| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: sbcvvhost_win86 TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.01.2012, 17:42
| #31 |
  |  sbcvvhost_win86 Trojaner Hi, hier: FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) Solltest Du mal rausschmeisen, oder ich entsorge es per OTL... chris Es gibt eine neue Version von MAM, daher updaten und Fullscan...
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
03.01.2012, 15:46
| #32 |
 | sbcvvhost_win86 TrojanerCode:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.02.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 DevilTech :: DEVILTECH-PC [Administrator] Schutz: Aktiviert 02.01.2012 21:02:01 mbam-log-2012-01-02 (21-02-01).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 374478 Laufzeit: 1 Stunde(n), 4 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) also MAM zeigt mir nun nicht die an die mir DrWeb angezeigt hat. kannst du mir die von DrWeb und des mit der pmb.exe da per OTL löschen? dann müsste der rechner an sich ja wieder steril sein(oder?). |
|
04.01.2012, 09:40
| #33 |
| | sbcvvhost_win86 Trojaner Hi,
__________________Fix für OTL:
 Code:
ATTFilter :OTL
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
[2011.12.09 23:02:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks
:Commands
[emptytemp]
[Reboot]
chris
__________________ |
|
04.01.2012, 11:57
| #34 |
| | sbcvvhost_win86 Trojaner Hey, hier hab ich noch erstmal einen OTL Scan. meine Icons sind trotz "unhide" immernoch nit da! Code:
ATTFilter OTL logfile created on: 04.01.2012 11:50:47 - Run 5 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\DevilTech\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,71 Gb Available Physical Memory | 35,62% Memory free 3,99 Gb Paging File | 2,56 Gb Available in Paging File | 64,09% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 232,79 Gb Total Space | 60,62 Gb Free Space | 26,04% Space Free | Partition Type: NTFS Computer Name: DEVILTECH-PC | User Name: DevilTech | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\DevilTech\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.) PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) ========== Modules (No Company Name) ========== MOD - C:\Users\DevilTech\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6\CliSecureRT.dll () MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\7c4eea005578d9990f604fda345fb2b4\System.Management.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\44d18693baaee5ee0e6f6fd4910e8f81\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a3ffdc1316821b5ceb32c9a788334329\System.Xaml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\2de8b7360d6a58fa7fd1b451fa88dde6\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\351819dc653a07a310cf1387b3266936\PresentationFramework.Classic.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\813a0913bea1269e48613509609e72b4\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\17bfc7131aca3a393f430121f79307bd\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\419103071a5a5d17738afbe9dd03d58a\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\8244412387a82c0acd3d63622e22cef5\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\9dacf8a5033dfbcb435be166d2f42cdf\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (Application Updater) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe () SRV - (Steganos Volatile Disk) -- C:\Windows\SysWOW64\STGRAMDiskHandler64.exe (Softwareentwicklung Remus - ArchiCrypt) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc) DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation) DRV:64bit: - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation) DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation) DRV:64bit: - (STGMFEngine64) -- C:\Windows\SysNative\drivers\STGMFEngine64.sys (Softwareentwicklung Remus - ArchiCrypt.com) DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC) DRV:64bit: - (CVirtA) -- C:\Windows\SysNative\drivers\CVirtA64.sys (Cisco Systems, Inc.) DRV:64bit: - (Cam5607) -- C:\Windows\SysNative\drivers\BisonC07.sys (Bison Electronics. Inc. ) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (johci) -- C:\Windows\SysNative\drivers\johci.sys (JMicron ) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (smserial) -- C:\Windows\SysNative\drivers\SmSerl64.sys (Motorola Inc.) DRV:64bit: - (netw5v64) Intel(R) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (DNE) -- C:\Windows\SysNative\drivers\dne64x.sys (Deterministic Networks, Inc.) DRV:64bit: - (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) -- C:\Windows\SysNative\drivers\s0017unic.sys (MCCI Corporation) DRV:64bit: - (s0017obex) -- C:\Windows\SysNative\drivers\s0017obex.sys (MCCI Corporation) DRV:64bit: - (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) -- C:\Windows\SysNative\drivers\s0017nd5.sys (MCCI Corporation) DRV:64bit: - (s0017mdm) -- C:\Windows\SysNative\drivers\s0017mdm.sys (MCCI Corporation) DRV:64bit: - (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s0017mgmt.sys (MCCI Corporation) DRV:64bit: - (s0017mdfl) -- C:\Windows\SysNative\drivers\s0017mdfl.sys (MCCI Corporation) DRV:64bit: - (s0017bus) Sony Ericsson Device 0017 driver (WDM) -- C:\Windows\SysNative\drivers\s0017bus.sys (MCCI Corporation) DRV:64bit: - (TcUsb) -- C:\Windows\SysNative\drivers\tcusb.sys (UPEK Inc.) DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.) DRV - (DrvAgent64) -- C:\Windows\SysWOW64\drivers\DrvAgent64.SYS (Phoenix Technologies) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (PVUSB) -- C:\Windows\SysWOW64\drivers\CESG502.SYS (Hitachi Semiconductor and Devices Sales Co.,Ltd.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/413 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E1 5D B7 17 5C 5A CA 01 [binary data] IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\4.9\koyotesoftToolbarIE.dll (Spigot, Inc.) IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=244506&ilc=12" FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=244506&p=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\ChemDraw\npcdp32.dll (CambridgeSoft Corp.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009.12.22 20:53:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.14 15:31:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.14 15:31:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009.12.22 20:53:23 | 000,000,000 | ---D | M] [2011.10.04 08:44:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DevilTech\AppData\Roaming\mozilla\Extensions [2011.12.28 08:59:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions [2011.12.20 16:10:54 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.12.06 08:49:36 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.10.04 08:44:05 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} [2011.04.06 13:28:15 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.04.06 13:28:22 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\DevilTech\AppData\Roaming\mozilla\Firefox\Profiles\hsui6a1g.default\extensions\engine@conduit.com [2011.11.04 01:07:57 | 000,000,933 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\11-suche.xml [2009.11.02 13:53:37 | 000,002,059 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\daemon-search.xml [2011.11.04 01:07:58 | 000,002,419 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\englische-ergebnisse.xml [2011.08.30 00:06:23 | 000,010,525 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\gmx-suche.xml [2012.01.03 21:05:00 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-1.xml [2011.08.17 15:17:02 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-2.xml [2011.09.02 00:44:48 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-3.xml [2011.09.07 22:31:31 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-4.xml [2011.10.05 05:57:09 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-5.xml [2011.10.06 11:08:35 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-6.xml [2011.10.17 11:57:15 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-7.xml [2011.11.09 14:05:53 | 000,000,950 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin-8.xml [2011.06.18 11:00:09 | 000,001,056 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\icqplugin.xml [2011.11.04 01:07:57 | 000,002,457 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\lastminute.xml [2011.10.04 08:44:01 | 000,002,503 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\SearchResults.xml [2011.11.04 01:07:57 | 000,005,508 | ---- | M] () -- C:\Users\DevilTech\AppData\Roaming\Mozilla\Firefox\Profiles\hsui6a1g.default\searchplugins\webde-suche.xml [2011.12.24 16:22:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2009.10.31 19:59:29 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2009.10.31 15:23:36 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.12.24 16:22:17 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM [2011.12.24 16:22:17 | 000,000,000 | ---D | M] (Koyote Soft Toolbar) -- C:\PROGRAM FILES (X86)\KOYOTE SOFT TOOLBAR\FF () (No name found) -- C:\USERS\DEVILTECH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HSUI6A1G.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\DEVILTECH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HSUI6A1G.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI [2011.11.09 14:04:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.10.06 06:05:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.06 06:05:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.10.06 06:05:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.10.06 06:05:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.04 08:44:01 | 000,002,503 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml [2011.10.06 06:05:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.06 06:05:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Loader Class) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Koyote Soft Toolbar) - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\4.9\koyotesoftToolbarIE.dll (Spigot, Inc.) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (Loader Class) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKLM\..\Toolbar: (Koyote Soft Toolbar) - {1E864EAC-892F-4A60-8C17-63123FD5731C} - C:\Program Files (x86)\Koyote Soft Toolbar\IE\4.9\koyotesoftToolbarIE.dll (Spigot, Inc.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll () O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - Startup: C:\Users\DevilTech\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DevilTech\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DevilTech\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{39090016-6A02-4642-9C39-29B9187C71B1}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll (Bandoo Media, inc) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) -C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) -C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll (Bandoo Media, inc) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:64bit: - HKLM IFEO\ipsecdialer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\sepcsuite.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\setmtu.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\ipsecdialer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\sepcsuite.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\setmtu.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.31 00:51:14 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\DoctorWeb [2011.12.29 15:00:34 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\AppData\Roaming\LolClient [2011.12.29 13:18:56 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\Killer [2011.12.29 11:56:45 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\AppData\Roaming\Malwarebytes [2011.12.29 11:56:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.29 11:56:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.29 11:56:34 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.29 11:56:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.12.29 10:55:42 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\DevilTech\Desktop\OTL.exe [2011.12.28 22:01:01 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Windows\SysNative\OTL.exe [2011.12.24 16:22:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Updater [2011.12.24 16:22:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Spigot [2011.12.24 16:22:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Koyote Soft Toolbar [2011.12.23 23:41:10 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Documents\Meine empfangenen Dateien [2011.12.14 10:15:56 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011.12.14 10:15:44 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2011.12.14 10:15:44 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.12.14 10:15:43 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.12.14 10:15:43 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.12.14 10:15:42 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.12.14 10:15:41 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011.12.14 10:15:41 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011.12.14 10:12:54 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011.12.14 10:12:54 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011.12.10 00:32:12 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\riotsGamesLogs [2011.12.10 00:09:55 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2011.12.10 00:09:55 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2011.12.10 00:09:54 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2011.12.10 00:06:28 | 000,000,000 | ---D | C] -- C:\Riot Games [2011.12.10 00:06:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games [2011.12.09 23:03:19 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\LeagueOfLegends [2011.12.09 23:03:03 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\AppData\Local\PMB Files [2011.12.09 23:03:02 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2011.12.09 23:02:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks [2011.12.05 15:49:03 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\Resident Evil Afterlife 1080 Proper [2011.12.05 15:48:28 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\Skate.or.Die [2011.12.05 15:48:07 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\The Transporter 3 [2011.12.05 15:42:55 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\Desktop\Inglourious.Basterds.TS.MD.German.XViD-OWK [2011.12.05 15:24:35 | 000,000,000 | ---D | C] -- C:\Users\DevilTech\AppData\Local\Western Digital [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.04 11:44:42 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.01.04 11:44:42 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.01.04 11:37:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.01.02 21:59:51 | 006,669,278 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.01.02 21:59:51 | 002,482,498 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.01.02 21:59:51 | 002,055,830 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.01.02 21:59:51 | 001,841,650 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.01.02 21:59:51 | 000,006,046 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.30 19:38:13 | 075,126,312 | ---- | M] () -- C:\Users\DevilTech\Desktop\drweb-cureit.exe [2011.12.29 11:56:36 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.28 21:28:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Windows\SysNative\OTL.exe [2011.12.28 21:28:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\DevilTech\Desktop\OTL.exe [2011.12.21 14:39:05 | 000,067,290 | ---- | M] () -- C:\Users\DevilTech\Desktop\800px-Fachhochschule_Emden_Leer_logo.svg.png [2011.12.14 18:38:04 | 000,413,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.10 00:09:56 | 000,001,722 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.12.30 19:33:12 | 075,126,312 | ---- | C] () -- C:\Users\DevilTech\Desktop\drweb-cureit.exe [2011.12.29 11:56:36 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.21 14:38:46 | 000,067,290 | ---- | C] () -- C:\Users\DevilTech\Desktop\800px-Fachhochschule_Emden_Leer_logo.svg.png [2011.12.14 23:42:41 | 000,000,312 | ---- | C] () -- C:\Users\DevilTech\Desktop\Curse Client.appref-ms [2011.12.10 00:09:56 | 000,001,722 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2011.12.05 15:49:16 | 733,958,144 | ---- | C] () -- C:\Users\DevilTech\Desktop\Kategorie C - Deutsche Hooligans.avi [2011.12.05 15:47:33 | 719,515,648 | ---- | C] () -- C:\Users\DevilTech\Desktop\Punisher_War_Zone_synchron.avi [2011.12.05 15:46:59 | 734,550,016 | ---- | C] () -- C:\Users\DevilTech\Desktop\Inception_2 [2010].avi [2011.12.05 15:46:55 | 733,900,800 | ---- | C] () -- C:\Users\DevilTech\Desktop\Inception_1 [2010].avi [2011.12.05 15:46:29 | 731,475,968 | ---- | C] () -- C:\Users\DevilTech\Desktop\Underworld3.avi [2011.12.05 15:45:23 | 912,384,600 | ---- | C] () -- C:\Users\DevilTech\Desktop\How High (kiffer komödie)=method man und redman.avi [2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.09.29 10:24:09 | 000,015,190 | ---- | C] () -- C:\Windows\M3000Twn.ini [2011.09.29 10:24:09 | 000,000,229 | ---- | C] () -- C:\Windows\OEM.ini [2011.09.20 11:02:28 | 000,178,823 | ---- | C] () -- C:\Windows\hpoins44.dat.temp [2011.09.20 11:02:28 | 000,000,586 | ---- | C] () -- C:\Windows\hpomdl44.dat.temp [2011.09.08 16:09:34 | 000,006,036 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.01.04 16:10:56 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.01.04 16:10:56 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.01.04 16:10:56 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.01.04 16:10:56 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2010.03.26 22:20:32 | 000,010,752 | ---- | C] () -- C:\Users\DevilTech\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.01.26 00:24:57 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat [2009.12.22 20:53:03 | 000,023,719 | ---- | C] () -- C:\Windows\hpqins15.dat [2009.12.01 19:05:24 | 000,146,784 | ---- | C] () -- C:\Windows\hpoins44.dat [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.11 10:30:02 | 000,000,512 | ---- | C] () -- C:\Windows\hpomdl44.dat [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat < End of report > |
|
04.01.2012, 12:01
| #35 |
| | sbcvvhost_win86 Trojaner Hier nun der Fix lauf! Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin\ deleted successfully.
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll moved successfully.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin\ deleted successfully.
File C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
C:\Program Files (x86)\Pando Networks\Media Booster\Microsoft.VC90.CRT folder moved successfully.
C:\Program Files (x86)\Pando Networks\Media Booster folder moved successfully.
C:\Program Files (x86)\Pando Networks folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: DevilTech
->Temp folder emptied: 1933699 bytes
->Temporary Internet Files folder emptied: 28734405 bytes
->Java cache emptied: 1052072 bytes
->FireFox cache emptied: 48624003 bytes
->Flash cache emptied: 1508 bytes
User: Public
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 94133 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 422669 bytes
Total Files Cleaned = 77,00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 01042012_115734
Files\Folders moved on Reboot...
C:\Users\DevilTech\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\DevilTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CJVYV18E\addons-v4[1].html moved successfully.
C:\Users\DevilTech\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A59KZWMO\addons-tracker-v4[1].htm moved successfully.
Registry entries deleted on Reboot...
|
|
05.01.2012, 10:51
| #36 |
| | sbcvvhost_win86 Trojaner Hi, Rechtsklick - Desktopsymbole ein/ausblenden... und dann anordnen lassen Oder: Windows 7 Desktop anzeigen Symbol erstellen | Tricks | Windows 7 Tipps Über den Explorer siehst Du sie aber noch..? ->Start - Regedit, zum Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer navigieren und dort den Eintrag (falls vorhanden) NoDesktop löschen... chris
__________________ --> sbcvvhost_win86 Trojaner Geändert von Chris4You (05.01.2012 um 10:57 Uhr) |
|
09.01.2012, 10:08
| #37 |
| | sbcvvhost_win86 Trojaner Alles klar desktop ist soweit wiedernormal. virensolltennun ja auch runter sein. vielen dank für die hilfe =)  Peter |
|
09.01.2012, 21:50
| #38 |
| | sbcvvhost_win86 TrojanerCode:
ATTFilter
Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Montag, 9. Januar 2012 10:11
Es wird nach 3031228 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 x64
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : DevilTech
Computername : DEVILTECH-PC
Versionsinformationen:
BUILD.DAT : 10.2.0.704 Bytes 28.09.2011 13:14:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 28.06.2011 13:06:47
AVSCAN.DLL : 10.0.5.0 57192 Bytes 28.06.2011 13:06:46
LUKE.DLL : 10.3.0.5 45416 Bytes 28.06.2011 13:06:50
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 10:59:47
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 28.06.2011 13:06:52
AVREG.DLL : 10.3.0.9 88833 Bytes 13.07.2011 10:47:44
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 08:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 13:23:11
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 10:34:33
VBASE003.VDF : 7.11.19.171 2048 Bytes 20.12.2011 10:37:30
VBASE004.VDF : 7.11.19.172 2048 Bytes 20.12.2011 10:37:30
VBASE005.VDF : 7.11.19.173 2048 Bytes 20.12.2011 10:37:30
VBASE006.VDF : 7.11.19.174 2048 Bytes 20.12.2011 10:37:30
VBASE007.VDF : 7.11.19.175 2048 Bytes 20.12.2011 10:37:31
VBASE008.VDF : 7.11.19.176 2048 Bytes 20.12.2011 10:37:31
VBASE009.VDF : 7.11.19.177 2048 Bytes 20.12.2011 10:37:31
VBASE010.VDF : 7.11.19.178 2048 Bytes 20.12.2011 10:37:31
VBASE011.VDF : 7.11.19.179 2048 Bytes 20.12.2011 10:37:31
VBASE012.VDF : 7.11.19.180 2048 Bytes 20.12.2011 10:37:31
VBASE013.VDF : 7.11.19.217 182784 Bytes 22.12.2011 10:37:31
VBASE014.VDF : 7.11.19.255 148480 Bytes 24.12.2011 10:55:37
VBASE015.VDF : 7.11.20.29 164352 Bytes 27.12.2011 10:49:03
VBASE016.VDF : 7.11.20.70 180224 Bytes 29.12.2011 18:28:24
VBASE017.VDF : 7.11.20.102 240640 Bytes 02.01.2012 12:30:41
VBASE018.VDF : 7.11.20.139 164864 Bytes 04.01.2012 11:45:21
VBASE019.VDF : 7.11.20.178 167424 Bytes 06.01.2012 11:45:22
VBASE020.VDF : 7.11.20.179 2048 Bytes 06.01.2012 11:45:22
VBASE021.VDF : 7.11.20.180 2048 Bytes 06.01.2012 11:45:22
VBASE022.VDF : 7.11.20.181 2048 Bytes 06.01.2012 11:45:22
VBASE023.VDF : 7.11.20.182 2048 Bytes 06.01.2012 11:45:22
VBASE024.VDF : 7.11.20.183 2048 Bytes 06.01.2012 11:45:22
VBASE025.VDF : 7.11.20.184 2048 Bytes 06.01.2012 11:45:22
VBASE026.VDF : 7.11.20.185 2048 Bytes 06.01.2012 11:45:22
VBASE027.VDF : 7.11.20.186 2048 Bytes 06.01.2012 11:45:22
VBASE028.VDF : 7.11.20.187 2048 Bytes 06.01.2012 11:45:22
VBASE029.VDF : 7.11.20.188 2048 Bytes 06.01.2012 11:45:22
VBASE030.VDF : 7.11.20.189 2048 Bytes 06.01.2012 11:45:22
VBASE031.VDF : 7.11.20.194 3584 Bytes 06.01.2012 12:16:13
Engineversion : 8.2.8.18
AEVDF.DLL : 8.1.2.2 106868 Bytes 27.10.2011 10:19:27
AESCRIPT.DLL : 8.1.3.95 479612 Bytes 29.12.2011 10:50:59
AESCN.DLL : 8.1.7.2 127349 Bytes 10.01.2011 13:22:49
AESBX.DLL : 8.2.4.5 434549 Bytes 03.12.2011 13:00:56
AERDL.DLL : 8.1.9.15 639348 Bytes 09.09.2011 03:15:41
AEPACK.DLL : 8.2.15.1 770423 Bytes 16.12.2011 13:36:46
AEOFFICE.DLL : 8.1.2.25 201084 Bytes 01.01.2012 11:02:24
AEHEUR.DLL : 8.1.3.14 4260216 Bytes 01.01.2012 11:02:24
AEHELP.DLL : 8.1.18.0 254327 Bytes 27.10.2011 10:19:21
AEGEN.DLL : 8.1.5.17 405877 Bytes 09.12.2011 13:20:34
AEEMU.DLL : 8.1.3.0 393589 Bytes 10.01.2011 13:22:42
AECORE.DLL : 8.1.24.3 201079 Bytes 29.12.2011 10:49:35
AEBB.DLL : 8.1.1.0 53618 Bytes 10.01.2011 13:22:41
AVWINLL.DLL : 10.0.0.0 19304 Bytes 10.01.2011 13:22:56
AVPREF.DLL : 10.0.3.2 44904 Bytes 28.06.2011 13:06:46
AVREP.DLL : 10.0.0.10 174120 Bytes 18.05.2011 10:30:35
AVARKT.DLL : 10.0.26.1 255336 Bytes 28.06.2011 13:06:44
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 28.06.2011 13:06:45
SQLITE3.DLL : 3.6.19.0 355688 Bytes 17.06.2010 13:27:02
AVSMTP.DLL : 10.0.0.17 63848 Bytes 10.01.2011 13:22:56
NETNT.DLL : 10.0.0.0 11624 Bytes 17.06.2010 13:27:01
RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 28.06.2011 13:06:41
RCTEXT.DLL : 10.0.64.0 98664 Bytes 28.06.2011 13:06:41
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Optimierter Suchlauf..................: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660,
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,
Beginn des Suchlaufs: Montag, 9. Januar 2012 10:11
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LastFM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchSettings.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesTrayAgent.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesPDLR.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '1' Modul(e) wurden durchsucht
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '159' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Ende des Suchlaufs: Montag, 9. Januar 2012 11:18
Benötigte Zeit: 1:07:06 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
41936 Verzeichnisse wurden überprüft
598520 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
598520 Dateien ohne Befall
3607 Archive wurden durchsucht
0 Warnungen
0 Hinweise
44755 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
|
|
| Themen zu sbcvvhost_win86 Trojaner |
| .html, absolut, arten, block, brauch, datei, daten, eingabeaufforderung, eingefangen, gefangen, gefunde, gen, gestartet, leute, nicht mehr, peter, problem, schnell, sitzt, starten, stick, troja, trojane, trojaner, trojaner eingefangen, wenig, win |
Linear-Darstellung
