| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundespolizei Virus und Antivir findet Exp/Java.Dldr.A, TR/Gendal.6725309.1 ...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
12.11.2011, 17:51
| #1 |
 |  Bundespolizei Virus und Antivir findet Exp/Java.Dldr.A, TR/Gendal.6725309.1 ... Hallo liebes Trojanerboard-Team, ich hatte schonmal Probleme mit meinem Vista-PC Anfang des Jahres. Hier bekam ich wirklich gute Hilfe! Nochmal vielen Dank dafür! Seit zwei Monaten gibt's schonwieder Virenalarm. Ich hätte schon längst mal bei Euch nachfragen sollen. Aber seit gestern auch noch der Bundespolizei-Virus. Aber der Reihe nach! In unserer Quarantäne von Antivir schlummern (oder schlummern eben doch nicht) EXP/Pdfka.LW, Java/Exdoer.BE.2, JS/Agent.akm, EXP/Java.BN, EXP/2010-0840.H, TR/Gendal.6725309.1, EXP/Java.Dldr.A und TR/Mahmud.200704! Bis vor etwa 2 Wochen gab es aber keine auffälligen Probleme. Dann plötzlich hat der Computer beim Hochfahren gestreikt, soll heißen: Computer fährt hoch, unterdessen (manchmal noch vor dem Anmelden als user, manchmal aber auch erst wenn ich schon die Antivir Systemprüfung laufen habe) plötzlich 1/2 Sekunde lang blauer Bildschirm mit einer ganzen Latte Meldungen und der PC schaltet sich aus und fährt erneut hoch. Beim x-ten Mal klappt es dann doch. Manchmal bleibt der PC auch einfach nur hängen (nichts geht mehr; dies aber auch nur am Anfang, d.h. wenn er mal geht, dann geht er eben auch). Die Meldungen auf dem blauen Bildschirm konnte ich nur einmal lesen, als er sich gerade in diesem Moment aufgehängt hatte. Der Inhalt war etwa so: Windows fährt sicherheitshalber den Rechner runter um Schaden abzuwenden. DRIVER_IRQL_NOT_LESS_OR EQUAL Und dann Hinweise auf möglicherweise in letzter Zeit nicht ordentlich installierte Hardware oder Software. Technical Information: ... tcpip.sys - Address 88699EBE base at 8862F000, Datestamp 47919120 Auf dem Rechner wurde von uns zuletzt aber nichts neues installiert. Also vermutete ich doch einen Zusammenhang mit Viren. Seit gestern nun auch noch der Bundespolizei-Virus wenn ich mich als user anmelde! Wenn ich mich als zweiter Benutzer anmelde (extra für unsere Kinder eingerichtet) läuft es soweit (noch!?). Tips auf der Internetseite von Chip zum Beseitigen dieses Virus halfen nicht weiter (Unscheinbare .exe-Datei in der Registry entfernen; habe keine entsprechende Datei gefunden und auch nix entfernt). http://www.trojaner-board.de/images/smilies/balla.gif Ich bin Laie und wende mich hilfesuchend an Euch! Inzwischen habe ich defogger durchgeführt. Am Ende kam keine Neustart-Aufforderung, aber Probleme gab's keine. Dennoch hier das Logfile: defogger_disable by jpshortstuff (23.02.10.1) Log created at 22:27 on 11/11/2011 (Familie Ratai) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Dann OTL: Code:
ATTFilter OTL logfile created on: 11.11.2011 22:56:24 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Kinder\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 66,44% Memory free 3,13 Gb Paging File | 2,03 Gb Available in Paging File | 64,98% Paging File free Paging file location(s): c:\pagefile.sys 200 200 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 76,00 Gb Total Space | 15,67 Gb Free Space | 20,62% Space Free | Partition Type: NTFS Drive D: | 380,97 Gb Total Space | 297,51 Gb Free Space | 78,09% Space Free | Partition Type: NTFS Computer Name: ***-PC | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Kinder\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.) PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Winamp\winampa.exe (Nullsoft, Inc.) PRC - C:\Programme\HDDlife\HDDlifePro.exe (BinarySense, Inc.) PRC - C:\Programme\Common Files\BinarySense\hldasvc.exe (BinarySense, Inc.) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin) PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - c:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe () PRC - C:\Programme\Google\Google EULA\GoogleEULALauncher.exe ( ) PRC - C:\Programme\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers) PRC - C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation) PRC - C:\Programme\Process Explorer\procexp.exe (Sysinternals) PRC - C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION) PRC - C:\Programme\ExitWin\ew.exe (Mirko Böer) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\b67478ec034fdf811a748f1b6b5b1c95\Microsoft.VisualBasic.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1363115565fff5a641243a48f396f107\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\367c4043efc2f32d843cb588b0dc97fc\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll () MOD - C:\Programme\HDDlife\CrashRpt.dll () MOD - C:\Programme\FinePixViewer\wia_register_event.dll () MOD - C:\Programme\ArcSoft\PhotoImpression 5\Share\PIHook.dll () ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) SRV - (HDDlife HDD Access service) -- C:\Program Files\Common Files\BinarySense\hldasvc.exe (BinarySense, Inc.) SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin) SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- c:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe () SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers) SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (UPnPService) -- C:\Programme\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG) SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin) DRV - (SaibVd32) -- C:\Windows\System32\drivers\SaibVd32.sys (Sonic Solutions) DRV - (SahdIa32) -- C:\Windows\System32\Drivers\SahdIa32.sys (Sonic Solutions) DRV - (SaibIa32) -- C:\Windows\System32\Drivers\SaibIa32.sys (Sonic Solutions) DRV - (SysCow) -- C:\Windows\system32\drivers\syscow32v.sys (Sonic Solutions) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.) DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.) DRV - (RxFilter) -- C:\Windows\System32\drivers\RxFilter.sys (Sonic Solutions) DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.) DRV - (pfc) -- C:\Windows\System32\drivers\pfc.sys (Padus, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 77 2A 5A 32 96 A0 CC 01 [binary data] IE - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Winamp Search" FF - prefs.js..browser.search.defaulturl: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=" FF - prefs.js..browser.search.selectedEngine: "Winamp Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..keyword.URL: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.01 12:28:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.25 10:15:24 | 000,000,000 | ---D | M] [2008.11.23 21:48:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Familie Ratai\AppData\Roaming\mozilla\Extensions [2011.03.24 17:16:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Familie Ratai\AppData\Roaming\mozilla\Firefox\Profiles\mjjf476y.default\extensions [2010.04.04 22:54:28 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\Familie Ratai\AppData\Roaming\mozilla\Firefox\Profiles\mjjf476y.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010.03.15 16:33:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Familie Ratai\AppData\Roaming\mozilla\Firefox\Profiles\mjjf476y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2008.12.20 22:04:43 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\Familie Ratai\AppData\Roaming\mozilla\Firefox\Profiles\mjjf476y.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2010.04.14 12:34:30 | 000,001,196 | ---- | M] () -- C:\Users\Familie Ratai\AppData\Roaming\Mozilla\Firefox\Profiles\mjjf476y.default\searchplugins\winamp-search.xml [2011.03.30 14:43:44 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.03.30 14:43:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.03.30 14:43:51 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.05.01 12:28:50 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.03.30 14:42:23 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found. O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - File not found O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O2 - BHO: (NTIECatcher Class) - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Programme\NetTransport\NTIEHelper.dll (Xi) O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found. O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin) O4 - HKLM..\Run: [EEventManager] C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( ) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.) O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\System32\WerFault.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [NoIE4StubProcessing] C:\Windows\system32\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f File not found O4 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000..\RunOnce: [scan_after_setup] c:\program files\avira\antivir desktop\avcenter.exe (Avira GmbH) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: Alles mit Net Transport herunterladen - C:\Programme\NetTransport\NTAddList.html () O8 - Extra context menu item: Mit Net Transport herunterladen - C:\Programme\NetTransport\NTAddLink.html () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O15 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKU\S-1-5-21-4221722840-285674823-3773879148-1000\..Trusted Ranges: GD ([http] in Local intranet) O15 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKU\S-1-5-21-4221722840-285674823-3773879148-1002\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29D38C5F-FC59-4F18-B2C5-DC457B07DCEC}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32254DAA-0277-4E43-B0A9-188143275102}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\hddlife {BD758015-47D9-477A-8873-4B688A2BC0E2} - C:\Program Files\Common Files\BinarySense\hlAPP.dll (BinarySense, Inc.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.11 22:54:01 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.11 22:27:03 | 000,000,000 | ---- | M] () -- C:\Users\Familie Ratai\defogger_reenable [2011.11.11 22:09:55 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.11.11 22:09:55 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.11.11 22:09:55 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.11.11 22:09:55 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.11.11 22:02:40 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.11 22:02:31 | 000,000,282 | ---- | M] () -- C:\Windows\tasks\BackOnTrack Instant Restore Idle.job [2011.11.11 22:02:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.11 22:02:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.05 18:13:00 | 000,000,284 | ---- | M] () -- C:\Windows\tasks\AppleSoftwareUpdate.job [2011.10.31 23:00:52 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2011.10.14 14:14:39 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{2B9E6E98-4E29-4FD2-B730-EA3C4D5ADEF7}.job [2011.10.13 17:22:43 | 000,453,656 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.10.13 16:41:43 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2011.10.13 16:41:43 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2011.10.13 16:40:28 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.11 22:27:03 | 000,000,000 | ---- | C] () -- C:\Users\Familie Ratai\defogger_reenable [2011.10.13 16:41:43 | 000,008,798 | ---- | C] () -- C:\Windows\System32\icrav03.rat [2011.10.13 16:41:42 | 000,001,988 | ---- | C] () -- C:\Windows\System32\ticrf.rat [2011.10.13 16:40:28 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2011.03.23 10:55:01 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe [2011.03.23 10:55:01 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe [2011.03.23 10:55:01 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2011.03.23 10:55:01 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2011.03.23 10:55:00 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.05.08 06:23:07 | 000,000,055 | ---- | C] () -- C:\Windows\Rabe_1.ini [2010.03.15 16:08:25 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2009.10.21 17:51:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.10.21 17:51:45 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.06.12 14:44:15 | 000,000,269 | ---- | C] () -- C:\Windows\LilliS.ini [2009.05.10 10:29:25 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2009.01.25 11:47:25 | 000,025,088 | ---- | C] () -- C:\Users\Familie Ratai\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.01.19 10:59:02 | 000,000,389 | ---- | C] () -- C:\Windows\DIXI4.ini [2009.01.10 16:57:48 | 000,131,584 | ---- | C] () -- C:\Windows\System32\SpoonUninstall.exe [2009.01.10 16:57:48 | 000,003,451 | ---- | C] () -- C:\Windows\System32\SpoonUninstall-Ri-li.dat [2008.12.21 18:07:34 | 000,023,888 | ---- | C] () -- C:\Users\Familie Ratai\AppData\Roaming\UserTile.png [2008.12.20 22:06:49 | 000,000,133 | ---- | C] () -- C:\Users\Familie Ratai\AppData\Roaming\burnaware.ini [2008.12.20 10:15:14 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat [2008.12.20 10:15:14 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat [2008.12.20 10:15:14 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat [2008.12.20 10:15:13 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat [2008.12.20 10:15:13 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat [2008.12.20 10:15:13 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat [2008.12.20 10:15:13 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat [2008.12.20 10:15:13 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat [2008.12.20 10:15:13 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat [2008.12.20 10:15:13 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat [2008.12.20 10:15:13 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat [2008.12.20 10:15:12 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat [2008.12.20 10:15:12 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat [2008.12.20 10:15:12 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat [2008.12.20 10:15:12 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat [2008.12.20 10:15:12 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat [2008.12.20 10:15:12 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat [2008.12.20 10:15:12 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat [2008.12.20 10:13:33 | 000,065,793 | ---- | C] () -- C:\Windows\System32\esfw66.bin [2008.12.20 10:13:24 | 000,000,025 | ---- | C] () -- C:\Windows\CDE V10V100V350EFGD.ini [2008.11.30 16:45:40 | 000,002,618 | ---- | C] () -- C:\Windows\mozver.dat [2008.11.24 21:41:58 | 000,000,067 | ---- | C] () -- C:\Windows\LilliP.ini [2008.11.23 21:48:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2008.11.22 15:34:42 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini [2008.09.30 11:26:58 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2008.09.30 11:26:57 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini [2008.09.30 11:23:06 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin [2008.09.30 10:59:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll [2008.01.21 08:15:58 | 000,628,504 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 08:15:58 | 000,126,248 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 13:47:37 | 000,453,656 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2009.06.06 17:41:20 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\BinarySense [2008.12.20 10:44:12 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\EPSON [2011.03.30 11:03:25 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\Foxit [2008.11.23 11:33:27 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\FUJIFILM [2009.06.16 10:35:29 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\NCH Swift Sound [2011.06.24 08:38:24 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\Opera [2008.12.21 18:07:34 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\PeerNetworking [2009.06.16 11:00:02 | 000,000,000 | ---D | M] -- C:\Users\Familie Ratai\AppData\Roaming\Recordpad [2009.01.10 16:52:19 | 000,000,000 | ---D | M] -- C:\Users\Kinder\AppData\Roaming\EPSON [2009.07.25 12:17:06 | 000,000,000 | ---D | M] -- C:\Users\Kinder\AppData\Roaming\NCH Swift Sound [2009.07.25 12:17:06 | 000,000,000 | ---D | M] -- C:\Users\Kinder\AppData\Roaming\Recordpad [2010.04.03 10:16:37 | 000,000,000 | ---D | M] -- C:\Users\Kinder\AppData\Roaming\Wildlife Park 2 [2009.07.25 12:37:20 | 000,000,000 | ---D | M] -- C:\Users\Kinder\AppData\Roaming\Wildlife Park 2 - Abenteuer auf der Ranch [2011.08.11 15:11:00 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\elsterformular [2009.02.10 10:44:47 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\EPSON [2008.11.23 13:38:51 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\FUJIFILM [2011.09.18 18:17:21 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\gtk-2.0 [2008.11.23 20:41:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MAGIX [2009.06.16 18:07:05 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\NCH Swift Sound [2009.05.10 10:54:44 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Panasonic [2011.03.21 12:05:45 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Pnpcodec [2009.06.16 18:07:05 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Recordpad [2008.11.24 17:08:14 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Serif [2009.10.26 16:14:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Wildlife Park 2 [2010.02.04 16:39:18 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Wildlife Park 2 - Abenteuer auf der Ranch [2011.11.11 22:02:31 | 000,000,282 | ---- | M] () -- C:\Windows\Tasks\BackOnTrack Instant Restore Idle.job [2011.11.11 21:27:39 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.10.14 14:14:39 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{2B9E6E98-4E29-4FD2-B730-EA3C4D5ADEF7}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:24051EFF @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:2BE9FEFC < End of report > Außerdem habe ich GMER durchgeführt. Gmer.txt ebenfalls im Anhang. So, ich hoffe alles einigermaßen ordentlich beschrieben zu haben. Vielleicht könnt Ihr mir ja helfen, die Viecherei wieder in den Griff zu bekommen. Im voraus schonmal vielen Dank, und liebe Grüße, Elke. |
| Themen zu Bundespolizei Virus und Antivir findet Exp/Java.Dldr.A, TR/Gendal.6725309.1 ... |
| adobe, alternate, anfang, antivir, askbar, avira, bho, bildschirm, computer, defender, entfernen, error, explorer, firefox, google, home, hängen, intranet, langs, logfile, nodrives, nvidia, nvlddmkm.sys, picasa, programme, realtek, registry, safer networking, scan, schaltet sich aus, sched.exe, sicherheitshalber, stick, superantispyware, usb, virus |
Baum-Darstellung