![]() |
|
Plagegeister aller Art und deren Bekämpfung: Trojaner Befall, OTLP.exe runterladenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
| ![]() Trojaner Befall, OTLP.exe runterladen Liebe Helfer, ich habe das hier schon mehrfach beschriebene Problem, das mein Laptop sowohl im normalen als auch im abgesicherten Modus lediglich die Anzeige "Please wait while the connection is beeing established, Bitte warten Sie während die Verbindung hergestellt wird" anzeigt. Leider ist mir noch nicht so klar, was ich genau für eine CD an meinem zweiten PC brennen muss um den Fehler auszulesen. Können Sie mir hierzu bitte den Link zu der runterzuladenden Datei schicken? Vielen Dank Hallo, so den ersten Schritt habe ich hoffentlich geschafft. Ich hab die OTLP.exe heruntergeladen und den OTL ausgelesen. Ich hoffe, das war ok so? Kann mir jemand helfen? Vielen Dank OTL Logfile: Code:
ATTFilter OTL logfile created on: 3/25/2012 12:33:28 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 6.0.2900.2180) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 502.00 Mb Total Physical Memory | 309.00 Mb Available Physical Memory | 62.00% Memory free 454.00 Mb Paging File | 336.00 Mb Available in Paging File | 74.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37.25 Gb Total Space | 0.08 Gb Free Space | 0.20% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2005/10/28 02:41:52 | 000,491,520 | ---- | M] ( ) [On_Demand] -- C:\WINDOWS\System32\dlcfcoms.exe -- (dlcf_device) SRV - [2004/03/18 10:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2001/02/23 04:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (SYMIDSCO) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (mailKmd) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2006/10/04 22:42:42 | 000,002,560 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k) DRV - [2006/10/04 22:42:42 | 000,002,432 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp) DRV - [2006/02/06 15:19:54 | 008,410,880 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3) DRV - [2004/09/02 13:25:50 | 000,271,216 | ---- | M] (Zone Labs Inc.) [Kernel | System] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant) DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) DRV - [2004/06/10 20:00:00 | 000,016,384 | R--- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmunet.sys -- (AVMUNET) DRV - [2003/07/14 10:33:26 | 000,111,168 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x) DRV - [2003/04/23 03:10:12 | 000,033,335 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wa301a.sys -- ({E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}) DRV - [2003/03/21 15:07:46 | 002,390,528 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R) DRV - [2003/02/14 04:59:14 | 001,169,792 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2002/12/17 04:41:36 | 000,042,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp) DRV - [2002/11/28 11:04:48 | 000,025,600 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC) DRV - [2002/11/18 10:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3) DRV - [2002/11/07 13:48:00 | 000,030,208 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wbms.sys -- (WBMS) Winbond Memory Stick Storage (MS) DRV - [2002/10/29 08:25:54 | 000,008,843 | ---- | M] () [Kernel | System] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey) DRV - [2002/10/23 05:25:48 | 000,002,920 | ---- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\Wbutton.sys -- (Wbutton) DRV - [2002/08/28 17:59:26 | 000,154,624 | ---- | M] (Lucent Technologies) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wlluc48.sys -- (wlluc48) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Upgrade to Google Chrome IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = Google IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = GMX - E-Mail, FreeMail, De-Mail, Themen- & Shopping-Portal - kostenlos IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Upgrade to Google Chrome IE - HKU\Stefan_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant_bak = about:blank IE - HKU\Stefan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Stefan_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.in.tum.de:8080 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Programme\Google\Update\1.2.183.39\npGoogleOneClick8.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/03/04 05:16:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/05/06 05:38:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012/03/04 05:16:37 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012/03/04 05:16:20 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/03/04 05:16:20 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012/03/04 05:16:20 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012/03/04 05:16:20 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012/03/04 05:16:20 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012/03/04 05:16:20 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2002/08/29 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.) O2 - BHO: (no name) - {EEBA788A-C268-492A-B7FE-42C2B6C553D4} - No CLSID value found. O3 - HKU\Stefan_ON_C\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe () O4 - HKLM..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [CtrlVol] C:\Program Files\Launch Manager\ctrlvol.exe () O4 - HKLM..\Run: [datasysdisc] C:\WINDOWS\system32\spool.exe () O4 - HKLM..\Run: [DLCFCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.DLL () O4 - HKLM..\Run: [hostspoolx] C:\WINDOWS\System32\cryptspool.exe () O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [HP Software Update] C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP) O4 - HKLM..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe (Hewlett-Packard) O4 - HKLM..\Run: [HPHUPD05] C:\Programme\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe () O4 - HKLM..\Run: [K3aRyluP6SiCkoR] C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\PDFBackend.exe () O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe () O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe () O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe () O4 - HKLM..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs Inc.) O4 - HKU\Stefan_ON_C..\Run: [K3aRyluP6SiCkoR] C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O4 - HKU\Stefan_ON_C..\Run: [WheresJames Startup Manager] C:\Program Files\WheresJames\StartupMgr\StartupMgr.exe (WheresJames Software (WheresJames Software - Shareware and Freeware)) O4 - HKLM..\RunOnce: [MSAntiVirus] C:\WINDOWS\System32\spool.exe () O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\Stefan_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe) - C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe) - C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O20 - HKU\Stefan_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe) - C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O20 - HKU\Stefan_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe) - C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe () O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/01/22 07:21:41 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfserv.dll [2011/01/22 07:21:41 | 001,134,592 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfusb1.dll [2011/01/22 07:21:41 | 000,774,144 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfhbn3.dll [2011/01/22 07:21:41 | 000,638,976 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpmui.dll [2011/01/22 07:21:41 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfih.exe [2011/01/22 07:21:41 | 000,155,648 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfprox.dll [2011/01/22 07:21:41 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfpplc.dll [2011/01/22 07:21:40 | 000,704,512 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomc.dll [2011/01/22 07:21:40 | 000,491,520 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcoms.exe [2011/01/22 07:21:40 | 000,483,328 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcflmpm.dll [2011/01/22 07:21:40 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcomm.dll [2011/01/22 07:21:40 | 000,368,640 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcfcfg.exe [2006/12/02 08:25:46 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\vsnpstd3.dll [2006/12/02 08:25:44 | 000,147,456 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll [2006/12/02 08:25:44 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/03/25 05:22:06 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012/03/25 05:21:58 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/03/24 05:12:09 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/03/18 13:00:06 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/03/18 12:28:09 | 000,286,720 | ---- | M] () -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe [2012/03/18 11:37:23 | 000,000,107 | ---- | M] () -- C:\WINDOWS\ChssBase.ini [2012/03/18 11:36:04 | 000,000,890 | -H-- | M] () -- C:\WINDOWS\System32\vsconfig.xml [2012/03/17 05:36:00 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Daily.job [2012/02/25 11:45:27 | 000,002,495 | ---- | M] () -- C:\Dokumente und Einstellungen\Stefan\Desktop\Microsoft Word.lnk [2012/02/25 07:16:37 | 000,002,523 | ---- | M] () -- C:\Dokumente und Einstellungen\Stefan\Desktop\Microsoft Excel.lnk [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/03/18 12:28:38 | 000,286,720 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\flint4ytw.exe [2012/01/30 18:58:40 | 000,002,320 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\.recently-used.xbel [2011/05/23 15:27:16 | 000,000,432 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2011/05/23 15:25:20 | 000,000,065 | ---- | C] () -- C:\WINDOWS\System32\bd7030.dat [2011/05/23 15:24:34 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI [2011/05/23 15:20:03 | 000,031,664 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2011/03/19 08:55:15 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2011/01/22 07:21:41 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlcfvs.dll [2011/01/22 07:21:40 | 000,430,080 | ---- | C] () -- C:\WINDOWS\System32\dlcfutil.dll [2011/01/22 07:21:39 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsb.dll [2011/01/22 07:21:39 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\dlcfins.dll [2011/01/22 07:21:39 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\dlcfjswr.dll [2011/01/22 07:21:39 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dlcfinsr.dll [2011/01/22 07:21:39 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dlcfcub.dll [2011/01/22 07:21:39 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\dlcfcu.dll [2011/01/22 07:21:39 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dlcfcur.dll [2011/01/22 07:21:38 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\dlcfcfg.dll [2010/09/25 12:07:39 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2009/09/19 13:42:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009/06/28 12:24:27 | 000,019,861 | ---- | C] () -- C:\WINDOWS\HPHins02.dat.temp [2009/06/28 12:24:27 | 000,004,308 | ---- | C] () -- C:\WINDOWS\hphmdl02.dat.temp [2009/06/28 12:06:46 | 000,019,861 | ---- | C] () -- C:\WINDOWS\HPHins02.dat [2009/06/28 12:06:46 | 000,004,308 | ---- | C] () -- C:\WINDOWS\hphmdl02.dat [2009/06/28 12:05:42 | 000,364,544 | ---- | C] () -- C:\WINDOWS\System32\hphped05.exe [2009/06/28 12:05:15 | 000,006,478 | ---- | C] () -- C:\WINDOWS\System32\hphmon05.dat [2008/01/30 07:36:14 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\PUTTY.RND [2007/12/31 16:03:29 | 000,000,146 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006/12/02 08:25:54 | 000,339,968 | ---- | C] () -- C:\WINDOWS\vsnpstd3.exe [2006/12/02 08:25:54 | 000,094,208 | ---- | C] () -- C:\WINDOWS\tsnpstd3.exe [2006/12/02 08:25:54 | 000,020,480 | ---- | C] () -- C:\WINDOWS\CameraFixer.exe [2006/12/02 08:25:54 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini [2006/12/02 08:25:49 | 008,410,880 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys [2006/12/02 08:25:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\usnpstd3.exe [2006/01/04 12:24:22 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI [2006/01/03 12:52:04 | 000,015,428 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\RefEdit.exd [2005/11/13 11:15:35 | 000,000,107 | ---- | C] () -- C:\WINDOWS\ChssBase.ini [2005/04/03 14:49:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI [2005/02/09 14:50:10 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2005/02/02 08:06:32 | 000,001,364 | ---- | C] () -- C:\WINDOWS\bestplayer.ini [2004/11/21 10:11:49 | 000,046,056 | ---- | C] () -- C:\WINDOWS\System32\spool.exe [2004/11/21 10:11:49 | 000,046,056 | ---- | C] () -- C:\WINDOWS\System32\cryptspool.exe [2004/11/10 10:53:01 | 000,053,760 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2004/09/26 14:47:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ftpupd.exe [2004/09/23 18:57:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\hctsyk.exe [2004/09/23 14:30:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\zfuzsj.exe [2004/09/22 18:33:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\zqlcyc.exe [2004/09/20 19:23:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\auiddo.exe [2004/09/20 13:27:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\bcwagr.exe [2004/09/19 14:27:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\vsspoy.exe [2004/09/19 10:14:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\yoagcq.exe [2004/09/19 08:59:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\kjxvwf.exe [2004/09/19 08:17:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\btyphj.exe [2004/09/18 19:29:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ldlbos.exe [2004/09/18 10:37:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\xoniir.exe [2004/09/18 09:38:43 | 000,032,509 | ---- | C] () -- C:\WINDOWS\System32\datkkq32.dll [2004/09/18 08:02:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\phnkvt.exe [2004/09/18 05:49:32 | 000,006,657 | ---- | C] () -- C:\WINDOWS\System32\Emglhchg.dll [2004/09/17 17:44:30 | 000,000,327 | ---- | C] () -- C:\WINDOWS\alchem.ini [2004/09/17 13:17:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\sxwuhz.exe [2004/09/17 11:06:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\aiazxo.exe [2004/09/17 08:05:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\yijzqk.exe [2004/09/16 16:02:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\bbkccw.exe [2004/09/16 15:19:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\fhtuhy.exe [2004/09/14 12:49:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ebgdva.exe [2004/09/14 10:17:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\geoosc.exe [2004/09/14 09:29:56 | 000,008,846 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\gsview32.ini [2004/09/14 09:00:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\hanjow.exe [2004/09/14 08:42:01 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini [2004/09/14 07:51:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\stzdgz.exe [2004/09/13 13:44:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ddhnwk.exe [2004/09/13 10:06:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\whqlek.exe [2004/09/13 09:59:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\rroxpe.exe [2004/09/13 09:32:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\sqbjxm.exe [2004/09/13 08:37:52 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2004/09/11 16:46:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\lcuwhh.exe [2004/09/11 13:59:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\sdztiq.exe [2004/09/11 11:22:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\zpdlyr.exe [2004/09/11 10:19:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\phqghu.exe [2004/09/11 06:28:57 | 000,000,359 | ---- | C] () -- C:\WINDOWS\conscorr.ini [2004/09/11 06:28:04 | 000,000,045 | ---- | C] () -- C:\WINDOWS\GDFDMNGO.ini [2004/08/02 09:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/06/15 05:18:40 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2004/05/21 10:42:43 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Stefan\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2004/05/04 02:21:23 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/05/04 02:08:01 | 000,008,843 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys [2004/05/04 02:08:01 | 000,002,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\WBUTTON.sys [2004/05/04 02:07:43 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll [2004/05/04 02:07:38 | 000,001,052 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2002/09/17 00:40:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2002/09/17 00:38:41 | 000,196,960 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2002/09/17 00:33:29 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2002/09/17 00:30:04 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2002/09/16 23:57:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2002/09/16 23:48:55 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2002/09/16 14:22:23 | 000,407,550 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2002/09/16 14:22:23 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2002/09/16 14:22:23 | 000,071,856 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2002/09/16 14:22:23 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2002/09/16 14:21:53 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2002/09/16 14:21:47 | 000,394,412 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2002/09/16 14:21:47 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2002/09/16 14:21:46 | 000,059,660 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2002/09/16 14:21:46 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2002/09/16 14:21:45 | 000,004,678 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2002/09/16 14:21:44 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2002/09/16 14:21:41 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2002/09/16 14:21:31 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2002/09/16 14:21:31 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2002/09/16 14:21:16 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2002/09/16 14:21:04 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin ========== LOP Check ========== [2005/11/13 11:12:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\ChessBase [2012/01/06 07:07:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\gtk-2.0 [2004/11/02 21:19:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\Kazaa Lite [2007/04/18 07:19:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\Leadertech [2005/08/04 08:43:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\Setup [2011/08/23 04:33:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\Simfy [2010/10/16 06:37:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Stefan\Anwendungsdaten\TeamViewer [2007/01/18 12:57:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bin [2008/02/23 13:32:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ElsterFormular [2011/05/23 15:20:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft [2007/01/18 12:57:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tools ========== Purity Check ========== < End of report > |
Themen zu Trojaner Befall, OTLP.exe runterladen |
0x00000001, abgesicherte, abgesicherten, anzeige, askbar, befall, bitte warten, brennen, connection, datei, disabletaskmgr, fehler, freemail, helfer, hergestellt, hotkey.sys, laptop, launch, liebe, link, mehrfach, modus, nodrives, normale, normalen, please, please wait, plug-in, problem, runterladen, schicke, schicken, troja, trojaner, trojaner otlp, verbindung, version=1.0 |