UAs [2011.11.03 13:24:14 | 000,000,000 | ---D | M] -- C:\Users\Yvonne\AppData\Roaming\xmldm [2011.10.14 02:28:41 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.01.31 18:36:46 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.11.05 14:28:31 | 000,000,000 | ---D | M] -- C:\avrescue [2010.11.21 13:55:14 | 000,000,000 | -HSD | M] -- C:\Boot [2009.01.31 17:04:49 | 000,000,000 | ---D | M] -- C:\DELL [2009.01.28 22:06:57 | 000,000,000 | ---D | M] -- C:\doctemp [2009.01.31 16:35:03 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2008.10.27 07:33:34 | 000,000,000 | ---D | M] -- C:\Drivers [2011.07.21 14:28:36 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft [2009.01.31 18:01:32 | 000,000,000 | RH-D | M] -- C:\MSOCache [2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.07.22 11:43:38 | 000,000,000 | R--D | M] -- C:\Program Files [2010.10.21 20:23:38 | 000,000,000 | -H-D | M] -- C:\ProgramData [2009.01.31 16:35:08 | 000,000,000 | -HSD | M] -- C:\Programme [2011.11.05 16:45:01 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.02.20 12:35:55 | 000,000,000 | R--D | M] -- C:\Users [2011.10.14 02:29:35 | 000,000,000 | ---D | M] -- C:\Windows [2011.10.13 18:54:40 | 000,000,000 | ---D | M] -- C:\xmldm < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: REGEDIT.EXE > [2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe [2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-14 01:12:55 < > < End of report > |
| Themen zu TR/Spy.Banker.iuq.3 in C:\Users\Username\AppData\Roaming\appconf32.exe |
| acroiehelpe, adobe, antivirus, autorun, avira, bho, c:\windows\system32\rundll32.exe, canon, cdburnerxp, conduit, converter, defender, entfernen, error, excel.exe, explorer, firefox, format, frage, helper, home, intranet, logfile, mp3, phishing, plug-in, registry, rundll, scan, senden, software, studio, usb, vista, ändern |
Baum-Darstellung