| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundespolizei virus shell = explorer.exeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.01.2012, 23:55
| #1 |
 |  Bundespolizei virus shell = explorer.exe [B]Hallo Leute ich hatte schon vor 2 Wochen diesen Trojanern auf meinem Laptop Ich habe mir deshalb einen neuen Benutzerkonto zugelegt, und habe meine daten davor gesichert und auf dem neuen behalten. Jedoch fand der Anti Viren Programm den Trojaner nicht und ich dachte er wäre verschwunden. Jedoch heute kam er zum erstenmal nach 2 Wochen wieder-  Ich schreibe diesen Thread hier von einem anderen Benutzerkonto aus. Jedoch wird dieser wahrscheinlich auch infiziert sein. Was muss ich machen? Hilfe! Geändert von mumii42 (07.01.2012 um 00:14 Uhr) |
|
07.01.2012, 00:31
| #2 |
| /// Selecta Jahrusso   | Bundespolizei virus shell = explorer.exe Mein Name ist Daniel und ich werde dir mit deinem Malware Relevanten Problemen helfen. Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Logge dich bitte einmal in dem Benutzerkonto ein, in das du kannst. Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
Bitte poste in deiner nächsten Antwort OTL.txt Extras.txt
__________________ |
|
07.01.2012, 11:31
| #3 |
| | Bundespolizei virus shell = explorer.exe Danke für deine schnelle Antwort.
__________________Hier ist das Resultat:OTL Logfile: Code:
ATTFilter OTL logfile created on: 1/7/2012 11:23:15 AM - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Muhammed_2\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.86 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.86% Memory free 7.71 Gb Paging File | 5.63 Gb Available in Paging File | 73.06% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 116.44 Gb Total Space | 56.00 Gb Free Space | 48.09% Space Free | Partition Type: NTFS Drive D: | 334.67 Gb Total Space | 334.43 Gb Free Space | 99.93% Space Free | Partition Type: NTFS Computer Name: MUHAMMED-PC | User Name: Muhammed_2 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Muhammed_2\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Windows\AsScrPro.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) PRC - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\PROGRA~2\VIRTUA~1\VIRTUA~1.EXE (VirtuaWin) PRC - C:\PROGRA~2\VIRTUA~1\modules\WinList.exe () PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS) PRC - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.) PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe () PRC - C:\PROGRA~2\ROCKET~1\ROCKET~1.EXE () PRC - C:\PROGRA~2\Yzshadow\YzShadow.exe (Y'z@Home) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll () MOD - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll () MOD - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avutil-51.dll () MOD - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avformat-53.dll () MOD - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avcodec-53.dll () MOD - C:\PROGRA~2\Google\Chrome\APPLIC~1\160912~1.75\gcswf32.dll () MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe () MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll () MOD - C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll () MOD - C:\PROGRA~2\VIRTUA~1\modules\WinList.exe () MOD - \\?\globalroot\systemroot\syswow64\mswsock.DLL () MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe () MOD - C:\PROGRA~2\ROCKET~1\ROCKET~1.EXE () MOD - C:\PROGRA~2\ROCKET~1\RocketDock.dll () MOD - C:\PROGRA~2\Yzshadow\YzShadow.dll () MOD - C:\PROGRA~2\Yzshadow\Languages\English.lang () ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_b427739.dll () SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (npggsvc) -- C:\Windows\SysWow64\GameMon.des (INCA Internet Co., Ltd.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ADSMService) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.) ========== Driver Services (SafeList) ========== DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH) DRV:64bit: - (Neo_WRJ) -- C:\Windows\SysNative\drivers\Neo_0114.sys (SoftEther Corporation) DRV:64bit: - (AsDsm) -- C:\Windows\SysNative\drivers\AsDsm.sys (ASUSTek Computer Inc) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (JME) JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits) -- C:\Windows\SysNative\drivers\JME.sys (JMicron Technology Corp.) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.) DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( ) DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys () DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (lullaby) -- C:\Windows\SysNative\drivers\lullaby.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (arcvad_ds2dhw) -- C:\Windows\SysNative\drivers\ArcVad.sys (ArcSoft, Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV:64bit: - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\SysNative\drivers\sfdrv01.sys (Protection Technology (StarForce)) DRV:64bit: - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\SysNative\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV:64bit: - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\SysNative\drivers\sfvfs02.sys (Protection Technology) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS) DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Asus | MSN IE - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Asus | MSN IE - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_10_2_161.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) [2011/10/11 15:46:15 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files (x86)\DNA\plugins\npbtdna.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll CHR - plugin: Protect Disc License Acquisition Plugin (Enabled) = C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Muhammed_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\ CHR - Extension: Google-Suche = C:\Users\Muhammed_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\ CHR - Extension: AutocompletePro plugin for chrome = C:\Users\Muhammed_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\defdhglnppeioeflggkmglipcecffkhk\1.0_0\ CHR - Extension: Google Mail = C:\Users\Muhammed_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\ O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll (SimplyGen) O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [EeeStorageBackup] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe () O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe () O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [sllaunch] C:\Windows\SysWOW64\sllaunch.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [svchost] C:\Windows\SysWOW64\WindowsSystemFiles\svchost.exe (Microsoft) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007..\Run: [slwc] C:\Windows\SysWOW64\\slwc.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - CC:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class) O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} hxxp://gfx1.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUplden-us.cab (Windows Live Hotmail Photo Upload Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC0A58AC-4548-445B-8F96-A9193790196B}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/01/07 11:15:50 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{F90DB3EC-6065-46CC-B4D4-9710B9379BCE} [2012/01/07 11:15:37 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{5C444420-16D4-41A4-A1A3-8CAA71CF4999} [2012/01/07 00:09:49 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Muhammed_2\Desktop\OTL.exe [2012/01/06 23:37:38 | 000,000,000 | ---D | C] -- C:\_OTL [2012/01/06 16:53:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2012/01/06 16:52:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER [2012/01/06 16:52:02 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012/01/06 16:26:33 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{72C7B24E-8762-44D4-B57A-776FACE7E5B6} [2012/01/06 16:24:41 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{994A08FB-E03B-48F6-AC4C-681DB9ACFE97} [2012/01/06 16:19:40 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{02014222-3B2B-4BA5-93A8-5A194C410449} [2012/01/06 16:15:16 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{F4E1B2D8-AF04-4006-BFE4-6FAFE005E4A9} [2012/01/05 10:41:58 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{C7B90A24-9CD7-4EB9-8518-3B57DFC7AD5D} [2012/01/05 10:40:34 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{69DAC1BD-7F4E-42D8-9769-C17859B85E8D} [2012/01/03 11:53:38 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{2B105D92-3F27-4C3A-9A01-046B968B3C8A} [2012/01/03 11:53:25 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{8FB6E8C4-F591-447D-BA4A-70F124D05491} [2012/01/02 20:06:30 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{381C98B1-7B88-4D1A-A416-BB8E6FB07FC1} [2012/01/02 17:30:14 | 000,695,296 | ---- | C] (AnjoCaido) -- C:\Users\Muhammed_2\Desktop\MinecraftSP.exe [2012/01/02 10:37:11 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{D05CF4DC-0B53-42B2-9B87-AC478586EB99} [2012/01/01 12:09:25 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\.minecraft [2012/01/01 10:57:36 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{FCEDE603-AB56-489E-A7CF-DEBFE17C9423} [2012/01/01 10:57:24 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{5AB396ED-9D7F-4141-A108-43FA735D5D04} [2011/12/31 10:15:24 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{74F2CDF1-A82A-42F4-BB4F-4A52644EEFCD} [2011/12/31 10:14:22 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{C00107F8-A008-4403-B414-3C8194FD9E8F} [2011/12/30 14:17:16 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{1B921478-0E09-4186-97E7-DC9342AF63FE} [2011/12/30 14:17:05 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{4E8AB37D-EFB3-4979-AB25-15782A703832} [2011/12/30 09:28:03 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{0BD72A1F-A539-445B-BD44-FB8163F0CAB7} [2011/12/30 09:27:07 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{71A7E144-D592-4B1C-9C32-28865DCEA1C5} [2011/12/28 09:26:22 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{9765186D-EA79-42D8-B0B2-C152FB45A53A} [2011/12/28 09:26:08 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{C8D379D6-0BB5-4E62-8E3A-5970B172F29D} [2011/12/28 09:26:07 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{0493E47F-58B1-419F-8BE8-188C296DBAD4} [2011/12/27 09:32:38 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{004AB697-2B32-4D8F-B9C3-7F31C8222719} [2011/12/27 09:32:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{B9B587F7-375B-4CFD-85A6-61431CAEA673} [2011/12/26 09:05:50 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{644E7832-8586-496E-9674-ACFED15C1B66} [2011/12/26 09:05:38 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{A822D4A8-2925-4BBC-8B0F-C9C6CB10EECE} [2011/12/25 15:15:21 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{4852F8D0-2424-4944-8A5B-B29AAC8DC6F2} [2011/12/25 15:15:06 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{D47FEF9C-A87A-4E07-82AD-1AFD1B6AEE20} [2011/12/25 12:09:00 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{3C6545D2-D769-43B2-8C81-D2143999A8D0} [2011/12/25 12:08:06 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{37D93EF9-373F-4893-8B96-9890F11C3A00} [2011/12/24 09:22:38 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{FAB36D47-1D72-4911-8184-DA4D70C4E0D9} [2011/12/24 09:22:25 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{692C289E-8C20-4F5E-A048-F193B0108D45} [2011/12/23 14:35:25 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Skype [2011/12/23 07:16:58 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{C9598641-1657-4531-B403-865D4BD300B0} [2011/12/23 07:16:45 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{0B29E461-551D-479E-9ECC-B21956277C50} [2011/12/22 13:09:58 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{DDB9C4FC-6078-4BF2-A89D-92B01A68E2C5} [2011/12/22 13:09:29 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{FAC95711-5BC7-4CDA-AC18-70DBFF803E99} [2011/12/21 22:55:00 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Apple [2011/12/21 20:27:08 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\Documents\Meine empfangenen Dateien [2011/12/21 19:38:55 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Windows Live [2011/12/21 19:38:55 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{6B8547CC-6842-4A35-B774-5C91650D6973} [2011/12/21 19:38:42 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\{E80CA1A0-5D8E-4538-8E33-650EE6C450C1} [2011/12/21 19:38:27 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\Tracing [2011/12/20 00:08:03 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\Desktop\Normal anziehen undso [2011/12/19 23:27:51 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Paint.NET [2011/12/19 23:03:10 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\ElevatedDiagnostics [2011/12/18 11:43:37 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\Documents\ASUS WebStorage [2011/12/18 11:43:37 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Asus WebStorage [2011/12/18 11:30:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yzshadow [2011/12/18 11:30:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VirtuaWin [2011/12/18 11:30:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UberIcon [2011/12/18 11:30:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RocketDock [2011/12/18 11:22:09 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\WinRAR [2011/12/18 11:19:32 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Adobe [2011/12/18 11:12:58 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Google [2011/12/18 11:11:55 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\SRS Labs [2011/12/18 11:10:57 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\ATI [2011/12/18 11:10:57 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\ATI [2011/12/18 11:09:23 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011/12/18 11:09:23 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Searches [2011/12/18 11:09:23 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011/12/18 11:09:14 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Identities [2011/12/18 11:09:10 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Contacts [2011/12/18 11:07:26 | 000,000,000 | --SD | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Favorites [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Downloads [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Documents [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Desktop [2011/12/18 11:07:26 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Vorlagen [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\AppData\Local\Verlauf [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\AppData\Local\Temporary Internet Files [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Startmenü [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\SendTo [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Recent [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Netzwerkumgebung [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Lokale Einstellungen [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Documents\Eigene Videos [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Documents\Eigene Musik [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Eigene Dateien [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Documents\Eigene Bilder [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Druckumgebung [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Cookies [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\AppData\Local\Anwendungsdaten [2011/12/18 11:07:26 | 000,000,000 | -HSD | C] -- C:\Users\Muhammed_2\Anwendungsdaten [2011/12/18 11:07:26 | 000,000,000 | -H-D | C] -- C:\Users\Muhammed_2\AppData [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Temp [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Power2Go [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Microsoft Help [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Local\Microsoft [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Media Center Programs [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Macromedia [2011/12/18 11:07:26 | 000,000,000 | ---D | C] -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite [2011/12/18 11:07:25 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Videos [2011/12/18 11:07:25 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Saved Games [2011/12/18 11:07:25 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Pictures [2011/12/18 11:07:25 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Music [2011/12/18 11:07:25 | 000,000,000 | R--D | C] -- C:\Users\Muhammed_2\Links [2011/12/18 09:57:57 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011/12/15 14:31:14 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011/12/15 14:30:59 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2011/12/15 14:30:59 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2011/12/15 14:30:59 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011/12/15 14:30:59 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2011/12/15 14:30:59 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011/12/15 14:30:59 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011/12/15 14:30:59 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011/12/15 14:30:58 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2011/12/15 14:30:58 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2011/12/15 14:30:58 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011/12/15 14:30:58 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011/12/15 14:30:58 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2011/12/15 14:30:58 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2011/12/15 14:30:58 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2011/12/15 14:30:58 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2011/12/15 14:26:32 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011/12/15 14:26:31 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2008/08/12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/01/07 11:21:02 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/01/07 11:21:02 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/01/07 11:16:10 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/01/07 11:13:37 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/01/07 11:13:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/01/07 11:13:04 | 3105,259,520 | -HS- | M] () -- C:\hiberfil.sys [2012/01/06 23:36:07 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Muhammed_2\Desktop\OTL.exe [2012/01/06 23:32:36 | 001,622,098 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/01/06 23:32:36 | 000,700,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012/01/06 23:32:36 | 000,655,302 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/01/06 23:32:36 | 000,149,402 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012/01/06 23:32:36 | 000,122,174 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/01/06 16:56:35 | 000,471,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/01/06 16:54:37 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2012/01/06 14:18:53 | 000,001,057 | ---- | M] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk [2012/01/02 17:30:12 | 000,695,296 | ---- | M] (AnjoCaido) -- C:\Users\Muhammed_2\Desktop\MinecraftSP.exe [2012/01/01 12:47:52 | 698,154,420 | ---- | M] () -- C:\Users\Muhammed_2\Documents\clip0010.avi [2011/12/27 12:00:00 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\One-Click Tweak.job [2011/12/25 16:18:26 | 1482,993,182 | ---- | M] () -- C:\Users\Muhammed_2\Documents\clip0009.avi [2011/12/19 15:32:18 | 000,270,142 | ---- | M] () -- C:\Users\Muhammed_2\Desktop\Minecraft.exe [2011/12/10 12:36:41 | 001,642,510 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/01/06 14:18:53 | 000,001,057 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk [2012/01/01 12:41:29 | 698,154,420 | ---- | C] () -- C:\Users\Muhammed_2\Documents\clip0010.avi [2011/12/25 15:19:40 | 1482,993,182 | ---- | C] () -- C:\Users\Muhammed_2\Documents\clip0009.avi [2011/12/19 15:32:17 | 000,270,142 | ---- | C] () -- C:\Users\Muhammed_2\Desktop\Minecraft.exe [2011/12/18 11:32:42 | 000,315,682 | ---- | C] () -- C:\Windows\SysWow64\slwc.exe [2011/12/18 11:10:21 | 000,001,411 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011/12/18 11:09:34 | 000,001,445 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011/11/15 18:07:58 | 000,145,843 | ---- | C] () -- C:\Windows\SysWow64\sllaunch.exe [2011/11/15 18:05:16 | 000,111,104 | ---- | C] () -- C:\Windows\SysWow64\Uharc.exe [2011/11/15 18:05:16 | 000,008,636 | ---- | C] () -- C:\Windows\SysWow64\modifype.exe [2011/11/08 16:13:51 | 000,052,836 | ---- | C] () -- C:\Windows\SysWow64\zlib1.dll [2011/11/08 16:13:50 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\libpng13.dll [2011/11/08 16:13:49 | 000,394,752 | ---- | C] () -- C:\Windows\SysWow64\cygwinb19.dll [2011/11/08 16:13:45 | 000,709,719 | ---- | C] () -- C:\Windows\unins000.exe [2011/11/08 16:13:45 | 000,006,589 | ---- | C] () -- C:\Windows\unins000.dat [2011/05/12 14:12:37 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011/02/25 17:36:44 | 000,000,396 | -H-- | C] () -- C:\Program Files (x86)\U_AVA_Setup.exe.bfi [2011/01/21 20:32:07 | 000,000,244 | ---- | C] () -- C:\Windows\ODBCINST.INI [2010/09/14 17:48:12 | 000,000,782 | ---- | C] () -- C:\Windows\config.ini [2010/07/29 12:59:38 | 000,000,336 | ---- | C] () -- C:\Windows\game.ini [2010/07/24 20:54:40 | 000,281,656 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010/07/24 20:54:34 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2010/07/24 20:52:52 | 000,794,408 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2010/07/24 15:23:11 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe [2010/07/14 13:31:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010/07/03 19:03:20 | 001,642,510 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010/06/21 14:52:30 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2010/01/29 22:54:57 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll [2010/01/29 22:51:15 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010/01/29 22:36:52 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2009/10/26 04:38:20 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config [2009/08/19 09:33:09 | 000,018,432 | ---- | C] () -- C:\Windows\OOBEPlayer.exe [2009/08/19 09:33:09 | 000,000,035 | ---- | C] () -- C:\Windows\OOBEPlayer.ini [2009/07/29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini [2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2009/04/08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll [2008/05/22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg [2006/05/19 04:39:57 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini [2003/02/20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI ========== Alternate Data Streams ========== @Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:15024E60 @Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:734E442A @Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:05EE1EEF @Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:DDEB08FD @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4CF61E54 @Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:0888F409 @Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:A724744F @Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:2B11E0DF @Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:888AFB86 < End of report > Extras.txtOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 1/7/2012 11:23:15 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Muhammed_2\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.86 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.86% Memory free
7.71 Gb Paging File | 5.63 Gb Available in Paging File | 73.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 56.00 Gb Free Space | 48.09% Space Free | Partition Type: NTFS
Drive D: | 334.67 Gb Total Space | 334.43 Gb Free Space | 99.93% Space Free | Partition Type: NTFS
Computer Name: MUHAMMED-PC | User Name: Muhammed_2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{26B0A622-1314-70B4-2971-DA74D58F2DDB}" = ccc-utility64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{D87D65E0-B704-9861-F836-5A310B41F153}" = ATI Catalyst Install Manager
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F634E9C2-5D00-3A4B-5AB0-148C431BBDD5}" = ATI AVIVO64 Codecs
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin 64" = Adobe Flash Player 10 Plugin 64-bit
"ASUS WebStorage" = ASUS WebStorage
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Elantech" = ETDWare PS/2-x64 7.0.5.9_WHQL
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"USB 2.0 UVC 1.3M WebCam" = USB 2.0 UVC 1.3M WebCam
"WinRAR archiver" = WinRAR archiver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0512FBC8-37F5-11E1-630E-0E4BF115179A}" = CCC Help Norwegian
"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
"{07C4EA80-2F1F-B150-4CCC-0AD2E4F8FBAB}" = CCC Help Hungarian
"{07EC03E1-2831-C147-CAA7-7A900EE9FD8D}" = CCC Help Dutch
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D052F88-18D4-FC0A-BF33-318C4FDFF6FD}" = Catalyst Control Center Graphics Light
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1E356931-3A8D-77D4-4D08-2FB6A1C01361}" = CCC Help Thai
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33A9D3F0-C131-5CCF-3630-13FDAE4931E8}" = ccc-core-static
"{33D31A9E-7D50-1B38-7D5E-FB41C89A805A}" = CCC Help Turkish
"{342126E1-173C-4585-BFBE-3EBDD20E3E9E}" = Mobipocket Reader 6.2
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{420897E0-9294-C91D-194A-C3D53B768AB7}" = Catalyst Control Center Core Implementation
"{42AF51C0-4028-46CF-B616-FB1F75286457}" = A.V.A
"{43E49F45-70FB-31D8-2C9A-4C80A0694F28}" = CCC Help Finnish
"{4997619D-FA9C-1987-ADD9-292E7623A7AB}" = CCC Help Chinese Standard
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{5E7B9D7C-0245-A5AF-9A7F-C2A74F8A4251}" = CCC Help French
"{641BFAC0-2527-FEF8-DA90-52F42A9C82AB}" = CCC Help Portuguese
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65761BAE-11E8-48FE-B30F-1F01011AB906}" = Die Sims™ 3 "Erstelle eine Welt"-Tool - Beta
"{65CE0B7D-F67E-EE9C-A10F-85ECBDC7FF01}" = Catalyst Control Center Graphics Full New
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6EB8E500-1A08-5104-C0F4-B131C23BAC57}" = CCC Help Italian
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B4D193B-D76D-308B-8B12-5D9BB1CBCE6C}" = Microsoft Visual Basic Power Packs 3.0
"{7C3B44A6-CA80-67A8-BD61-72AC2E367760}" = CCC Help Russian
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8385135C-A857-2F59-5226-03AF656DA9A5}" = Catalyst Control Center Localization All
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{856520DF-4018-0EAD-B02F-C506C0C52F02}" = CCC Help Swedish
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{901DC58A-5C1B-4315-BA40-5AD3D3A463B9}" = REACTOR
"{90D9AF4D-8BA2-D322-E2B6-316CC4EEDEB9}" = CCC Help English
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}" = JMicron Ethernet Adapter NDIS Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B408981-8298-20FE-58E5-59113B371947}" = CCC Help Japanese
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9DB3F20E-EAE9-FE53-DC08-71BC5E5F18E3}" = Catalyst Control Center Graphics Previews Vista
"{9E3234AD-F86D-7ABE-EC5B-A1BDDC770FFE}" = CCC Help Danish
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A57039DB-8A82-0DA3-CFBD-888E88A50816}" = CCC Help Korean
"{A5981835-5A34-E723-BBB1-3A4556F93B14}" = CCC Help Greek
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9D0699A-714A-7AF0-7887-A880440CF1EE}" = CCC Help German
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB3C268A-E54B-4F6D-BF97-2DFCEEFA94F5}" = Catalyst Control Center - Branding
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1924580-0C5D-11E0-B655-0013D3D69929}" = MSVCRT Redists
"{B72E80DB-DF9B-DE1E-8899-CC74B6B9456A}" = Catalyst Control Center InstallProxy
"{BB1FCCCB-CF8E-87FE-B989-37041A118F29}" = CCC Help Chinese Traditional
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C94ADF6E-B9F0-1221-AD6F-25D547EA0726}" = Catalyst Control Center Graphics Previews Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D221681D-9B40-2078-0119-4FD158DC571B}" = Catalyst Control Center Graphics Full Existing
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4C16219-48E5-B6BC-637B-F16412CE5DE5}" = CCC Help Spanish
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{EE83CCB4-1DDF-153A-3E73-242A687D8C58}" = CCC Help Polish
"{F81722A1-2B1A-383B-1775-26BE96E14E4E}" = CCC Help Czech
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced PC Tweaker_is1" = Advanced PC Tweaker v4.2
"Akamai" = Akamai NetSession Interface Service
"ASUS AP Bank_is1" = ASUS AP Bank
"AutocompletePro3_is1" = AutocompletePro
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Call of Duty: Black Ops_is1" = Call of Duty: Black Ops
"Deer Hunter Tournament_is1" = Deer Hunter Tournament
"Google Chrome" = Google Chrome
"HyperCam 2" = HyperCam 2
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"Protect Disc License Helper" = Protect Disc License Helper 1.0.118
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Snow Transformation Pack" = Snow Transformation Pack 1.5
"WinLiveSuite" = Windows Live Essentials
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
|
|
07.01.2012, 15:49
| #4 |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exe
Code:
ATTFilter :otl
[2011/10/11 15:46:15 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [svchost] C:\Windows\SysWOW64\WindowsSystemFiles\svchost.exe (Microsoft)
O7 - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
[2012/01/06 14:18:53 | 000,001,057 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk
[2012/01/06 14:18:53 | 000,001,057 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk
:files
sc qc eventlog /c
sc query eventlog /c
:commands
[emptytemp]
Berichte ob du nun wieder auf das infizierte Benutzerkonto zugreifen kannst
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
07.01.2012, 18:48
| #5 | |
| | Bundespolizei virus shell = explorer.exeZitat:
Jedoch teils, denn es öffnet sich immer ein Ordner davor. Womit ich dann auf mein DesktopOrdner zugreifen kann. Ich finde keinen neues Textdokument auf meinem Desktop. Mfg. |
|
08.01.2012, 00:28
| #6 |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exe USB Stick vorhanden ?
__________________ --> Bundespolizei virus shell = explorer.exe |
|
08.01.2012, 11:24
| #7 | |
| | Bundespolizei virus shell = explorer.exeZitat:
|
|
08.01.2012, 14:26
| #8 | |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exeZitat:
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
08.01.2012, 14:55
| #9 |
| | Bundespolizei virus shell = explorer.exe Nein das ist unwichtig. Ich habe jetzt 2 Datein im folgendene Pfad gefunden: C:\_OTL\MovedFiles\<time_date>.txt 01062012_233738.log User: Default User ->Temp folder emptied: 0 bytes Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. ->Temporary Internet Files folder emptied: 33170 bytes Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. ->Flash cache emptied: 41620 bytes User: Muhammed_2 User: Public %systemdrive% .tmp files removed: 0 bytes Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. Unable to create HKLM\Software\OldTimer Tools\OTL key. %systemroot% .tmp files removed: 1020928 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 31693 bytes Total Files Cleaned = 45.00 mb OTL by OldTimer - Version 3.2.31.0 log created on 01062012_233738 01072012_184051.log All processes killed Error: Unable to interpret <  tl [2011/10/11 15:46:15 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [svchost] C:\Windows\SysWOW64\WindowsSystemFiles\svchost.exe (Microsoft) O7 - HKU\S-1-5-21-1276163129-1475671500-3325650461-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 [2012/01/06 14:18:53 | 000,001,057 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk [2012/01/06 14:18:53 | 000,001,057 | ---- | C] () -- C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk :files sc qc eventlog /c sc quer> in the current context!Error: Unable to interpret <y eventlog /c :commands [emptytemp]> in the current context! OTL by OldTimer - Version 3.2.31.0 log created on 01072012_184051 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
08.01.2012, 16:26
| #10 |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exe Downloade Dir bitte Malwarebytes
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
08.01.2012, 21:09
| #11 |
| | Bundespolizei virus shell = explorer.exe Malwarebytes Anti-Malware 1.60.0.1800 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: v2012.01.08.03 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Muhammed_2 :: MUHAMMED-PC [Administrator] 08.01.2012 21:01:14 mbam-log-2012-01-08 (21-01-14).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 199602 Laufzeit: 6 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 1 C:\Windows\SysWOW64\WindowsSystemFiles\svchost.exe (Trojan.Dropper) -> 1232 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost (Trojan.Dropper) -> Daten: C:\Windows\system32\WindowsSystemFiles\svchost.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (Search) Gut: (Google) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 1 C:\Program Files (x86)\Spyware Process Detector (Rogue.SpywareProcessDetector) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 5 C:\Windows\SysWOW64\WindowsSystemFiles\svchost.exe (Trojan.Dropper) -> Löschen bei Neustart. C:\Windows\System32\WindowsSystemFiles\svchost.exe (Trojan.Dropper) -> Löschen bei Neustart. C:\Users\Muhammed_2\AppData\Local\Temp\0.8865802567638007.exe (Trojan.Ransom.Gen) -> Löschen bei Neustart. C:\Users\Muhammed_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.8865802567638007.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Spyware Process Detector\spd321.dll (Rogue.SpywareProcessDetector) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) EDIT: Ja es hat funktioniert. Der Virus erscheint nicht wenn ich in meinen Infizierten Konto reingehe. Was hab ich jetzt zu machen? Geändert von mumii42 (08.01.2012 um 21:18 Uhr) Grund: JUUUUUUUHUUUUUU! |
|
08.01.2012, 21:52
| #12 | |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exeCombofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Bitte poste in deiner nächsten Antwort Combofix.txt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
10.01.2012, 15:18
| #13 |
| | Bundespolizei virus shell = explorer.exe Combofix Logfile: Code:
ATTFilter ComboFix 12-01-09.07 - Muhammed_2 10.01.2012 14:55:45.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3949.2337 [GMT 1:00]
ausgeführt von:: c:\users\Muhammed_2\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\prefs.js
c:\program files (x86)\AutocompletePro
c:\program files (x86)\AutocompletePro\AutocompletePro.dll
c:\program files (x86)\AutocompletePro\chrome\autocompleteprochrome.crx
c:\program files (x86)\AutocompletePro\FireFoxExtension.exe
c:\program files (x86)\AutocompletePro\InstTracker.exe
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files (x86)\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files (x86)\AutocompletePro\support@predictad.com\install.rdf
c:\program files (x86)\AutocompletePro\unins000.dat
c:\program files (x86)\AutocompletePro\unins000.exe
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\programdata\FullRemove.exe
c:\programdata\NOTEPAD.EXE-x.txt
c:\programdata\RUNDLL32.EXE-x.txt
c:\windows\assembly\tmp\U
c:\windows\assembly\tmp\U\00000001.@
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@
c:\windows\config.ini
c:\windows\isRS-000.tmp
c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\system32\consrv.dll
c:\windows\System64
c:\windows\SysWow64\WindowsSystemFiles
c:\windows\WindowsUpdate.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-12-10 bis 2012-01-10 ))))))))))))))))))))))))))))))
.
.
2012-01-08 20:00 . 2012-01-08 20:00 -------- d-----w- c:\programdata\Malwarebytes
2012-01-08 20:00 . 2012-01-08 20:00 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-08 20:00 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-06 22:37 . 2012-01-06 22:37 -------- d-----w- C:\_OTL
2012-01-06 15:52 . 2012-01-06 15:52 -------- d-----w- c:\windows\PCHEALTH
2012-01-04 21:55 . 2012-01-04 21:55 -------- d-----w- c:\users\Beyza\AppData\Local\Apple
2011-12-22 20:18 . 2011-12-22 20:18 -------- d-----w- c:\users\Beyza\AppData\Local\Diagnostics
2011-12-18 10:32 . 2010-10-16 04:49 315682 ----a-w- c:\windows\SysWow64\slwc.exe
2011-12-18 10:30 . 2011-12-18 10:30 -------- d-----w- c:\program files (x86)\Yzshadow
2011-12-18 10:30 . 2011-12-18 10:30 -------- d-----w- c:\program files (x86)\VirtuaWin
2011-12-18 10:30 . 2011-12-18 10:30 -------- d-----w- c:\program files (x86)\UberIcon
2011-12-18 10:30 . 2011-12-23 05:34 -------- d-----w- c:\program files (x86)\RocketDock
2011-12-18 10:07 . 2011-12-22 20:38 -------- d-----w- c:\users\Muhammed_2
2011-12-18 08:57 . 2011-12-18 08:57 -------- d-----w- c:\program files\CCleaner
2011-12-15 13:31 . 2011-10-26 05:19 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-15 13:31 . 2011-11-05 05:26 1197568 ----a-w- c:\windows\system32\wininet.dll
2011-12-15 13:31 . 2011-11-05 04:35 981504 ----a-w- c:\windows\SysWow64\wininet.dll
2011-12-15 13:31 . 2011-11-05 05:28 696600 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2011-12-15 13:31 . 2011-11-05 04:38 673048 ----a-w- c:\program files (x86)\Internet Explorer\iexplore.exe
2011-12-15 13:31 . 2011-11-05 04:33 860672 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2011-12-15 13:26 . 2011-11-24 05:00 3141632 ----a-w- c:\windows\system32\win32k.sys
2011-12-15 13:26 . 2011-10-15 06:25 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-15 13:26 . 2011-10-15 05:48 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-15 13:26 . 2011-11-05 05:17 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-15 13:26 . 2011-11-05 04:30 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-12 16:49 . 2012-01-08 13:51 -------- d-----w- c:\users\Beyza\AppData\Local\Windows Live
2011-12-12 16:32 . 2012-01-08 13:04 -------- d-----w- c:\users\Beyza\AppData\Roaming\.minecraft
2011-12-12 15:08 . 2011-12-12 15:51 -------- d-----w- c:\users\Beyza\AppData\Roaming\.Nitrous
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-30 01:21 . 2012-01-10 13:46 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D5627A4-196A-4C22-9453-99DBB0BB1364}\mpengine.dll
2011-11-15 17:05 . 2009-07-13 23:54 2851328 ----a-w- c:\windows\system32\themeui.dll
2011-11-15 17:05 . 2009-07-13 23:54 44544 ----a-w- c:\windows\system32\themeservice.dll
2011-11-15 17:05 . 2009-07-13 23:55 332288 ----a-w- c:\windows\system32\uxtheme.dll
2011-11-15 17:05 . 2009-07-13 23:39 2755072 ----a-w- c:\windows\SysWow64\themeui.dll
2011-11-15 17:05 . 2009-07-13 23:39 245760 ----a-w- c:\windows\SysWow64\uxtheme.dll
2011-11-15 13:29 . 2010-05-19 16:51 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-11-12 11:58 . 2011-11-08 15:13 709719 ----a-w- c:\windows\unins000.exe
2011-10-28 15:21 . 2011-10-28 15:21 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2009-04-08 18:31 . 2009-04-08 18:31 106496 ----a-w- c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 05:45 . 2008-08-12 05:45 155648 ----a-w- c:\program files (x86)\Common Files\MSIactionall.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . 0862495E0C825893DB75EF44FAEA8E93 . 2870272 . . [6.1.7600.16385] .. c:\windows\system32\SLTrans\explorer.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08 143360 ----a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"slwc"="c:\windows\SysWOW64\\slwc.exe" [2010-10-16 315682]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]
"sllaunch"="c:\windows\SysWOW64\sllaunch.exe" [2010-10-16 145843]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-18 98304]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2010-1-29 12862]
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2010-1-29 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 ntiomin;ntiomin; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 135664]
R3 arcvad_ds2dhw;ArcMIVEVad Service;c:\windows\system32\drivers\ArcVad.sys [x]
R3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\AVA\Binaries\GameGuard\dump_wmimmc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 135664]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 X6va003;X6va003;c:\users\Muhammed\AppData\Local\Temp\003F887.tmp [x]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-09-03 136360]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
S3 Neo_WRJ;VPN Client Device Driver - WRJ;c:\windows\system32\DRIVERS\Neo_0114.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 19:28]
.
2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-29 19:28]
.
2011-12-27 c:\windows\Tasks\One-Click Tweak.job
- c:\program files (x86)\Advanced PC Tweaker\OneClick.exe [2011-08-02 09:14]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:52 159744 ----a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
"EeeStorageBackup"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2009-11-26 1732608]
"combofix"="c:\combofix\CF7143.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://asus.msn.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-AutocompletePro3_is1 - c:\program files (x86)\AutocompletePro\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_b427739.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va003]
"ImagePath"="\??\c:\users\Muhammed\AppData\Local\Temp\003F887.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ÀÞ*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\@÷-*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\ASUS\SmartLogon\smartlogon.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\AsScrPro.exe
c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\progra~2\Yzshadow\YzShadow.exe
c:\progra~2\VIRTUA~1\VIRTUA~1.EXE
c:\progra~2\ROCKET~1\ROCKET~1.EXE
c:\progra~2\VIRTUA~1\modules\WinList.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\program files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-10 15:16:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-01-10 14:16
.
Vor Suchlauf: 16 Verzeichnis(se), 61.873.238.016 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 61.465.399.296 Bytes frei
.
- - End Of File - - 316B5984C686314FEAB13C9B562457F9
|
|
10.01.2012, 16:00
| #14 |
| /// Selecta Jahrusso | Bundespolizei virus shell = explorer.exe Hy, Wie läuft der Rechner jetzt ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
11.01.2012, 14:07
| #15 |
| | Bundespolizei virus shell = explorer.exe Hi, viel besser! Ist der Virus nun entfernt? Er erscheint nicht mehr. |
|
| Themen zu Bundespolizei virus shell = explorer.exe |
| administrator, anderen, anti, benutzerkonto, daten, explorer.exe, infiziert, leute, manager, neue, neuen, programm, rechtsklick, scan, shell, starten, system32, temp, trojaner, trojanern, viren, virus, wichtig, win, win7 |
Textbox.
Linear-Darstellung
