| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: "BKA EXPLOIT" EXP/CVE-2011-3544.AM' Desktop nicht mehr zugänglich.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.01.2012, 23:23
| #1 |
| |  "BKA EXPLOIT" EXP/CVE-2011-3544.AM' Desktop nicht mehr zugänglich. Hallo, anscheinend habe auch ich mir diesen "BKA Virus" eingefangen. Beim Start des Systems wird mein Antivir Virescanner scheinbar deaktiviert, in der Tray ist das Symbol nicht mehr zu sehen. Sobald der Rechner fertig geladen hat, erscheint der IE mit einer Zahlungsaufforderung von 100 EUR, also das anscheinend übliche Schema. Strg Alt Entf funktioniert zwar, leider ist der Button für den Taskmanager aber gesperrt. Zum Schluß funktioniert das System dann überhaupt nicht mehr, statt des Desktops sieht man lediglich die gleiche Seite mit der Zahlungsaufforderung. Unter diesem Account kann ich daher keine Tools mehr laufen lassen. Vielleicht hat jemand von euch eine Idee, wie ich zumindest wieder mit dem Rechner (zur Not gerne offline) arbeiten kann um Daten zu sichern. Über einen 2. Benutzeraccount konnte ich mit Antivir Scans durchführen, gefunden wurde folgendes: Antivir LOG Die Datei 'C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\53\2578cd35-19ff19e1' enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2011-3544.AM' [exploit]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f3b9a67.qua' verschoben! Defogger >Disable keine Fehlermeldung OTL mit folgenden Daten laufen lassen: activex netsvcs msconfig %SYSTEMDRIVE%\*. %PROGRAMFILES%\*.exe %LOCALAPPDATA%\*.exe %systemroot%\*. /mp /s %systemroot%\system32\*.manifest /3 /md5start explorer.exe regedit.exe winlogon.exe wininit.exe userinit.exe ipsec.sys afd.sys /md5stop HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs CREATERESTOREPOINT Vielleicht ist der Rechner ja noch soweit zu retten, damit man noch einige Daten sichern kann. Hier ist meine angefertigte OTL Logdatei: HTML-Code: OTL logfile created on: 04.01.2012 22:23:41 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\maxmustermann\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 75,59% Memory free 2,60 Gb Paging File | 2,14 Gb Available in Paging File | 82,14% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37,26 Gb Total Space | 19,19 Gb Free Space | 51,51% Space Free | Partition Type: NTFS Computer Name: **** | User Name: maxmustermann | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011.10.16 14:22:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\maxmustermann\Desktop\OTL.exe PRC - [2011.03.21 22:10:00 | 001,230,704 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2011.02.18 07:18:50 | 000,245,760 | ---- | M] () -- C:\Programme\Synology\Assistant\UsbClientService.exe PRC - [2011.01.13 11:01:30 | 001,838,904 | ---- | M] (Orbitdownloader.com) -- C:\Programme\Orbitdownloader\orbitdm.exe PRC - [2011.01.11 13:26:32 | 000,557,056 | ---- | M] (Orbitdownloader.com) -- C:\Programme\Orbitdownloader\orbitnet.exe PRC - [2010.10.29 14:49:28 | 000,249,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2010.06.01 16:28:20 | 000,499,796 | ---- | M] (Atheros) -- C:\WINDOWS\system32\acs.exe PRC - [2010.06.01 16:28:06 | 000,561,263 | ---- | M] () -- C:\Programme\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe PRC - [2010.02.23 14:26:25 | 000,050,477 | ---- | M] () -- C:\downloads\Defogger(1).exe PRC - [2009.09.03 06:44:12 | 000,495,693 | ---- | M] (Simon Brown, HB9DRV) -- C:\Programme\Amateur Radio\Ham Radio Deluxe\HRDSerialPortSvr.exe PRC - [2009.09.03 06:31:56 | 000,196,608 | ---- | M] (Simon Brown, HB9DRV) -- C:\Programme\Amateur Radio\Ham Radio Deluxe\HRDRemoteSvr.exe PRC - [2009.07.15 15:51:36 | 000,942,080 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Programme\AWUS036H Wireless LAN Utility\RtWLan.exe PRC - [2008.10.15 13:31:50 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe PRC - [2008.10.15 13:29:58 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe PRC - [2008.06.12 13:28:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe PRC - [2007.11.26 15:10:08 | 000,020,992 | ---- | M] (E-MU Systems) -- C:\WINDOWS\system32\emaudsv.exe PRC - [2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004.08.04 00:58:22 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows NT\Zubehör\wordpad.exe PRC - [2004.02.24 16:35:06 | 002,372,760 | ---- | M] (Sygate Technologies, Inc.) -- C:\Programme\Sygate\SPF\Smc.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2011.03.21 22:10:36 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.03.21 22:10:00 | 001,230,704 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe MOD - [2011.02.18 07:18:50 | 000,245,760 | ---- | M] () -- C:\Programme\Synology\Assistant\UsbClientService.exe MOD - [2011.01.13 10:59:54 | 000,397,312 | ---- | M] () -- C:\Programme\Orbitdownloader\wtlctrl.dll MOD - [2010.06.01 16:28:14 | 000,278,528 | ---- | M] () -- C:\Programme\TP-LINK\TP-LINK Wireless Client Utility\twculoc.dll MOD - [2010.06.01 16:28:14 | 000,163,840 | ---- | M] () -- C:\Programme\TP-LINK\TP-LINK Wireless Client Utility\oemresloc.dll MOD - [2010.06.01 16:28:10 | 000,077,824 | ---- | M] () -- C:\WINDOWS\system32\wgapiloc.dll MOD - [2010.06.01 16:28:06 | 000,561,263 | ---- | M] () -- C:\Programme\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe MOD - [2010.06.01 16:28:06 | 000,422,000 | ---- | M] () -- C:\WINDOWS\system32\wgapi.dll MOD - [2010.02.23 14:26:25 | 000,050,477 | ---- | M] () -- C:\downloads\Defogger(1).exe MOD - [2009.04.03 16:32:10 | 000,110,592 | ---- | M] () -- C:\Programme\AWUS036H Wireless LAN Utility\EnumDevLib.dll MOD - [2008.01.22 18:28:02 | 000,339,968 | ---- | M] () -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sqlite3.dll MOD - [2007.07.12 11:11:54 | 001,163,264 | ---- | M] () -- C:\Programme\AWUS036H Wireless LAN Utility\acAuth.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2011.02.18 07:18:50 | 000,245,760 | ---- | M] () [Auto | Running] -- C:\Programme\Synology\Assistant\UsbClientService.exe -- (UsbClientService) SRV - [2010.06.01 16:28:20 | 000,499,796 | ---- | M] (Atheros) [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS) SRV - [2009.09.03 06:44:12 | 000,495,693 | ---- | M] (Simon Brown, HB9DRV) [Auto | Running] -- C:\Programme\Amateur Radio\Ham Radio Deluxe\HRDSerialPortSvr.exe -- (HRD SerialPortSvr) SRV - [2009.09.03 06:31:56 | 000,196,608 | ---- | M] (Simon Brown, HB9DRV) [Auto | Running] -- C:\Programme\Amateur Radio\Ham Radio Deluxe\HRDRemoteSvr.exe -- (HRD RemoteSvr) SRV - [2008.10.15 13:31:50 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler) SRV - [2008.10.15 13:29:58 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService) SRV - [2007.11.26 15:10:08 | 000,020,992 | ---- | M] (E-MU Systems) [Auto | Running] -- C:\WINDOWS\system32\emaudsv.exe -- (emaudsv) SRV - [2004.02.24 16:35:06 | 002,372,760 | ---- | M] (Sygate Technologies, Inc.) [Auto | Running] -- C:\Programme\Sygate\SPF\Smc.exe -- (SmcService) SRV - [2003.08.01 18:28:24 | 000,474,624 | ---- | M] (Constantin Kaplinsky) [Auto | Stopped] -- C:\Programme\TightVNC\WinVNC.exe -- (winvnc) SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2012.01.04 21:35:55 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2011.10.07 16:21:06 | 000,066,048 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl) DRV - [2011.08.28 17:32:46 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2011.02.18 07:20:08 | 000,046,304 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\busenum.sys -- (busenum) DRV - [2010.12.02 07:53:44 | 000,035,008 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0) DRV - [2010.11.02 21:51:49 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\truecrypt.sys -- (truecrypt) DRV - [2010.11.02 21:30:47 | 000,045,400 | ---- | M] (Avira GmbH) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgntdd.sys -- (avgntdd) DRV - [2010.11.02 21:30:47 | 000,022,360 | ---- | M] (Avira GmbH) [File_System | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys -- (avgntmgr) DRV - [2010.11.02 21:30:46 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2010.06.01 16:28:20 | 000,058,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD) DRV - [2010.06.01 16:28:08 | 000,598,528 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\arusb.sys -- (arusb(TP-LINK)) Wireless Network Adapter Service(TP-LINK) DRV - [2010.03.18 11:06:20 | 000,121,224 | ---- | M] (ABILIS Systems) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AbilisBdaTuner.sys -- (AbilisT) DRV - [2009.10.08 13:41:46 | 000,063,488 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabser.sys -- (silabser) DRV - [2009.10.08 13:41:46 | 000,017,920 | ---- | M] (Silicon Laboratories, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\silabenm.sys -- (silabenm) DRV - [2009.06.26 08:21:34 | 000,323,328 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8187.sys -- (RTLWUSB) DRV - [2009.06.10 14:33:19 | 000,072,520 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K) DRV - [2009.06.10 14:33:19 | 000,057,672 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS) DRV - [2007.11.26 14:14:54 | 000,163,352 | ---- | M] (E-MU Systems) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emusba10.sys -- (emusba10) DRV - [2007.11.08 18:03:26 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2005.03.30 11:12:38 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TVicPort.sys -- (TVicPort) DRV - [2004.08.03 23:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE) DRV - [2004.02.02 10:53:28 | 000,018,518 | ---- | M] (Sygate Technologies, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\wpsdrvnt.sys -- (wpsdrvnt) DRV - [2004.02.02 10:51:04 | 000,055,891 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\Drivers\Teefer.sys -- (Teefer) DRV - [2004.02.02 10:37:32 | 000,011,914 | ---- | M] (Sygate Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys -- (wg3n) DRV - [2000.09.19 11:16:56 | 000,003,584 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DLPORTIO.SYS -- (DLPortIO) DRV - [2000.07.24 00:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\BrPar.sys -- (BrPar) DRV - [2000.02.08 10:30:24 | 000,015,488 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ScFBPNT2.sys -- (ScFBPNT2) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-725345543-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-1801674531-725345543-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Programme\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\html5video [2011.04.17 03:36:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Programme\DivX\DivX Plus Web Player\firefox\wpa [2011.04.17 03:36:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.10.12 13:01:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.12 13:01:16 | 000,000,000 | ---D | M] [2011.04.28 19:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\maxmustermann\Anwendungsdaten\Mozilla\Extensions [2011.04.07 16:18:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.03.17 17:49:10 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011.02.17 19:28:28 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.07.31 07:09:57 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.23 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll () O3 - HKU\S-1-5-21-1801674531-725345543-682003330-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DesktopTwister] C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\_PA297\DSKTWIST.EXE File not found O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM..\Run: [SmcService] C:\Programme\Sygate\SPF\Smc.exe (Sygate Technologies, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TWCU] C:\Programme\TP-LINK\TP-LINK Wireless Client Utility\TWCU.exe () O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.) O4 - HKLM..\Run: [WinVNC] C:\Programme\TightVNC\WinVNC.exe (Constantin Kaplinsky) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-21-1801674531-725345543-682003330-1003..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AWUS036H Wireless LAN Utility.lnk = C:\Programme\AWUS036H Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Orbit.lnk = C:\Programme\Orbitdownloader\orbitdm.exe (Orbitdownloader.com) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1801674531-725345543-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{64289A02-7B55-4DFB-8743-96B753339B8C}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AEAF9C74-006E-4375-A432-493CF9A384AC}: NameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O32 - HKLM CDRom: AutoRun - 0 O32 - AutoRun File - [2009.01.27 18:57:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - Windows Messenger 5.1 ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012.01.04 21:33:02 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2012.01.04 21:33:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\maxmustermann\Anwendungsdaten\Malwarebytes [2012.01.04 21:32:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.01.04 21:32:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.01.04 21:32:45 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.01.04 21:32:44 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.01.04 21:29:30 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\maxmustermann\Desktop\OTL.exe [2012.01.04 20:31:50 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\maxmustermann\Recent [2011.12.15 14:52:28 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoinstaller01007.dll [2011.12.15 14:52:28 | 000,063,488 | ---- | C] (Silicon Laboratories) -- C:\WINDOWS\System32\drivers\silabser.sys [2011.12.15 14:52:28 | 000,017,920 | ---- | C] (Silicon Laboratories, Inc.) -- C:\WINDOWS\System32\drivers\silabenm.sys [2011.12.15 14:52:28 | 000,000,000 | ---D | C] -- C:\Programme\Silabs [2011.12.15 14:52:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Silabs [2011.12.15 14:52:01 | 000,000,000 | ---D | C] -- C:\SiLabs [2011.12.11 16:51:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DupDetector [2011.12.11 16:51:19 | 000,000,000 | ---D | C] -- C:\Programme\Prismatic Software [2011.12.11 16:38:00 | 000,000,000 | ---D | C] -- C:\Programme\AntiTwin [2011.12.11 12:50:04 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Adobe [2011.12.11 12:45:29 | 000,000,000 | ---D | C] -- C:\Programme\Adobe [2011.12.11 12:45:18 | 000,306,688 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUninst.exe [2011.12.07 14:41:32 | 000,000,000 | ---D | C] -- C:\Programme\PonyProg2000 [2011.12.07 14:41:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PonyProg [2011.12.07 14:03:07 | 000,035,892 | ---- | C] (Prolific Technology Inc.) -- C:\WINDOWS\System32\SER9PL.sys [2011.12.07 13:44:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\MCS Electronics [2011.12.07 13:43:52 | 000,014,544 | ---- | C] (EnTech Taiwan) -- C:\WINDOWS\System32\drivers\TVicPort.sys [2011.12.07 13:43:46 | 000,000,000 | ---D | C] -- C:\Programme\MCS Electronics [2003.11.26 23:43:44 | 000,049,152 | ---- | C] (CodeMercs) -- C:\Programme\IOWKIT.DLL [2003.01.13 15:32:18 | 000,057,344 | ---- | C] (FTDI Ltd) -- C:\Programme\UIO88.DLL [1999.08.18 05:00:00 | 000,025,600 | ---- | C] (Inprise Corporation) -- C:\Programme\BORLNDMM.DLL [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012.01.04 22:21:37 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\maxmustermann\defogger_reenable [2012.01.04 22:13:43 | 000,294,216 | ---- | M] () -- C:\Dokumente und Einstellungen\maxmustermann\Desktop\gmer.zip [2012.01.04 21:35:55 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2012.01.04 21:32:52 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.01.04 20:57:44 | 000,458,476 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.01.04 20:57:44 | 000,440,684 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.01.04 20:57:44 | 000,084,318 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.01.04 20:57:44 | 000,071,002 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012.01.04 20:56:41 | 000,001,526 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Orbit.lnk [2012.01.04 20:53:17 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.01.04 20:53:11 | 2145,439,744 | -HS- | M] () -- C:\hiberfil.sys [2012.01.04 19:16:43 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.12.15 14:52:51 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf [2011.12.11 16:38:02 | 000,000,656 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Anti-Twin.lnk [2011.12.11 13:13:41 | 000,002,342 | ---- | M] () -- C:\WINDOWS\ST6UNST.001 [2011.12.11 13:13:27 | 000,286,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Setup1.exe [2011.12.11 13:13:26 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012.01.04 22:21:37 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\maxmustermann\defogger_reenable [2012.01.04 22:13:42 | 000,294,216 | ---- | C] () -- C:\Dokumente und Einstellungen\maxmustermann\Desktop\gmer.zip [2012.01.04 21:32:52 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.15 14:52:51 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_silabser_01007.Wdf [2011.12.11 16:38:04 | 000,000,662 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Anti-Twin.lnk [2011.12.11 16:38:02 | 000,000,656 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Anti-Twin.lnk [2011.12.11 13:13:25 | 000,002,342 | ---- | C] () -- C:\WINDOWS\ST6UNST.001 [2011.12.07 14:03:07 | 000,026,719 | ---- | C] () -- C:\WINDOWS\System32\SERSPL.VXD [2011.10.10 16:10:27 | 000,076,088 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2011.09.05 19:12:38 | 000,000,409 | ---- | C] () -- C:\WINDOWS\songs.ini [2011.09.05 19:03:13 | 000,000,028 | ---- | C] () -- C:\WINDOWS\winzip32.ini [2011.08.28 17:39:23 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2011.08.24 15:42:47 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2011.07.11 21:45:07 | 000,340,021 | ---- | C] () -- C:\WINDOWS\System32\jpeg.dll [2011.06.18 16:32:31 | 000,000,234 | ---- | C] () -- C:\WINDOWS\HRDLog001.INI [2011.05.22 20:34:34 | 000,000,060 | ---- | C] () -- C:\WINDOWS\crackpdf.INI [2011.05.22 20:33:03 | 000,000,075 | ---- | C] () -- C:\WINDOWS\winDecrypt.INI [2011.05.22 20:15:54 | 000,000,093 | ---- | C] () -- C:\WINDOWS\kjkjbas.INI [2011.05.22 20:15:54 | 000,000,092 | ---- | C] () -- C:\WINDOWS\kjkjERR.INI [2011.05.19 17:33:51 | 000,000,432 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2011.05.19 17:33:51 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD2030.DAT [2011.05.19 17:30:10 | 000,000,141 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI [2011.05.19 17:30:10 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI [2011.05.19 17:30:10 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini [2011.05.19 17:30:04 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL [2011.05.19 17:30:03 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL [2011.05.19 17:30:03 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL [2011.05.19 17:30:01 | 000,008,975 | ---- | C] () -- C:\WINDOWS\HL-2030.INI [2011.05.04 19:37:08 | 000,013,312 | ---- | C] () -- C:\Dokumente und Einstellungen\maxmustermann\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.04.25 19:25:30 | 000,262,216 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll [2011.04.25 19:25:01 | 000,422,000 | ---- | C] () -- C:\WINDOWS\System32\wgapi.dll [2011.04.25 19:25:01 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\wgapiloc.dll [2011.04.11 10:42:36 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\MPMapTrace.dll [2011.04.11 09:34:16 | 000,364,544 | ---- | C] () -- C:\WINDOWS\System32\mpPathan.dll [2011.03.17 17:50:14 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011.03.08 20:49:16 | 000,002,778 | ---- | C] () -- C:\WINDOWS\DigiPan.INI [2011.02.24 19:38:52 | 000,015,488 | ---- | C] () -- C:\WINDOWS\System32\drivers\ScFBPNT2.sys [2011.02.20 10:47:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2011.02.17 19:03:21 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2011.02.17 16:44:37 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe [2011.02.17 16:17:53 | 000,000,092 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini [2009.01.27 19:10:59 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll [2009.01.27 19:04:16 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009.01.27 19:00:11 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2009.01.27 18:53:05 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2009.01.27 18:40:31 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009.01.27 18:39:06 | 000,126,112 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2007.11.26 15:10:10 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\emcoinst.dll [2007.08.23 17:55:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007.03.23 03:03:14 | 000,001,049 | ---- | C] () -- C:\WINDOWS\emasio.dat [2006.12.13 15:03:14 | 000,074,240 | ---- | C] () -- C:\WINDOWS\System32\zlibwapi.dll [2006.06.10 05:17:56 | 000,000,830 | ---- | C] () -- C:\WINDOWS\System32\drivers\emusba10.dat [2005.01.06 11:08:14 | 003,917,312 | ---- | C] () -- C:\Programme\profilab30.exe [2005.01.06 11:02:56 | 000,222,981 | ---- | C] () -- C:\Programme\profilab30.chm [2004.12.22 14:42:32 | 000,157,630 | ---- | C] () -- C:\Programme\all_hardware.htm [2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004.07.02 07:25:42 | 000,724,480 | ---- | C] () -- C:\Programme\dmm_easy.exe [2004.03.24 18:15:50 | 000,388,096 | ---- | C] () -- C:\Programme\USB8IO.DLL [2003.07.01 04:56:36 | 000,345,600 | ---- | C] () -- C:\Programme\K8055D.DLL [2002.09.17 23:45:00 | 000,119,808 | ---- | C] () -- C:\WINDOWS\lsb_un20.exe [2002.08.29 02:54:14 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2001.08.23 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001.08.23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001.08.23 13:00:00 | 000,458,476 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2001.08.23 13:00:00 | 000,440,684 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001.08.23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001.08.23 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2001.08.23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001.08.23 13:00:00 | 000,084,318 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2001.08.23 13:00:00 | 000,071,002 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001.08.23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001.08.23 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2001.08.23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001.08.23 13:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001.08.23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2000.09.19 11:16:56 | 000,003,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\DLPORTIO.SYS [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*. >[/color] [2011.10.10 16:08:40 | 000,000,000 | ---D | M] -- C:\8b130456d411efb847b5e50c [2011.10.24 19:32:26 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2009.01.27 19:07:19 | 000,000,000 | ---D | M] -- C:\dell [2011.04.24 18:11:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2012.01.04 22:20:14 | 000,000,000 | ---D | M] -- C:\downloads [2009.01.27 19:11:20 | 000,000,000 | ---D | M] -- C:\drvrtmp [2011.07.29 19:26:40 | 000,000,000 | ---D | M] -- C:\Elektrotechnik [2011.07.11 23:40:49 | 000,000,000 | ---D | M] -- C:\karten [2011.08.28 17:36:38 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.04.24 22:05:00 | 000,000,000 | ---D | M] -- C:\OWON [2011.10.24 16:14:12 | 000,000,000 | ---D | M] -- C:\Patch [2011.05.05 16:32:28 | 000,000,000 | ---D | M] -- C:\Program Files [2012.01.04 21:32:44 | 000,000,000 | R--D | M] -- C:\Programme [2011.05.08 19:44:46 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2011.02.24 19:38:28 | 000,000,000 | ---D | M] -- C:\scan [2011.12.15 14:52:01 | 000,000,000 | ---D | M] -- C:\SiLabs [2011.06.27 15:23:57 | 000,000,000 | ---D | M] -- C:\Spectrum [2012.01.04 22:12:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.01.04 21:20:12 | 000,000,000 | ---D | M] -- C:\WINDOWS [2011.10.23 16:57:01 | 000,000,000 | ---D | M] -- C:\xp [color=#A23BEC]< %PROGRAMFILES%\*.exe >[/color] [2004.07.02 07:25:42 | 000,724,480 | ---- | M] () -- C:\Programme\dmm_easy.exe [2005.02.22 09:14:04 | 003,917,312 | ---- | M] () -- C:\Programme\profilab30.exe Invalid Environment Variable: LOCALAPPDATA [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.manifest /3 >[/color] [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] [color=#A23BEC]< MD5 for: AFD.SYS >[/color] [2008.08.14 11:34:26 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=4D43E74F2A1239D53929B82600F1971C -- C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys [2002.08.29 01:01:14 | 000,131,968 | ---- | M] (Microsoft Corporation) MD5=51B1872B62D1C335BAC53313913C8D5B -- C:\WINDOWS\$NtServicePackUninstall$\afd.sys [2008.08.14 10:51:43 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\system32\dllcache\afd.sys [2008.08.14 10:51:43 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\system32\drivers\afd.sys [2004.08.03 23:14:16 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E -- C:\WINDOWS\$NtUninstallKB951748$\afd.sys [2004.08.03 23:14:16 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E -- C:\WINDOWS\ServicePackFiles\i386\afd.sys [2008.08.14 10:48:52 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=6A0397376853E604DE8E1E7A87FC08AC -- C:\WINDOWS\$hf_mig$\KB956803\SP2QFE\afd.sys [2008.08.14 11:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$hf_mig$\KB956803\SP3GDR\afd.sys [2008.06.20 11:44:38 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=944CA435BFCFC82CC1ED9E3A7D731AA9 -- C:\WINDOWS\$NtUninstallKB956803$\afd.sys [2008.06.20 12:48:03 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=D6EE6014241D034E63C49A50CB2B442A -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys [2008.06.20 11:44:08 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=D99DDFFB33DEACDCF20717CB520379F6 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys [2008.06.20 12:40:08 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2002.08.29 02:43:36 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB884883$\explorer.exe [2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\explorer.exe [2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\system32\dllcache\explorer.exe [2005.04.07 19:46:59 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=64322E8399B205B7281FF883737A9B03 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [color=#A23BEC]< MD5 for: IPSEC.SYS >[/color] [2002.08.29 01:07:22 | 000,057,984 | ---- | M] (Microsoft Corporation) MD5=1C4802409CFD4A7051F458B744CFCAA5 -- C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys [2004.08.03 23:14:30 | 000,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys [2004.08.03 23:14:30 | 000,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\system32\drivers\ipsec.sys [color=#A23BEC]< MD5 for: REGEDIT.EXE >[/color] [2004.08.04 00:58:10 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\regedit.exe [2004.08.04 00:58:10 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe [2002.08.29 02:43:40 | 000,141,312 | ---- | M] (Microsoft Corporation) MD5=FD95FFECC4B1FE72597D7FA6AF8C2870 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe [2002.08.29 02:43:40 | 000,141,312 | ---- | M] (Microsoft Corporation) MD5=FD95FFECC4B1FE72597D7FA6AF8C2870 -- C:\xp\I386\REGEDIT.EXE [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2002.08.29 02:43:42 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe [2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe [2002.08.29 02:43:42 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >[/color] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2008.09.15 16:37:15 | 001,846,144 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color] [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color] < End of report > Alex |
| Themen zu "BKA EXPLOIT" EXP/CVE-2011-3544.AM' Desktop nicht mehr zugänglich. |
| 0x00000001, 100 eur, administrator, antivir, application/pdf, application/pdf:, avira, bho, bka exploit, bka virus, browser, daten sichern, desktop, einstellungen, error, firefox, fontcache, format, helper, homepage, karte, libusb0.sys, logfile, microsoft, object, plug-in, programm, realtek, registry, required, rundll, software, synology, taskmanager, temp, virus, win32k.sys, winlogon.exe, zugänglich |
Baum-Darstellung