| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Gema 50 EUR Problem sbcvvhost_win86Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.12.2011, 02:16
| #1 |
| |  Gema 50 EUR Problem sbcvvhost_win86 hallo auch ich depp hab mir den gema trojaner eingefangen, nur weißer bildschirm bzw. gesperrt für 50 eur. entsperren, keine bedienung möglich beim runterfahren prog.: sbcvvhost_win86 blockiert das runterfahren. os ist win 7 home premium x86 gruß rübi |
|
26.12.2011, 02:55
| #2 |
| | Gema 50 EUR Problem sbcvvhost_win86 WIN_7 X86 Service Pack 1
__________________Running from G:\ Modified HKLM shell extension. Current Shell File = C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe . . File C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe moved to G:\\infected or not found HKCU\..\Winlogon; Shell not found . [System Process] System smss.exe csrss.exe csrss.exe wininit.exe winlogon.exe services.exe lsass.exe lsm.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe cmd.exe conhost.exe ctfmon.exe dinotify.exe WmiPrvSE.exe srep.exe HKLM\..\Run [SynTPStart] = C:\Program Files\Synaptics\SynTP\SynTPStart.exe HKLM\..\Run [S3Trayp] = S3trayp.exe HKLM\..\Run [TPPOLL] = C:\Program Files\TOPRO\TPPOLL.EXE HKLM\..\Run [avgnt] = "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\..\Run [WBhXTAWuFpmNyON] = C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe HKCU\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKCU\..\Run [WBhXTAWuFpmNyON] = C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe HKU\.DEFAULT\..\Winlogon; Shell = HKU\S-1-5-19\..\Winlogon; Shell = HKU\S-1-5-20\..\Winlogon; Shell = HKU\S-1-5-21-3312457016-3241351049-4209360694-1000\..\Winlogon; Shell = C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe HKU\S-1-5-21-3312457016-3241351049-4209360694-1000_Classes\..\Winlogon; Shell = HKU\S-1-5-18\..\Winlogon; Shell = HKU\S-1-5-19\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-3312457016-3241351049-4209360694-1000\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKU\S-1-5-21-3312457016-3241351049-4209360694-1000\..\Run [WBhXTAWuFpmNyON] = C:\Users\Hans-Peter\AppData\Roaming\sbcvvhost_win86.exe ==== FINISH 26.12-02.40 ==== |
|
26.12.2011, 02:58
| #3 |
| | Gema 50 EUR Problem sbcvvhost_win86 beitrag vorher =
__________________ergebniss des srep.exe bzw. shell text |
|
26.12.2011, 04:05
| #4 |
| | Gema 50 EUR Problem sbcvvhost_win86 Die OTL Dateien: |
|
26.12.2011, 04:27
| #5 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Gema 50 EUR Problem sbcvvhost_win86Zitat:
Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
27.12.2011, 02:45
| #6 |
| | Gema 50 EUR Problem sbcvvhost_win86 Jup, bootet, Desktop Icons weg (alte und neu angelegte !). MWB: Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 911122602 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 26.12.2011 23:59:59 mbam-log-2011-12-26 (23-59-58).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 241644 Laufzeit: 1 Stunde(n), 3 Minute(n), 5 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
27.12.2011, 13:18
| #7 |
| | Gema 50 EUR Problem sbcvvhost_win86Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dc0a70b63191554d8b6904e66f4b212f
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-27 01:41:26
# local_time=2011-12-27 02:41:26 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 1783328 1783328 0 0
# compatibility_mode=5893 16776574 100 94 26128887 76579453 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=1184
# found=0
# cleaned=0
# scan_time=1826
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dc0a70b63191554d8b6904e66f4b212f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-27 11:58:54
# local_time=2011-12-27 12:58:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 1814619 1814619 0 0
# compatibility_mode=5893 16776574 100 94 26160178 76610744 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=92661
# found=5
# cleaned=0
# scan_time=7602
C:\Users\Hans-Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\57650353-73948c57 a variant of Win32/Injector.MOW trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Hans-Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\150cad71-41cfe915 Java/Exploit.CVE-2011-3544.L trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Hans-Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\6fd183b9-40d7c7bc Java/Exploit.CVE-2011-3544.K trojan (unable to clean) 00000000000000000000000000000000 I
Geändert von Rübennase (27.12.2011 um 13:30 Uhr) |
|
27.12.2011, 17:08
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Gema 50 EUR Problem sbcvvhost_win86 Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt? Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.12.2011, 20:17
| #9 |
| | Gema 50 EUR Problem sbcvvhost_win86 hallo cosinus hatte vorher nur das kolo-Emsisoft drauf. PC funzt soweit aber wieder, meine icons auf dem desk sind wieder da, scanns mit mwb, emsisoft und antivir ohne funde :-)) also denke das ist ausgestanden, ich danke dir und dem forum. |
|
28.12.2011, 23:10
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Gema 50 EUR Problem sbcvvhost_win86 Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.12.2011, 14:41
| #11 |
| | Gema 50 EUR Problem sbcvvhost_win86Code:
ATTFilter OTL logfile created on: 29.12.2011 14:23:46 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Hans-Peter\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 1,21 Gb Available Physical Memory | 64,68% Memory free 3,75 Gb Paging File | 2,85 Gb Available in Paging File | 76,08% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 40,25 Gb Total Space | 10,84 Gb Free Space | 26,93% Space Free | Partition Type: NTFS Drive D: | 34,18 Gb Total Space | 19,60 Gb Free Space | 57,35% Space Free | Partition Type: NTFS Computer Name: LAPPI | User Name: Hans-Peter | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Hans-Peter\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Programme\Mamutu\mamutu.exe (Emsi Software GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Mamutu\a2service.exe (Emsi Software GmbH) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) PRC - C:\Windows\System32\s3trayp.exe (S3 Graphics Co., Ltd.) PRC - C:\Programme\Topro\tppoll.exe () ========== Modules (No Company Name) ========== MOD - C:\Programme\WinRAR\RarExt.dll () MOD - C:\Programme\Ashampoo\Ashampoo Magical Security\ash_lang.dll () MOD - C:\Programme\Ashampoo\Ashampoo Magical Security\AshPPCor.dll () MOD - C:\Programme\Topro\tppoll.exe () ========== Win32 Services (SafeList) ========== SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (Mamutu) -- C:\Program Files\Mamutu\a2service.exe (Emsi Software GmbH) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (ShellfireVPN2Service) -- C:\Program Files\ShellfireVPN\jre6\bin\java.exe (Sun Microsystems, Inc.) SRV - (afcdpsrv) -- C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) SRV - (AcrSch2Svc) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (HsfXAudioService) -- C:\Windows\System32\XAudio32.dll (Conexant Systems, Inc.) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (a2injectiondriver) -- C:\Programme\Mamutu\a2dix86.sys (Emsi Software GmbH) DRV - (a2acc) -- C:\Programme\Mamutu\a2accx86.sys (Emsi Software GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project) DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys () DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation) DRV - (afcdp) -- C:\Windows\System32\drivers\afcdp.sys (Acronis) DRV - (tdrpman251) Acronis Try&Decide and Restore Points filter (build 251) -- C:\Windows\system32\DRIVERS\tdrpm251.sys (Acronis) DRV - (timounter) -- C:\Windows\system32\DRIVERS\timntr.sys (Acronis) DRV - (snapman) -- C:\Windows\system32\DRIVERS\snapman.sys (Acronis) DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV - (vpcvmm) -- C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation) DRV - (vpcbus) -- C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation) DRV - (vpcusb) -- C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation) DRV - (vpcnfltr) -- C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (FLxHCIc) Fresco Logic xHCI (USB3) -- C:\Windows\System32\drivers\FLxHCIc.sys (Fresco Logic) DRV - (FLxHCIh) Fresco Logic xHCI (USB3) -- C:\Windows\System32\drivers\FLxHCIh.sys (Fresco Logic) DRV - (HWiNFO32) -- C:\Programme\HWiNFO32\HWiNFO32.SYS (REALiX(tm)) DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.) DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.) DRV - (emAudio) -- C:\Windows\System32\drivers\emAudio.sys (eMPIA Technology, Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (a2util) -- C:\Programme\Mamutu\a2util32.sys (Emsi Software GmbH) DRV - (Ser2pl) -- C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.) DRV - (azvusb) -- C:\Windows\System32\drivers\azvusb.sys (AzureWave Technologies, Inc.) DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology, Corp.) DRV - (FETNDIS) -- C:\Windows\System32\drivers\fetnd6.sys (VIA Technologies, Inc. ) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio32.sys (Conexant Systems, Inc.) DRV - (DCamUSBIntel) -- C:\Windows\System32\drivers\TP6800.sys (Microsoft Corporation) DRV - (S3GIGP) -- C:\Windows\System32\drivers\VTGKModeDX32.sys (S3 Graphics Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://svoberwinden1926.mein-verein.de/startseite.cfm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E9 2E 7C 38 0E D6 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.12.23 16:33:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 12:22:25 | 000,000,000 | ---D | M] [2011.12.06 02:06:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.12.23 16:33:04 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.03.05 13:53:54 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.12.23 16:32:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.12.23 16:32:44 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.12.23 16:32:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.12.23 16:32:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.12.23 16:32:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.12.23 16:32:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Mamutu Guard] C:\PROGRAM FILES\MAMUTU\mamutu.exe (Emsi Software GmbH) O4 - HKLM..\Run: [S3Trayp] C:\Windows\System32\s3trayp.exe (S3 Graphics Co., Ltd.) O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TPPOLL] C:\Programme\Topro\tppoll.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0 O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AEBE9188-13F6-40FD-B4C2-4D272126F47C}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B509009C-0086-41C7-B1DC-1D6A78403B97}: DhcpNameServer = 213.133.98.98 213.133.100.100 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.29 00:19:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.12.29 00:18:01 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2011.12.28 19:17:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mamutu [2011.12.28 19:17:23 | 000,000,000 | ---D | C] -- C:\Program Files\Mamutu [2011.12.27 02:07:51 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2011.12.27 02:07:02 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hans-Peter\Desktop\esetsmartinstaller_enu.exe [2011.12.26 03:46:15 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Hans-Peter\Desktop\OTL.exe [2011.12.26 03:30:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.26 03:30:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.26 03:30:29 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.12.26 03:30:29 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.12.25 15:51:56 | 000,000,000 | ---D | C] -- C:\Users\Hans-Peter\Desktop\Trinidad-Scorpion-Butch T [2011.12.24 12:44:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011.12.24 12:12:19 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware [2011.12.24 12:12:19 | 000,000,000 | ---D | C] -- C:\Users\Hans-Peter\Documents\Anti-Malware [2011.12.23 17:01:25 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2011.12.23 16:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live [2011.12.06 14:51:52 | 000,000,000 | ---D | C] -- C:\Users\Hans-Peter\Desktop\WilmaaTVStream [2011.12.06 11:49:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.12.06 11:49:04 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.12.06 11:49:02 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.12.06 11:49:02 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.12.06 11:49:02 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2011.12.06 11:48:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.12.06 11:48:54 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.12.06 02:01:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UMPlayer ========== Files - Modified Within 30 Days ========== [2011.12.29 14:23:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.29 13:32:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.29 11:44:30 | 000,656,040 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.12.29 11:44:30 | 000,616,546 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.12.29 11:44:30 | 000,130,640 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.12.29 11:44:30 | 000,106,926 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.12.29 11:40:56 | 000,016,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.29 11:40:56 | 000,016,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.29 11:33:53 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.29 11:33:09 | 000,348,008 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.12.29 11:32:30 | 1508,466,688 | -HS- | M] () -- C:\hiberfil.sys [2011.12.29 00:19:49 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2011.12.28 19:17:26 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\Mamutu.lnk [2011.12.28 12:40:36 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.28 02:35:21 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI [2011.12.27 13:35:35 | 000,004,426 | ---- | M] () -- C:\Users\Hans-Peter\Documents\cc_20111227_133531.reg [2011.12.27 02:07:04 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Hans-Peter\Desktop\esetsmartinstaller_enu.exe [2011.12.26 03:46:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Hans-Peter\Desktop\OTL.exe [2011.12.25 14:13:00 | 000,282,013 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\Yahoo! Mail POP3.pdf [2011.12.25 02:44:52 | 027,735,877 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\How To Make Your Own Hot Sauce.mp4 [2011.12.24 11:07:16 | 000,296,777 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\Freenet Live mail POP3.pdf [2011.12.24 00:26:10 | 000,083,274 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\freenet POP3.JPG [2011.12.23 19:33:35 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.12.23 17:05:15 | 000,001,404 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\Windows Live Mail.lnk [2011.12.23 16:32:46 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.12.06 15:28:30 | 000,255,745 | ---- | M] () -- C:\Users\Hans-Peter\Desktop\HörnlebergGalerie.jpg [2011.12.06 11:49:22 | 000,001,940 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.12.06 02:36:34 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ShellfireVPN.lnk [2011.12.06 02:01:07 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\UMPlayer.lnk ========== Files Created - No Company Name ========== [2011.12.29 11:32:33 | 000,348,008 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2011.12.29 00:19:49 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2011.12.29 00:18:10 | 000,000,894 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.29 00:18:10 | 000,000,890 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.28 19:17:26 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\Mamutu.lnk [2011.12.28 12:40:36 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.27 13:35:33 | 000,004,426 | ---- | C] () -- C:\Users\Hans-Peter\Documents\cc_20111227_133531.reg [2011.12.25 14:12:59 | 000,282,013 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\Yahoo! Mail POP3.pdf [2011.12.25 02:44:26 | 027,735,877 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\How To Make Your Own Hot Sauce.mp4 [2011.12.24 11:07:11 | 000,296,777 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\Freenet Live mail POP3.pdf [2011.12.24 00:26:10 | 000,083,274 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\freenet POP3.JPG [2011.12.23 17:05:15 | 000,001,404 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\Windows Live Mail.lnk [2011.12.23 17:03:07 | 000,001,404 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2011.12.06 14:12:20 | 000,255,745 | ---- | C] () -- C:\Users\Hans-Peter\Desktop\HörnlebergGalerie.jpg [2011.12.06 11:49:22 | 000,001,940 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.12.06 02:36:34 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\ShellfireVPN.lnk [2011.07.29 09:42:46 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2011.07.20 00:42:03 | 002,340,992 | ---- | C] () -- C:\Windows\System32\BootMan.exe [2011.07.20 00:42:03 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe [2011.07.20 00:42:03 | 000,018,048 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll [2011.07.20 00:42:03 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys [2011.07.20 00:42:03 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys [2011.03.23 16:18:24 | 000,000,193 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc [2011.03.16 00:48:25 | 001,523,712 | ---- | C] () -- C:\Windows\System32\ToproVC.dll [2011.03.16 00:48:25 | 000,221,184 | ---- | C] () -- C:\Windows\ToproUI.exe [2011.03.16 00:48:25 | 000,065,536 | ---- | C] () -- C:\Windows\System32\camlib.dll [2011.03.16 00:48:25 | 000,040,960 | ---- | C] () -- C:\Windows\tpsti.exe [2011.02.27 02:45:24 | 000,449,024 | ---- | C] () -- C:\Windows\System32\UNESB.EXE [2011.02.27 02:45:24 | 000,266,240 | ---- | C] () -- C:\Windows\System32\ESB.EXE [2011.02.27 02:27:23 | 000,069,632 | ---- | C] () -- C:\Windows\System32\vuins32.dll [2011.02.27 00:17:07 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll [2010.01.18 13:42:06 | 000,034,666 | ---- | C] () -- C:\Windows\Irremote.ini [2009.07.14 09:47:43 | 000,656,040 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 09:47:43 | 000,130,640 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:05:48 | 000,616,546 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,106,926 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2007.09.06 01:01:22 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll [2007.08.23 17:55:34 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2006.03.09 01:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll ========== LOP Check ========== [2011.08.04 10:00:10 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.02.27 18:46:20 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Acronis [2011.02.27 00:22:36 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Adobe [2011.05.13 11:08:12 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\AnvSoft [2011.03.23 17:11:52 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Ashampoo [2011.12.06 11:53:06 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Avira [2011.12.06 02:33:02 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\BOM [2011.02.28 22:25:04 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\cerasus.media [2011.08.04 18:23:16 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\DAEMON Tools Lite [2011.12.26 03:18:30 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\DivX [2011.04.04 22:55:25 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\GARMIN [2011.02.26 23:24:34 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\GHISLER [2011.02.26 23:04:13 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Identities [2011.02.27 02:37:39 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\InstallShield [2011.02.27 00:01:42 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\IrfanView [2011.02.27 00:59:54 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Macromedia [2011.12.26 03:30:43 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Malwarebytes [2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Media Center Programs [2011.12.06 15:31:21 | 000,000,000 | --SD | M] -- C:\Users\Hans-Peter\AppData\Roaming\Microsoft [2011.02.27 00:41:30 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Mozilla [2011.12.27 20:14:23 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\NetSpeedMonitor [2011.04.13 13:27:31 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Opera [2011.12.06 02:39:31 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\ShellfireVPN [2011.12.25 03:08:11 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Skype [2011.06.25 00:46:06 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\skypePM [2011.04.05 10:45:44 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Softplicity [2011.02.28 23:13:20 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\TrueCrypt [2011.03.11 15:26:56 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\uTorrent [2011.07.17 21:14:16 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\vlc [2011.12.23 17:17:24 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\Windows Live Writer [2011.03.25 17:41:32 | 000,000,000 | ---D | M] -- C:\Users\Hans-Peter\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2011.02.27 15:06:08 | 000,696,277 | ---- | M] () -- C:\Users\Hans-Peter\AppData\Roaming\unins000.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe [2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < > < End of report > |
|
29.12.2011, 16:51
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Gema 50 EUR Problem sbcvvhost_win86Zitat:
 Mach danach ein neues OTL-Log. Wie o.g.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Gema 50 EUR Problem sbcvvhost_win86 |
| bedienung, bildschirm, blockiert, eingefangen, gefangen, gema trojaner, gen, gesperrt, home, home premium, keine bedienung, premium, problem, runterfahren, sbcvvhost_win86, sperre, sperren, troja, trojaner, trojaner eingefangen, weißer, win, win 7 |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
