Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Erster Befall unter 7 32bit, multiple Probleme

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 28.12.2011, 20:19   #16
ethanhund
 
Erster Befall unter 7 32bit, multiple Probleme - Standard

Erster Befall unter 7 32bit, multiple Probleme



Hi,

also die ssd ist neu eingebaut, hat ein eigenes os drauf (diesmal 64bit), eine Übertragung auf dieselbe ist also eher unwahrscheinlich? Ist das Bootkit Versionsabhängig? Sprich, ist eine Verbreitung eines unter 32bit laufenden Bootkits auch auf einem 64bit System wahrscheinlich?

Alt 30.12.2011, 21:30   #17
ethanhund
 
Erster Befall unter 7 32bit, multiple Probleme - Standard

Erster Befall unter 7 32bit, multiple Probleme



Aktueller OTL-Log:

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 30.12.2011 20:42:15 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\ethanhund\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 75,96% Memory free
6,50 Gb Paging File | 5,64 Gb Available in Paging File | 86,89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,41 Gb Total Space | 274,19 Gb Free Space | 29,44% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: ethanhund | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.12.30 00:28:25 | 000,619,352 | ---- | M] (IObit) -- C:\Programme\IObit\Advanced SystemCare 5\ASCTray.exe
PRC - [2011.12.30 00:28:25 | 000,494,424 | ---- | M] (IObit) -- C:\Programme\IObit\Advanced SystemCare 5\ASCService.exe
PRC - [2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
PRC - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) -- C:\Programme\Tunngle\TnglCtrl.exe
PRC - [2011.10.07 04:28:52 | 000,397,312 | -H-- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () -- C:\Programme\Verbindungsassistent\WTGService.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) -- C:\Programme\Common Files\Nuance\dgnsvc.exe
PRC - [2010.06.08 16:41:22 | 001,118,208 | -H-- | M] (Sitecom Corp.) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe
PRC - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe
PRC - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () -- C:\Programme\DTProTS\DTProTS.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.04.21 16:54:40 | 000,347,024 | ---- | M] () -- C:\Programme\IObit\Advanced SystemCare 5\madexcept_.bpl
MOD - [2011.04.21 16:54:40 | 000,179,088 | ---- | M] () -- C:\Programme\IObit\Advanced SystemCare 5\madbasic_.bpl
MOD - [2011.04.21 16:54:40 | 000,046,480 | ---- | M] () -- C:\Programme\IObit\Advanced SystemCare 5\maddisAsm_.bpl
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.30 00:28:25 | 000,494,424 | ---- | M] (IObit) [Auto | Running] -- C:\Programme\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
SRV - [2011.10.14 13:49:38 | 000,745,832 | -H-- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2011.10.07 04:28:22 | 000,176,128 | -H-- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011.10.06 22:26:08 | 000,291,840 | -H-- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2011.06.26 07:45:56 | 000,256,000 | R--- | M] () [Auto | Stopped] -- C:\ComboFix\pev.3XE -- (PEVSystemStart)
SRV - [2011.06.20 13:31:10 | 000,330,696 | -H-- | M] () [Auto | Running] -- C:\Programme\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2011.04.16 20:52:50 | 000,403,240 | -H-- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.07.29 05:05:38 | 000,296,808 | -H-- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Programme\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010.04.23 04:39:00 | 000,136,616 | -H-- | M] () [Auto | Stopped] -- C:\Programme\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2010.04.16 16:10:58 | 000,036,864 | -H-- | M] (Realtek) [Auto | Running] -- C:\Programme\SITECOM\300N USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU)
SRV - [2010.03.30 10:16:12 | 001,107,336 | -H-- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2010.01.06 19:49:12 | 000,655,624 | -H-- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2000.01.01 00:00:00 | 000,271,360 | -H-- | M] () [Auto | Running] -- C:\Programme\DTProTS\DTProTS.exe -- (DTProTS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.10.07 06:20:28 | 008,598,528 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011.10.07 03:45:38 | 000,257,024 | -H-- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011.08.24 00:51:40 | 000,281,760 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.08.24 00:51:37 | 000,025,888 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.06.24 05:25:26 | 000,039,424 | -H-- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.01)
DRV - [2011.06.06 23:06:54 | 000,211,984 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011.02.17 01:36:33 | 000,431,672 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.11.20 13:30:15 | 000,175,360 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)
DRV - [2010.11.20 10:14:45 | 000,017,920 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.05.12 17:29:32 | 000,600,096 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.04.23 04:33:12 | 000,036,864 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Programme\AMD\OverDrive\i386\AODDriver2.sys -- (AODDriver2)
DRV - [2010.03.09 11:21:26 | 000,107,024 | -H-- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010.02.24 11:22:10 | 000,185,472 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2010.02.18 08:18:22 | 000,037,944 | -H-- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2010.02.03 14:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.09.26 18:05:22 | 000,004,992 | -H-- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\enport.sys -- (enport)
DRV - [2009.09.16 07:02:40 | 000,027,136 | -H-- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.06.11 18:39:16 | 000,012,928 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.06.11 18:39:14 | 000,012,032 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.06.11 18:39:14 | 000,010,496 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.05.12 14:53:04 | 000,016,896 | -H-- | M] (Danish Wireless Design A/S) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FlashUsb.sys -- (FlashUSB)
DRV - [2008.11.19 16:09:10 | 000,024,832 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 16:09:08 | 000,019,968 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 16:09:08 | 000,013,056 | -H-- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.07.24 10:03:56 | 000,101,760 | -H-- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.06.29 13:47:34 | 000,034,304 | -H-- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006.09.24 14:28:46 | 000,005,248 | -H-- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [1996.04.03 20:33:26 | 000,005,248 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.yahoo.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?btnG=Google+Search&q="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.96.0: C:\Program Files\Battlelog Web Plugins\1.96.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files\OnLive\Plugin\npolgdet.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ethanhund\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 13:39:48 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.20 12:09:43 | 000,000,000 | -H-D | M]
 
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions
[2010.05.21 23:39:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.18 22:52:45 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\ethanhund\AppData\Roaming\mozilla\Firefox\Profiles\8u9rtd2e.default\extensions
[2009.10.03 20:45:30 | 000,001,720 | -H-- | M] () -- C:\Users\ethanhund\AppData\Roaming\Mozilla\Firefox\Profiles\8u9rtd2e.default\searchplugins\youtube-videosuche.xml
[2011.11.09 13:39:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
() (No name found) -- C:\USERS\ETHANHUND\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8U9RTD2E.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.11.09 13:39:48 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.03 20:51:01 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.03 20:51:01 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.03 20:51:01 | 000,001,153 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.03 20:51:01 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.03 20:51:01 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.03 20:51:01 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2000.01.01 00:00:00 | 000,000,794 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 secure.disc-soft.com 
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\ethanhund\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{508DA2EB-470E-488A-8334-53195C972FB4}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{58FD8014-B197-4FFC-898C-49CEF9574F16}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C473E33D-D975-42FC-AD51-7FBBBE88B282}: DhcpNameServer = 7.254.254.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.30 00:26:23 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2011.12.30 00:25:53 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\IObit
[2011.12.30 00:25:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 5
[2011.12.30 00:25:50 | 000,000,000 | ---D | C] -- C:\Program Files\IObit
[2011.12.30 00:22:31 | 029,918,440 | ---- | C] (IObit                                                       ) -- C:\Users\ethanhund\Desktop\asc-setup.exe
[2011.12.30 00:22:31 | 000,114,688 | ---- | C] (Sergiwa Software - www.sergiwa.com) -- C:\Users\ethanhund\Desktop\SMFixer (1).exe
[2011.12.28 20:26:44 | 013,751,224 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\ethanhund\Desktop\SUPERAntiSpyware.exe
[2011.12.23 23:16:34 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Malwarebytes
[2011.12.23 23:16:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.23 23:16:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.23 23:16:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.12.23 23:13:38 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\ethanhund\Desktop\mbam-setup-1.51.2.1300.exe
[2011.12.23 23:13:38 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\Desktop\TDSS
[2011.12.23 20:58:12 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011.12.23 12:28:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011.12.23 12:28:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011.12.23 12:28:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011.12.23 12:26:51 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.12.23 12:25:39 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.12.23 11:26:12 | 004,350,311 | R--- | C] (Swearware) -- C:\Users\ethanhund\Desktop\ComboFix.exe
[2011.12.23 11:07:17 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.12.23 09:10:12 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.23 09:01:58 | 000,000,000 | ---D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.23 08:50:57 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
[2011.12.22 22:14:59 | 000,218,688 | -H-- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:07:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jeak.de
[2011.12.15 00:43:02 | 000,000,000 | -H-D | C] -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011.12.15 00:43:01 | 000,000,000 | -H-D | C] -- C:\ProgramData\RELOADED
[2011.12.07 03:16:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock Games
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.30 20:43:17 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.30 20:43:17 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.30 20:39:46 | 000,000,388 | -H-- | M] () -- C:\Windows\tasks\QIPdater 2012.job
[2011.12.30 20:38:25 | 000,000,344 | -H-- | M] () -- C:\Windows\tasks\qipdater.exe.job
[2011.12.30 20:38:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.30 20:38:07 | 2616,057,856 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.30 00:52:31 | 000,001,136 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000UA.job
[2011.12.30 00:25:54 | 000,001,226 | ---- | M] () -- C:\Users\Public\Desktop\Quick Care.lnk
[2011.12.30 00:25:53 | 000,001,204 | ---- | M] () -- C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2011.12.29 18:03:56 | 000,114,688 | ---- | M] (Sergiwa Software - www.sergiwa.com) -- C:\Users\ethanhund\Desktop\SMFixer (1).exe
[2011.12.29 17:59:10 | 029,918,440 | ---- | M] (IObit                                                       ) -- C:\Users\ethanhund\Desktop\asc-setup.exe
[2011.12.28 20:27:48 | 013,751,224 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\ethanhund\Desktop\SUPERAntiSpyware.exe
[2011.12.24 20:52:01 | 000,001,084 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3336242082-4278682780-2186126620-1000Core.job
[2011.12.23 23:16:24 | 000,001,098 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.23 23:13:39 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\ethanhund\Desktop\mbam-setup-1.51.2.1300.exe
[2011.12.23 23:13:39 | 000,302,592 | ---- | M] () -- C:\Users\ethanhund\Desktop\qbqgb7tt.exe
[2011.12.23 11:26:13 | 004,350,311 | R--- | M] (Swearware) -- C:\Users\ethanhund\Desktop\ComboFix.exe
[2011.12.23 09:10:12 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ethanhund\Desktop\OTL.exe
[2011.12.23 09:01:29 | 000,322,393 | ---- | M] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.23 08:53:24 | 000,700,130 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.23 08:53:24 | 000,654,842 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.23 08:53:24 | 000,148,926 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.23 08:53:24 | 000,121,714 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.22 22:19:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\Access.dat
[2011.12.22 22:14:59 | 000,218,688 | -H-- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011.12.22 22:06:01 | 000,414,368 | -H-- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.12.22 05:51:27 | 000,140,072 | -H-- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.12.22 05:51:18 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2011.12.22 05:11:56 | 000,280,904 | -H-- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2011.12.12 02:05:38 | 000,337,452 | -H-- | M] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.30 00:25:54 | 000,001,226 | ---- | C] () -- C:\Users\Public\Desktop\Quick Care.lnk
[2011.12.30 00:25:53 | 000,001,204 | ---- | C] () -- C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2011.12.23 23:16:24 | 000,001,098 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.23 23:13:39 | 000,302,592 | ---- | C] () -- C:\Users\ethanhund\Desktop\qbqgb7tt.exe
[2011.12.23 12:28:00 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011.12.23 12:28:00 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011.12.23 12:28:00 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.12.23 12:28:00 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.12.23 12:28:00 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.12.23 09:01:59 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.12.23 09:01:59 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2011.12.23 09:01:59 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011.12.23 09:01:59 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2011.12.23 09:01:59 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2011.12.23 09:01:58 | 000,001,417 | ---- | C] () -- C:\Users\ethanhund\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.23 09:01:29 | 000,322,393 | ---- | C] () -- C:\Users\ethanhund\Desktop\win7-32-sm-reset.exe
[2011.12.12 02:05:32 | 000,337,452 | -H-- | C] () -- C:\Users\ethanhund\Desktop\tumblr_lvte4usg1V1qhpx54o1_400.gif
[2011.11.13 23:40:31 | 000,451,072 | -H-- | C] () -- C:\Windows\System32\ISSRemoveSP.exe
[2011.10.14 12:53:07 | 000,053,248 | -H-- | C] () -- C:\Windows\System32\CommonDL.dll
[2011.10.14 12:53:07 | 000,002,413 | -H-- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2011.10.04 23:00:01 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.09.22 15:33:23 | 000,000,043 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_local.cfg
[2011.09.22 15:04:46 | 000,011,099 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\TheHunterSettings_live.bin
[2011.09.14 10:47:40 | 000,053,760 | -H-- | C] () -- C:\Windows\System32\OVDecode.dll
[2011.09.08 17:51:22 | 000,037,376 | -H-- | C] () -- C:\Windows\System32\atitmpxx.dll
[2011.08.24 00:51:40 | 000,281,760 | -H-- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.08.24 00:51:37 | 000,025,888 | -H-- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.08.17 20:48:44 | 000,237,701 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.07.24 02:06:29 | 000,000,082 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\X-Plane Installer.prf
[2011.07.11 16:17:35 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2011.04.09 17:55:28 | 000,179,261 | -H-- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.03.17 18:51:44 | 000,003,929 | -H-- | C] () -- C:\Windows\System32\atipblag.dat
[2011.02.28 13:11:17 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.02.28 13:09:51 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.10.31 10:31:39 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.12 20:14:31 | 000,012,800 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.10 01:36:48 | 000,036,734 | -H-- | C] () -- C:\Windows\System32\OggDSuninst.exe
[2010.09.17 23:24:08 | 000,001,395 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\SAS7_000.DAT
[2010.08.19 12:49:54 | 001,970,176 | -H-- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.08.02 14:31:53 | 000,000,530 | ---- | C] () -- C:\Windows\eReg.dat
[2010.07.21 01:35:51 | 000,165,376 | -H-- | C] () -- C:\Windows\System32\unrar.dll
[2010.07.21 01:35:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.07.21 01:35:50 | 000,790,528 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.07.21 01:35:50 | 000,134,144 | -H-- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.07.21 01:35:50 | 000,108,032 | -H-- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.06.25 16:55:46 | 000,017,408 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\WebpageIcons.db
[2010.06.16 22:40:07 | 000,000,853 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_sta
[2010.06.16 22:39:10 | 000,000,849 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\RT3070_{EB772CD6-AFF3-46A1-BA99-E1F1CE80FDE2}_prof
[2010.06.12 19:30:42 | 000,036,892 | -H-- | C] () -- C:\Windows\System32\BASSMOD.dll
[2010.06.12 19:30:11 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.06.12 19:30:11 | 000,000,001 | ---- | C] () -- C:\Windows\audi20.dat
[2010.05.26 20:01:44 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.05.21 23:39:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.03 16:27:30 | 000,000,170 | ---- | C] () -- C:\Windows\game.ini
[2010.03.17 22:00:27 | 002,434,856 | -H-- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2009.11.09 14:21:02 | 000,066,560 | -H-- | C] () -- C:\Windows\System32\ntrights.exe
[2009.10.17 20:06:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\Access.dat
[2009.10.09 15:12:59 | 000,138,056 | -H-- | C] () -- C:\Users\ethanhund\AppData\Roaming\PnkBstrK.sys
[2009.10.09 15:12:29 | 003,360,624 | -H-- | C] () -- C:\Windows\System32\pbsvc.exe
[2009.10.05 14:09:42 | 001,658,973 | -H-- | C] () -- C:\Windows\System32\libmmd.dll
[2009.10.05 14:09:42 | 000,122,880 | -H-- | C] () -- C:\Windows\System32\PtSSE2.dll
[2009.10.05 14:09:42 | 000,019,968 | -H-- | C] () -- C:\Windows\System32\Cpuinf32.dll
[2009.09.26 18:05:22 | 000,008,192 | -H-- | C] () -- C:\Windows\System32\gsimrxnp.dll
[2009.09.26 18:05:22 | 000,004,992 | -H-- | C] () -- C:\Windows\System32\drivers\enport.sys
[2009.09.19 02:48:22 | 000,140,072 | -H-- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.09.19 02:47:12 | 000,280,904 | -H-- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009.09.19 02:45:01 | 000,075,136 | -H-- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.09.13 00:49:25 | 000,007,604 | -H-- | C] () -- C:\Users\ethanhund\AppData\Local\Resmon.ResmonCfg
[2009.07.14 09:47:43 | 000,700,130 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,148,926 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 002,340,040 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,654,842 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,121,714 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.10.06 19:42:57 | 000,237,568 | -H-- | C] () -- C:\Windows\System32\OggDS.dll
[2002.10.05 00:04:25 | 000,921,600 | -H-- | C] () -- C:\Windows\System32\vorbisenc.dll
[2002.10.05 00:04:24 | 000,188,416 | -H-- | C] () -- C:\Windows\System32\vorbis.dll
[2002.10.05 00:04:17 | 000,045,056 | -H-- | C] () -- C:\Windows\System32\ogg.dll
[1996.04.03 20:33:26 | 000,005,248 | -H-- | C] () -- C:\Windows\System32\giveio.sys
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0FF263E8

< End of report >
         
--- --- ---
__________________


Alt 01.01.2012, 11:45   #18
Chris4You
 
Erster Befall unter 7 32bit, multiple Probleme - Standard

Erster Befall unter 7 32bit, multiple Probleme



Hi,

Unhide
Lade Dir unhide von folgender Adresse runter und dann per Doppelklick als Admin ausführen:
[url[http://filepony.de/download-unhide/[/url]
Es werden alle versteckten Dateien sichtbar gemacht, ggf. welche die versteckt sein sollten wieder unsichtbar machen (Auswählen im Explorer->Eingenschaften->versteckt)

Ein neuer Treiber, kennst Du den?
C:\Windows\System32\drivers\dtsoftbus01.sys

Eine interessante: DhcpNameServer = 7.254.254.254-Adresse (Tunngle?)

Lass mal den Tdss-Killer (neue Version laden) los und kreuze bei den Einstellungen noch die Suche nach TDSS/3/$-Filesystem an (detect the presence of TDLFS file system which the TDL 3/4 rootkits create in the last sectors of hard disk drives for storing its files. All these files can be quarantined.)

chris
__________________
__________________

Alt 04.01.2012, 10:24   #19
ethanhund
 
Erster Befall unter 7 32bit, multiple Probleme - Standard

Erster Befall unter 7 32bit, multiple Probleme



Update:

Also mitlerweile habe ich das System neu aufgesetzt, die SSD nutze ich nun als Bootlaufwerk, die HDD als reinen Datenablageort. Das Ausgangsproblem ist somit gelöst. Einzig der noch nicht gereinigte MBR-Sektor sorgt bei mir noch für Kopfschmerzen. Leider habe ich erst nach der Formation der betroffenen HDD erfahren, dass der klassische fdisk/ mbr-Befehl nur bei einem fertig installierten OS anwendbar ist. Da ich mir den Aufwand, nochmals Windows auf der HDD zu installieren und vorher die bereits darauf installierte Software wiederum auf der bereits gut gefüllten externen Festplatte zu sichern, sparen möchte, bleiben mir demzufolge zwei Alternativen:
1.: Dauerhaft darauf verzichten, Windows auf der HDD zu installieren (MBR bleibt ungesäubert)
2.: Eine Möglichkeit finden, den MBR zu säubern, ohne dafür Windows installieren zu müssen

Da mir in der Hardwareabteilung dieses Forums leider bisher keine Softwarelösung für die zweite Alternative geliefert werden konnte, muss ich mich wohl damit abfinden, niemals wieder guten Gewissens Windows auf der HDD installieren zu können.

Dennoch ist mein ursprüngliches Schädlingsproblem hinfällig geworden, wofür ich mich bei Chris4You vielmals bedanke, und der Thread kann von mir aus geschlossen werden.

Antwort

Themen zu Erster Befall unter 7 32bit, multiple Probleme
adobe after effects, alternate, bho, candy, desktop, disabletaskmgr, error, excel, excel.exe, failed, firefox, flash player, google, google chrome, grand theft auto, helper, homepage, iexplore.exe, install.exe, logfile, microsoft office word, mozilla, nicht mehr öffnen, origin, plug-in, problem, programm, realtek, registry, scan, security, security update, senden, software, studio, system, taskmanager, teamspeak, third party, trojaner-board, webcheck, windows detected a hard disk problem




Ähnliche Themen: Erster Befall unter 7 32bit, multiple Probleme


  1. Begrenzte Internetverbindung unter Windows 10; keinerlei Probleme unter Ubuntu
    Netzwerk und Hardware - 05.09.2015 (13)
  2. Positiver Befall mit 4 Trojanern unter Windows7 #1
    Log-Analyse und Auswertung - 22.05.2015 (20)
  3. Lüfter läuft ständig auf hochtouren obwohl CPU normal läuft unter w7 home premium 32bit serv.pck 1 DANKE!
    Log-Analyse und Auswertung - 09.09.2014 (12)
  4. Multiple Probleme mit Viren und Trojanern
    Plagegeister aller Art und deren Bekämpfung - 25.07.2014 (11)
  5. Unter Win 7 HomePremium mehrfacher Trojaner-Befall
    Plagegeister aller Art und deren Bekämpfung - 09.07.2014 (19)
  6. Windows Vista 32Bit: Probleme nach Reparatur von Fake Java Update mit MalwareBytes
    Alles rund um Windows - 13.05.2014 (9)
  7. TR/Trash.Gen Befall unter Windows XP
    Log-Analyse und Auswertung - 05.12.2013 (17)
  8. Win7 32bit Advanced System Protector Befall und evt. weitere
    Log-Analyse und Auswertung - 15.11.2013 (14)
  9. GVU Trojaner-Befall, vermutlich V2.07. WIN7pro 32Bit
    Log-Analyse und Auswertung - 02.09.2013 (3)
  10. Laptop / Windows Vista Home 32bit/ System Care Antivirus Befall
    Log-Analyse und Auswertung - 20.08.2013 (13)
  11. system32\drivers\ wird unter 32bit shell nicht gelistet
    Alles rund um Windows - 07.01.2013 (1)
  12. "ihavenet-Problem" bei Google-Suche im Mozilla Firefox unter Windows Vista 32bit
    Plagegeister aller Art und deren Bekämpfung - 02.01.2013 (18)
  13. Befall mit BKA Trojaner, Win7 32bit
    Log-Analyse und Auswertung - 10.08.2012 (12)
  14. Nach Befall von Live Security Platinum unter Vista
    Log-Analyse und Auswertung - 26.07.2012 (1)
  15. Unter Befall gesicherte Dateien gefahrlos neu aufspielen möglich?
    Plagegeister aller Art und deren Bekämpfung - 01.12.2011 (4)
  16. 4GB RAM unter Win7 32Bit
    Alles rund um Windows - 27.12.2010 (4)
  17. Probleme mit neuer Grafikkarte unter Vista Home Basic 32bit
    Alles rund um Windows - 11.01.2010 (1)

Zum Thema Erster Befall unter 7 32bit, multiple Probleme - Hi, also die ssd ist neu eingebaut, hat ein eigenes os drauf (diesmal 64bit), eine Übertragung auf dieselbe ist also eher unwahrscheinlich? Ist das Bootkit Versionsabhängig? Sprich, ist eine Verbreitung - Erster Befall unter 7 32bit, multiple Probleme...
Archiv
Du betrachtest: Erster Befall unter 7 32bit, multiple Probleme auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.