| |
| |||||||
Log-Analyse und Auswertung: Mozilla startet sich beim HochfahrenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
01.01.2012, 20:46
| #1 |
| |  Mozilla startet sich beim Hochfahren Hallo, seit wenigen Tagen hab ich das Phänomen, dass sich Mozilla automatisch startet, wenn ich den Rechner hochfahre. Mein Standardbrowser ist Chrome. Ich hab daraufhin Spybot Search and Destroy installiert und nach einem Scan fand er auch einige unschöne Cookies, die ich alle entfernt hab. Der Virenscanner MSE fand überhaupt nichts. Ich hab schon nach dem Mozilla-problem gegoogelt, aber konnte nicht genau mein Problem, bzw. Problemlösung finden. Und jetzt liegt auch der Gedanke nahe, dass da noch viel blödere Sachen dahinter stecken könnten.. Es wäre super nett, wenn irgendwer mal über meine OTL File drüber schauen könnte. VIelen Dank. OTL logfile created on: 01.01.2012 20:02:10 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Rebi\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,87 Gb Total Physical Memory | 1,90 Gb Available Physical Memory | 49,26% Memory free 7,73 Gb Paging File | 5,50 Gb Available in Paging File | 71,18% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 146,62 Gb Total Space | 104,52 Gb Free Space | 71,28% Space Free | Partition Type: NTFS Drive D: | 151,37 Gb Total Space | 48,81 Gb Free Space | 32,24% Space Free | Partition Type: NTFS Computer Name: REBI-PC | User Name: Rebi | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.01.01 20:01:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe PRC - [2012.01.01 19:31:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe PRC - [2009.11.12 13:41:00 | 000,704,568 | ---- | M] (Conexant Systems, Inc) -- C:\Programme\CONEXANT\SAII\SmartAudio.exe PRC - [2009.01.26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2007.09.11 15:50:28 | 000,804,144 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\StCenter.exe PRC - [2007.09.07 11:06:46 | 001,070,384 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe PRC - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE PRC - [2007.03.09 19:00:18 | 001,167,360 | ---- | M] (Lenovo (Beijing) Limited) -- C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe ========== Modules (No Company Name) ========== MOD - [2011.12.31 15:07:22 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\dd759df05fad8dc6d3404e8e02b40819\Microsoft.VisualBasic.ni.dll MOD - [2011.12.31 14:59:50 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b559a471eef00081f0b5c2719d1d9623\System.Runtime.Remoting.ni.dll MOD - [2011.12.07 12:16:28 | 000,411,192 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll MOD - [2011.12.07 12:16:27 | 003,767,864 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll MOD - [2011.12.07 12:14:56 | 000,122,952 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avutil-51.dll MOD - [2011.12.07 12:14:55 | 000,222,280 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avformat-53.dll MOD - [2011.12.07 12:14:53 | 001,746,504 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avcodec-53.dll MOD - [2011.12.07 08:22:33 | 008,593,056 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll MOD - [2011.12.07 08:22:33 | 008,593,056 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\APPLIC~1\160912~1.63\gcswf32.dll MOD - [2011.10.28 16:37:46 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\273292e88c7b60ecbae9d85e94cd097e\WindowsFormsIntegration.ni.dll MOD - [2011.10.28 16:35:42 | 000,220,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\2c2215e99c21daeec6bf697cf7bcf103\CustomMarshalers.ni.dll MOD - [2011.10.28 16:21:09 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll MOD - [2011.10.28 16:20:43 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll MOD - [2011.10.28 16:20:30 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll MOD - [2011.10.28 16:20:24 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll MOD - [2011.10.28 16:20:21 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll MOD - [2011.10.28 16:20:12 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll MOD - [2011.10.28 16:20:07 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll MOD - [2011.10.28 16:20:04 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll MOD - [2011.10.28 16:20:03 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll MOD - [2011.10.28 16:19:58 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.11.05 02:57:39 | 000,069,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll MOD - [2009.07.14 18:58:15 | 000,167,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll MOD - [2005.06.24 19:05:02 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.04.27 16:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV:64bit: - [2011.04.27 16:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.12.24 12:01:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) SRV - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.06.10 05:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.04.27 14:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.02.02 14:52:02 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2009.12.17 23:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2009.12.17 21:59:28 | 000,086,120 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2009.11.24 13:21:26 | 000,708,608 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009.10.19 00:40:50 | 000,028,176 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC) DRV:64bit: - [2009.09.17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009.08.09 22:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 54 02 12 CC 93 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.18 18:49:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.18 18:50:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rebi\AppData\Roaming\mozilla\Extensions [2011.12.18 18:49:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.12.30 18:41:37 | 000,003,747 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll CHR - plugin: Google Update (Enabled) = C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\ CHR - Extension: Auf den Amazon-Wunschzettel = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.7_0\ CHR - Extension: Google-Suche = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\ CHR - Extension: Google Mail = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\ O1 HOSTS File: ([2011.12.30 18:48:30 | 000,440,010 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 15127 more lines... O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.) O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited) O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [EnergyCut] C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe (Lenovo (Beijing) Limited) O4 - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe (Lenovo(beijing) Limited) O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found O4 - HKCU..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - Startup: C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk = C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin) O4 - Startup: C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe (AVM Berlin) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93C37204-3657-4DC9-9420-9CF2BD68817D}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell - "" = AutoRun O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\AutoRun\command - "" = H:\SETUP.EXE O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\configure\command - "" = H:\SETUP.EXE O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\install\command - "" = H:\SETUP.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.01.01 20:01:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe [2012.01.01 19:31:17 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe [2011.12.30 18:42:54 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\AVG2012 [2011.12.30 18:41:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2011.12.30 18:40:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2011.12.30 18:39:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.12.30 18:39:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2011.12.30 18:39:48 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012 [2011.12.30 18:34:16 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2011.12.25 18:38:27 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\2011_12_24 - [2011.12.25 03:44:13 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Local\FRITZ! [2011.12.24 12:33:44 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2011.12.24 12:05:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool [2011.12.24 12:01:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared [2011.12.24 11:14:34 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CdCoverCreator [2011.12.24 11:14:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CdCoverCreator [2011.12.24 11:14:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CdCoverCreator [2011.12.23 18:12:55 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Canneverbe Limited [2011.12.23 18:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2011.12.23 18:12:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP [2011.12.18 18:49:57 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Mozilla [2011.12.18 18:49:57 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Local\Mozilla [2011.12.18 18:49:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2011.12.14 13:47:23 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.12.14 13:47:23 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.12.14 13:47:21 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011.12.14 13:47:20 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011.12.14 13:47:19 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.12.14 13:47:19 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.12.14 13:47:16 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2011.12.14 13:47:16 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2011.12.14 13:47:16 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2011.12.14 13:47:15 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2011.12.14 13:47:14 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2011.12.14 04:23:54 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011.12.14 04:23:50 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011.12.14 04:23:50 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011.12.13 21:59:41 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\2011_12_09 [2011.12.13 15:32:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2011.12.13 15:32:20 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2011.12.04 20:17:09 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\FRITZ! [2011.12.03 18:45:16 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\HammerHead [2011.12.03 14:47:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!DSL [2011.12.03 14:47:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVM [2011.12.03 14:46:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2011.12.03 14:46:25 | 000,069,120 | R--- | C] (AVM Berlin) -- C:\Windows\SysWow64\avmadd32.dll [2011.12.03 14:46:25 | 000,016,384 | R--- | C] (AVM Berlin GmbH) -- C:\Windows\SysWow64\avmprmon.dll [2011.12.03 14:46:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box [2011.12.03 14:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!BoxPrint [2011.12.03 14:46:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!Box ========== Files - Modified Within 30 Days ========== [2012.01.01 20:10:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000UA.job [2012.01.01 20:01:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe [2012.01.01 19:31:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe [2012.01.01 19:29:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.01.01 15:45:45 | 000,016,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.01.01 15:45:45 | 000,016,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.01.01 15:37:54 | 3113,365,504 | -HS- | M] () -- C:\hiberfil.sys [2011.12.31 19:29:39 | 001,505,034 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.31 19:29:39 | 000,656,266 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.12.31 19:29:39 | 000,618,108 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.12.31 19:29:39 | 000,131,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.12.31 19:29:39 | 000,107,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.12.30 18:48:30 | 000,440,010 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2011.12.30 18:40:37 | 000,001,258 | ---- | M] () -- C:\Users\Rebi\Desktop\Spybot - Search & Destroy.lnk [2011.12.28 11:39:40 | 734,212,096 | ---- | M] () -- C:\Users\Rebi\Desktop\1989 [2011.12.28 10:40:17 | 000,345,821 | ---- | M] () -- C:\Users\Rebi\Desktop\23648.pdf [2011.12.28 10:35:34 | 000,921,834 | ---- | M] () -- C:\Users\Rebi\Desktop\oas.pdf [2011.12.28 09:05:22 | 732,125,184 | ---- | M] () -- C:\Users\Rebi\Desktop\1988 [2011.12.26 20:46:23 | 786,393,088 | ---- | M] () -- C:\Users\Rebi\Desktop\2010 [2011.12.25 03:42:26 | 002,272,080 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.24 13:10:02 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000Core.job [2011.12.24 12:44:42 | 000,357,216 | ---- | M] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101 Kopie.jpg [2011.12.24 12:38:06 | 000,001,052 | ---- | M] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk [2011.12.24 11:57:22 | 000,257,212 | ---- | M] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101.jpeg [2011.12.24 11:34:49 | 000,124,825 | ---- | M] () -- C:\Users\Rebi\Desktop\swing.ccc [2011.12.24 11:30:02 | 000,070,969 | ---- | M] () -- C:\Users\Rebi\Desktop\artworks-000003049932-g3u3dv-crop.jpg [2011.12.24 11:29:39 | 000,106,412 | ---- | M] () -- C:\Users\Rebi\Desktop\al_jawala___the_ride.jpg [2011.12.24 11:29:15 | 000,016,914 | ---- | M] () -- C:\Users\Rebi\Desktop\111118_elektro_swing_ada-215x301.jpg [2011.12.23 22:46:05 | 000,002,273 | ---- | M] () -- C:\Users\Rebi\Desktop\zzz.m3u [2011.12.23 19:18:49 | 000,003,308 | ---- | M] () -- C:\Users\Rebi\Desktop\1.axp [2011.12.22 19:41:44 | 874,333,946 | ---- | M] () -- C:\Users\Rebi\Desktop\Dance Cardio Workout.zip [2011.12.19 10:57:05 | 000,002,598 | ---- | M] () -- C:\Users\Rebi\Documents\ZertiSchlüss.pfx [2011.12.19 10:52:36 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2011.12.16 18:57:04 | 006,091,287 | ---- | M] () -- C:\Users\Rebi\Desktop\Ben Folds Five and Selections From Naked Baby Photos (Songbook).pdf [2011.12.06 15:57:04 | 721,327,605 | ---- | M] () -- C:\Users\Rebi\Desktop\01 Complete Body Workout.m4v [2011.12.04 20:17:45 | 000,001,234 | ---- | M] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk [2011.12.03 18:45:17 | 000,000,043 | ---- | M] () -- C:\END [2011.12.03 14:47:07 | 000,002,471 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk ========== Files Created - No Company Name ========== [2011.12.30 18:40:37 | 000,001,258 | ---- | C] () -- C:\Users\Rebi\Desktop\Spybot - Search & Destroy.lnk [2011.12.28 11:31:20 | 734,212,096 | ---- | C] () -- C:\Users\Rebi\Desktop\1989 [2011.12.28 10:40:20 | 000,345,821 | ---- | C] () -- C:\Users\Rebi\Desktop\23648.pdf [2011.12.28 10:35:39 | 000,921,834 | ---- | C] () -- C:\Users\Rebi\Desktop\oas.pdf [2011.12.28 08:40:39 | 732,125,184 | ---- | C] () -- C:\Users\Rebi\Desktop\1988 [2011.12.26 20:20:07 | 786,393,088 | ---- | C] () -- C:\Users\Rebi\Desktop\2010 [2011.12.24 12:44:36 | 000,357,216 | ---- | C] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101 Kopie.jpg [2011.12.24 12:38:06 | 000,001,052 | ---- | C] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk [2011.12.24 12:14:19 | 000,001,137 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS3.lnk [2011.12.24 12:10:50 | 000,001,223 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Stock Photos CS3.lnk [2011.12.24 12:08:37 | 000,001,403 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit 2.lnk [2011.12.24 12:08:12 | 000,001,192 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS3.lnk [2011.12.24 12:04:04 | 000,001,099 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS3.lnk [2011.12.24 11:57:28 | 000,257,212 | ---- | C] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101.jpeg [2011.12.24 11:34:49 | 000,124,825 | ---- | C] () -- C:\Users\Rebi\Desktop\swing.ccc [2011.12.24 11:30:04 | 000,070,969 | ---- | C] () -- C:\Users\Rebi\Desktop\artworks-000003049932-g3u3dv-crop.jpg [2011.12.24 11:29:42 | 000,106,412 | ---- | C] () -- C:\Users\Rebi\Desktop\al_jawala___the_ride.jpg [2011.12.24 11:29:18 | 000,016,914 | ---- | C] () -- C:\Users\Rebi\Desktop\111118_elektro_swing_ada-215x301.jpg [2011.12.23 22:17:23 | 000,002,273 | ---- | C] () -- C:\Users\Rebi\Desktop\zzz.m3u [2011.12.23 19:18:49 | 000,003,308 | ---- | C] () -- C:\Users\Rebi\Desktop\1.axp [2011.12.23 18:12:47 | 000,001,899 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2011.12.22 19:23:43 | 874,333,946 | ---- | C] () -- C:\Users\Rebi\Desktop\Dance Cardio Workout.zip [2011.12.19 10:57:02 | 000,002,598 | ---- | C] () -- C:\Users\Rebi\Documents\ZertiSchlüss.pfx [2011.12.18 18:49:52 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.12.16 18:56:19 | 006,091,287 | ---- | C] () -- C:\Users\Rebi\Desktop\Ben Folds Five and Selections From Naked Baby Photos (Songbook).pdf [2011.12.06 15:42:52 | 721,327,605 | ---- | C] () -- C:\Users\Rebi\Desktop\01 Complete Body Workout.m4v [2011.12.04 20:17:45 | 000,001,234 | ---- | C] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk [2011.12.03 18:45:17 | 000,000,043 | ---- | C] () -- C:\END [2011.12.03 14:47:07 | 000,002,471 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk [2011.11.05 20:03:25 | 000,003,584 | ---- | C] () -- C:\Users\Rebi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.11.03 11:07:28 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.10.26 11:49:59 | 001,500,444 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat < End of report > |
|
02.01.2012, 16:04
| #2 |
| /// Malware-holic   | Mozilla startet sich beim Hochfahren hi,
__________________1. spybot deinstalieren, nicht mehr sonderlich zeitgemäß, kann außerdem reinigung stören, pc neustarten. 2. Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ |
|
02.01.2012, 16:13
| #3 |
| | Mozilla startet sich beim Hochfahren Vielen Dank für deine Antwort. Soll ich meine Backups von Spybot wiederherstellen bevor ich es deinstalliere?
__________________ |
|
02.01.2012, 17:13
| #4 |
| | Mozilla startet sich beim Hochfahren So. Spybot ist deinstalliert. Scan wurde ausgeführt. Kurzer Hinweis: Chrome war doch nicht der Standardbrowser, nachdem ich das umgestellt hab, hat sich Firefox auch nicht wieder automatisch geöffnet. Ich finds trotzdem komisch. Hier mein Log: Combofix Logfile: Code:
ATTFilter ComboFix 12-01-02.01 - Rebi 02.01.2012 16:47:27.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3959.2607 [GMT 1:00]
ausgeführt von:: c:\users\Rebi\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{95591882-0B23-445D-B709-2D115214A714}.xps
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Leo.gadget
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\wetter.info.gadget
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-12-02 bis 2012-01-02 ))))))))))))))))))))))))))))))
.
.
2012-01-02 15:56 . 2012-01-02 15:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-02 15:37 . 2012-01-02 15:37 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{90D52915-24F6-4A2D-B4E5-205EAF3A3DE3}\offreg.dll
2012-01-01 14:39 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{90D52915-24F6-4A2D-B4E5-205EAF3A3DE3}\mpengine.dll
2011-12-30 17:42 . 2011-12-30 17:42 -------- d-----w- c:\users\Rebi\AppData\Roaming\AVG2012
2011-12-30 17:41 . 2011-12-30 17:41 -------- d--h--w- c:\programdata\Common Files
2011-12-30 17:39 . 2012-01-02 15:36 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-12-30 17:39 . 2012-01-02 15:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-12-30 17:39 . 2011-12-30 21:18 -------- d-----w- c:\programdata\AVG2012
2011-12-30 17:34 . 2011-12-30 21:15 -------- d-----w- c:\programdata\MFAData
2011-12-25 02:44 . 2011-12-25 02:44 -------- d-----w- c:\users\Rebi\AppData\Local\FRITZ!
2011-12-24 11:33 . 2011-12-24 11:33 -------- d-----w- c:\programdata\FLEXnet
2011-12-24 11:05 . 2011-12-24 11:05 -------- d-----w- c:\windows\SysWow64\spool
2011-12-24 11:01 . 2011-12-24 11:01 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
2011-12-24 10:14 . 2011-12-24 10:14 -------- d-----w- c:\program files (x86)\CdCoverCreator
2011-12-23 17:12 . 2011-12-23 17:12 -------- d-----w- c:\users\Rebi\AppData\Roaming\Canneverbe Limited
2011-12-23 17:12 . 2011-12-23 17:12 -------- d-----w- c:\programdata\Canneverbe Limited
2011-12-23 17:12 . 2011-12-23 17:12 -------- d-----w- c:\program files (x86)\CDBurnerXP
2011-12-18 17:49 . 2011-12-18 17:49 -------- d-----w- c:\users\Rebi\AppData\Local\Mozilla
2011-12-17 18:33 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-12-14 03:23 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 03:23 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 03:23 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 03:23 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-14 03:23 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 03:23 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-13 14:32 . 2011-12-13 14:32 -------- d-----w- c:\program files\7-Zip
2011-12-04 19:17 . 2012-01-02 15:45 -------- d-----w- c:\users\Rebi\AppData\Roaming\FRITZ!
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-19 09:52 . 2011-11-24 09:17 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-28 15:07 . 2011-10-28 15:07 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-10-28 15:07 . 2011-10-28 15:07 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-10-28 15:07 . 2011-10-28 15:07 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-10-28 15:07 . 2011-10-28 15:07 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-10-28 15:07 . 2011-10-28 15:07 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-10-28 15:07 . 2011-10-28 15:07 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-10-28 15:07 . 2011-10-28 15:07 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-10-28 15:07 . 2011-10-28 15:07 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-10-28 15:07 . 2011-10-28 15:07 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-10-28 15:07 . 2011-10-28 15:07 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-10-28 15:07 . 2011-10-28 15:07 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-10-28 15:07 . 2011-10-28 15:07 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-10-28 15:07 . 2011-10-28 15:07 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-10-28 15:07 . 2011-10-28 15:07 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-10-28 15:07 . 2011-10-28 15:07 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-10-28 15:07 . 2011-10-28 15:07 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-10-28 15:07 . 2011-10-28 15:07 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-10-28 15:07 . 2011-10-28 15:07 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-10-28 15:07 . 2011-10-28 15:07 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-10-28 15:07 . 2011-10-28 15:07 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-10-28 15:07 . 2011-10-28 15:07 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-10-28 15:07 . 2011-10-28 15:07 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-10-28 15:07 . 2011-10-28 15:07 222208 ----a-w- c:\windows\system32\msls31.dll
2011-10-28 15:07 . 2011-10-28 15:07 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-10-28 15:07 . 2011-10-28 15:07 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-10-28 15:07 . 2011-10-28 15:07 12288 ----a-w- c:\windows\system32\mshta.exe
2011-10-28 15:07 . 2011-10-28 15:07 114176 ----a-w- c:\windows\system32\admparse.dll
2011-10-28 15:07 . 2011-10-28 15:07 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-10-28 15:07 . 2011-10-28 15:07 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-10-28 15:07 . 2011-10-28 15:07 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-10-28 15:07 . 2011-10-28 15:07 448512 ----a-w- c:\windows\system32\html.iec
2011-10-28 15:07 . 2011-10-28 15:07 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-10-28 15:07 . 2011-10-28 15:07 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-10-28 15:07 . 2011-10-28 15:07 160256 ----a-w- c:\windows\system32\wextract.exe
2011-10-28 14:08 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-10-28 14:08 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-10-26 10:56 . 2011-10-26 10:56 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0486ACFD-5C61-41D8-8A71-FB2BA445D664}\gapaengine.dll
2011-10-18 00:27 . 2011-10-26 10:54 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ECCC5D85-334E-4494-AAB3-2AB2D4095596}\mpengine.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-13 307768]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-12 421736]
"EnergyUtility"="c:\program files (x86)\Lenovo\EnergyCut\utilty.exe" [2007-04-27 1581056]
"EnergyCut"="c:\program files (x86)\Lenovo\EnergyCut\EnergyCut.exe" [2007-03-09 1167360]
.
c:\users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files (x86)\FRITZ!DSL\FritzDsl.exe [2007-9-3 992560]
FRITZ!DSL Protect.lnk - c:\program files (x86)\FRITZ!DSL\FwebProt.exe [2007-9-7 1070384]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe [2011-12-3 29184]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files (x86)\FRITZ!DSL\IGDCTRL.EXE [2007-09-04 87344]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000Core.job
- c:\users\Rebi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-26 11:05]
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000UA.job
- c:\users\Rebi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-26 11:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-03 16414824]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-13 307768]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-11-16 508472]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2009-12-17 4367808]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6988736]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Rebi\AppData\Roaming\Mozilla\Firefox\Profiles\klgp19po.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-02 17:10:02
ComboFix-quarantined-files.txt 2012-01-02 16:09
.
Vor Suchlauf: 9 Verzeichnis(se), 116.153.851.904 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 115.788.238.848 Bytes frei
.
- - End Of File - - 513D8CAE19BD1F57AAB0923420C02190
|
|
02.01.2012, 18:53
| #5 |
| /// Malware-holic | Mozilla startet sich beim Hochfahren kann es sein das das problem nach der instalation von wetter.info.gadget auftrat? nutze das nicht selbst, wäre aber evtl. die lösung
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
02.01.2012, 21:13
| #6 |
| | Mozilla startet sich beim Hochfahren Das könnte sein. Lange habe ich das noch nicht drauf. Ich habe es jetzt mal deinstalliert. Sieht es ansonsten sauber aus auf meinem PC? |
|
03.01.2012, 13:02
| #7 |
| /// Malware-holic | Mozilla startet sich beim Hochfahren wir gucken mal weiter. malwarebytes: Downloade Dir bitte Malwarebytes
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.01.2012, 17:41
| #8 |
| | Mozilla startet sich beim Hochfahren Sorry, hat ein bisschen gedauert. Hier der Log. Malwarebytes Anti-Malware (Test) 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.06.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Rebi :: REBI-PC [Administrator] Schutz: Aktiviert 06.01.2012 16:53:09 mbam-log-2012-01-06 (16-53-09).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 294623 Laufzeit: 41 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
06.01.2012, 17:42
| #9 |
| /// Malware-holic | Mozilla startet sich beim Hochfahren sieht io aus lade den CCleaner standard: CCleaner Download - CCleaner 3.14.1616 falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.01.2012, 17:52
| #10 |
| | Mozilla startet sich beim Hochfahren 7-Zip 9.20 (x64 edition) Igor Pavlov 12.12.2011 4,53MB 9.20.00.0 notwendig Adobe Flash Player 11 ActiveX 64-bit Adobe Systems Incorporated 23.11.2011 6,00MB 11.1.102.55 notwendig Adobe Flash Player 11 Plugin Adobe Systems Incorporated 18.12.2011 6,00MB 11.1.102.55 notwendig Adobe Photoshop CS3 Adobe Systems Incorporated 23.12.2011 1.085MB 10.0 unnötig (Testversion) Adobe Reader X (10.1.1) - Deutsch Adobe Systems Incorporated 29.10.2011 119,2MB 10.1.1 notwendig Apple Application Support Apple Inc. 02.11.2011 61,2MB 2.1.5 unbekannt Apple Mobile Device Support Apple Inc. 21.11.2011 24,9MB 4.0.0.97 unbekannt Apple Software Update Apple Inc. 02.11.2011 2,38MB 2.1.3.127 notwendig AVM FRITZ!Box Dokumentation AVM Berlin 02.12.2011 unbekannt AVM FRITZ!Box Druckeranschluss AVM Berlin 02.12.2011 unbekannt AVM FRITZ!DSL AVM Berlin 02.12.2011 14,1MB 2.04.02 notwendig Bonjour Apple Inc. 02.11.2011 2,00MB 3.0.0.10 unbekannt Broadcom 802.11 Wireless Driver 25.10.2011 1.0.0.0 notwendig CCleaner Piriform 05.01.2012 3.14 notwendig CDBurnerXP CDBurnerXP 22.12.2011 12,8MB 4.4.0.2838 notwendig CdCoverCreator 2.5.3 thyanté Software 23.12.2011 2.5.3 unnötig Conexant HD Audio Conexant 25.10.2011 4.107.0.60 unbekannt Energy Management Lenovo 29.10.2011 5.4.0.8 notwendig EnergyCut Lenovo 25.11.2011 1.00 notwendig Google Chrome Google Inc. 25.10.2011 16.0.912.63 notwendig IrfanView (remove only) Irfan Skiljan 04.11.2011 1,50MB 4.30 notwendig iTunes Apple Inc. 21.11.2011 170,5MB 10.5.1.42 notwendig Malwarebytes Anti-Malware Version 1.60.0.1800 Malwarebytes Corporation 05.01.2012 18,6MB 1.60.0.1800 notwendig McAfee Security Scan Plus McAfee, Inc. 01.11.2011 8,30MB 2.0.181.2 unnötig Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.10.2011 38,8MB 4.0.30319 unbekannt Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 25.10.2011 2,94MB 4.0.30319 unbekannt Microsoft Office Professional Plus 2010 Microsoft Corporation 15.11.2011 14.0.6029.1000 notwendig Microsoft Security Essentials Microsoft Corporation 25.10.2011 2.1.1116.0 notwendig Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 03.12.2011 0,29MB 8.0.61001 unekannt Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 29.12.2011 0,57MB 9.0.30729.4148 unbekannt Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 30.12.2011 0,59MB 9.0.30729.6161 unbkeannt Mozilla Firefox 8.0.1 (x86 de) Mozilla 17.12.2011 34,9MB 8.0.1 notwendig NVIDIA Drivers NVIDIA Corporation 25.10.2011 65,1MB 1.10.57.35 notwendig Realtek Ethernet Controller Driver For Windows Vista and Later Realtek 25.10.2011 1.00.0009 notwendig VirtualCloneDrive Elaborate Bytes 29.10.2011 notwendig Visual Studio 2008 x64 Redistributables AVG Technologies 29.12.2011 42,00KB 10.0.0.2 unbekannt VLC media player 1.1.11 VideoLAN 02.11.2011 1.1.11 notwenidg Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) Lenovo 29.10.2011 10/19/2009 5.4.0.1 notwendig |
|
06.01.2012, 19:51
| #11 |
| /// Malware-holic | Mozilla startet sich beim Hochfahren deinstaliere: Adobe Flash Player alle Adobe - Andere Version des Adobe Flash Player installieren neueste version laden adobe reader: Adobe - Adobe Reader herunterladen - Alle Versionen haken bei mcafee security scan raus nehmen bitte auch mal den adobe reader wie folgt konfigurieren: adobe reader öffnen, bearbeiten, voreinstellungen. allgemein: nur zertifizierte zusatz module verwenden, anhaken. internet: hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc. es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht. bei javascript den haken bei java script verwenden raus nehmen bei updater, automatisch instalieren wählen. übernehmen /ok deinstaliere: Adobe Photoshop CdCoverCreator öffne otl. klicke bereinigen, pc startet neu, removal tools werden gelöscht. öffne ccleaner, analysieren, bereinigen. pc neustarten, berichte obs noch probleme gibt.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
19.01.2012, 18:21
| #12 |
| | Mozilla startet sich beim Hochfahren Huch, Seite 2 jetzt erst entdeckt. Mach ich.. Feedback kommt. |
|
| Themen zu Mozilla startet sich beim Hochfahren |
| adobe, automatisch, autorun, bho, bonjour, chdrt64.sys, document, dsl, error, excel.exe, explorer, firefox, format, google, helper, hijack, hijackthis, hochfahren, installation, intranet, langs, lenovo, logfile, microsoft security, mozilla, nvidia, photoshop, plug-in, realtek, registry, safer networking, scan, security, security scan, senden, software, startet, super, version=1.0, webcheck, windows |
Linear-Darstellung
