| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein ZugriffWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.04.2012, 14:58
| #1 | |
| |  Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Hallo Leute ich habe das gleiche Problem wie andere User hier auch, mein Hintergrund ist auf einmal schwarz geworden meine Symbole sind weg es kamen ungefähr 30 Systemwarnungen mit " System Message-Write Fault Error" und S.M.A.R.T. HDD hat sich geöffnet. Habe "unhide" schon geladen es kommt aber leider nicht alles wieder, Daten auf der 2ten Partition sind immer noch "versteckt" schnellstartleiste fehlt und Verknüpfungen fehlen. Malwarebytes hab ich geladen und hier ist die Log. Zitat:
Hoffe ihr könnt mir helfen. MfG Chris Edit: So jetzt hats geklappt mit dem OTL, hier die Log: OTL Logfile: Code:
ATTFilter OTL logfile created on: 08.04.2012 00:48:44 - Run 1 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Christoph\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,90 Gb Available Physical Memory | 45,40% Memory free 3,98 Gb Paging File | 2,62 Gb Available in Paging File | 65,72% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 69,77 Gb Total Space | 25,07 Gb Free Space | 35,93% Space Free | Partition Type: NTFS Drive D: | 69,52 Gb Total Space | 54,50 Gb Free Space | 78,40% Space Free | Partition Type: NTFS Computer Name: ACER | User Name: Christoph | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.04.03 22:03:32 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Downloads\OTL.exe PRC - [2012.03.16 19:19:31 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.01.13 14:53:16 | 000,981,680 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe PRC - [2011.11.01 16:40:04 | 001,053,056 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe PRC - [2011.10.27 11:34:30 | 000,718,384 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe PRC - [2011.10.27 11:33:58 | 000,173,104 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe PRC - [2011.10.27 11:33:32 | 000,148,016 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe PRC - [2011.10.11 15:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.07.15 17:10:16 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe PRC - [2011.07.15 17:06:56 | 001,526,592 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe ========== Modules (No Company Name) ========== MOD - [2012.03.16 19:19:30 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.02.17 17:35:42 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2011.11.01 16:42:14 | 000,392,064 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\ssoengine.dll MOD - [2011.11.01 16:42:12 | 000,058,240 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\securestorage.dll MOD - [2011.11.01 16:42:08 | 000,095,104 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\qjson.dll MOD - [2011.11.01 16:42:06 | 000,272,768 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\phonon4.dll MOD - [2011.11.01 16:41:38 | 000,165,248 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QxtWeb.dll MOD - [2011.11.01 16:41:36 | 000,384,896 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QxtCore.dll MOD - [2011.11.01 16:41:34 | 002,557,312 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtXmlPatterns4.dll MOD - [2011.11.01 16:41:32 | 000,346,496 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtXml4.dll MOD - [2011.11.01 16:41:30 | 010,843,520 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtWebKit4.dll MOD - [2011.11.01 16:41:24 | 000,196,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtSql4.dll MOD - [2011.11.01 16:41:22 | 001,294,208 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtScript4.dll MOD - [2011.11.01 16:41:20 | 000,682,880 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtOpenGL4.dll MOD - [2011.11.01 16:41:18 | 000,919,936 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtNetwork4.dll MOD - [2011.11.01 16:41:16 | 000,517,504 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtMultimediaKit1.dll MOD - [2011.11.01 16:41:14 | 008,172,928 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtGui4.dll MOD - [2011.11.01 16:41:12 | 002,252,672 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtDeclarative4.dll MOD - [2011.11.01 16:41:10 | 002,288,512 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\QtCore4.dll MOD - [2011.11.01 16:41:06 | 000,422,272 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll MOD - [2011.11.01 16:40:56 | 000,202,624 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\Imageformats\qjpeg4.dll MOD - [2011.11.01 16:40:54 | 000,034,688 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\Imageformats\qico4.dll MOD - [2011.11.01 16:40:52 | 000,032,640 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\Imageformats\qgif4.dll MOD - [2011.11.01 16:40:08 | 000,388,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\OviShareLib.dll MOD - [2011.11.01 16:40:00 | 000,438,144 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\NService.dll MOD - [2011.11.01 16:39:36 | 001,041,792 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\Maps Service API.dll MOD - [2011.11.01 16:39:06 | 000,740,736 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\CommonUpdateChecker.dll MOD - [2011.11.01 15:57:42 | 000,112,640 | ---- | M] () -- C:\Programme\Nokia\Nokia Suite\mediaservice\dsengine.dll ========== Win32 Services (SafeList) ========== SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.10.27 11:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.15 17:06:56 | 001,526,592 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.07.15 17:01:04 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp) SRV - [2009.07.14 03:16:19 | 000,348,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2006.10.26 20:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Unknown] -- -- (aau06ix7) DRV - [2012.04.08 00:47:41 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2012.02.15 17:30:51 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.08.17 13:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2011.08.17 13:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2011.08.17 13:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2011.08.17 13:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2011.04.26 15:30:20 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.03.05 23:30:23 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.14 00:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008.08.26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9B 8B FF 22 A4 BC CA 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.8.0191 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.8 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.3.6 FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.6.3 FF - prefs.js..extensions.enabledItems: bug489729@alice0775:1.3 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.4 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..extensions.enabledItems: fe_3.6@nokia.com:1.7.56.205 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30 FF - prefs.js..extensions.enabledItems: mail@gutscheinrausch.de:2.81 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_3.6@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_3.6 [2011.12.13 16:02:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.12 08:58:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.16 19:19:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.04 12:45:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_7.0@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.12.13 16:02:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\extensions\mail@gutscheinrausch.de [2011.12.23 16:09:10 | 000,000,000 | ---D | M] [2010.03.05 22:58:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions [2012.03.30 15:00:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions [2012.03.30 15:00:32 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.01.06 19:06:56 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2012.02.04 12:46:23 | 000,000,000 | ---D | M] ("bug489729") -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\bug489729@alice0775 [2011.07.16 17:17:05 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\DTToolbar@toolbarnet.com [2011.12.23 16:09:10 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\mail@gutscheinrausch.de [2011.07.16 17:16:57 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\9f502wmy.default\extensions\personas@christopher.beard [2012.02.24 09:48:37 | 000,000,933 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\11-suche.xml [2012.02.24 09:48:37 | 000,002,419 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\englische-ergebnisse.xml [2012.02.24 09:48:37 | 000,010,525 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\gmx-suche.xml [2012.04.01 22:15:54 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-1.xml [2011.10.01 15:04:07 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-10.xml [2011.11.16 12:10:49 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-11.xml [2011.03.03 11:32:49 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-2.xml [2011.03.07 22:45:01 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-3.xml [2011.04.26 08:25:30 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-4.xml [2011.05.03 10:33:59 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-5.xml [2011.07.09 17:49:35 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-6.xml [2011.08.18 22:02:11 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-7.xml [2011.09.03 14:38:56 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-8.xml [2011.09.09 07:52:05 | 000,000,950 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin-9.xml [2010.12.10 16:25:44 | 000,001,056 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\icqplugin.xml [2012.02.24 09:48:37 | 000,002,457 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\lastminute.xml [2012.02.24 09:48:37 | 000,005,508 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\9f502wmy.default\searchplugins\webde-suche.xml [2012.02.04 12:45:42 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9F502WMY.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI () (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9F502WMY.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI () (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9F502WMY.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI () (No name found) -- C:\USERS\CHRISTOPH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9F502WMY.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI [2012.03.16 19:19:31 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.01.29 16:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.29 15:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.01.29 16:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.01.29 16:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.29 16:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.29 16:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.11.16 23:31:16 | 000,001,000 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found. O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87F53D0E-4D54-4E68-8874-31911569186E}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD267A6E-EDC2-4D73-B319-BD43CAB03F9D}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - igfxdev.dll (Intel Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{e286da6d-391c-11df-9767-001b38778618}\Shell - "" = AutoRun O33 - MountPoints2\{e286da6d-391c-11df-9767-001b38778618}\Shell\AutoRun\command - "" = C:\Windows\explorer.exe -- [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = C:\Windows\explorer.exe -- [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.04.07 03:08:35 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2012.04.07 03:08:34 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2012.04.07 03:08:34 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.04.07 03:08:33 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.04.07 03:08:33 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2012.04.07 03:08:33 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2012.04.07 03:08:33 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2012.04.07 03:08:33 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2012.04.07 03:08:33 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2012.04.07 03:08:33 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2012.04.07 03:08:33 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2012.04.07 03:08:33 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2012.04.07 03:08:30 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2012.04.07 03:08:30 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2012.04.07 03:08:30 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2012.04.07 03:08:29 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2012.04.07 03:08:29 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2012.04.07 03:08:29 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.04.07 03:08:29 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2012.04.07 03:08:29 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2012.04.07 03:08:29 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2012.04.07 03:08:28 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.04.07 03:08:28 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2012.04.07 03:08:28 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2012.04.07 03:08:28 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2012.04.07 03:08:27 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.04.07 03:08:27 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2012.04.07 03:08:27 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2012.04.07 03:08:24 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.04.07 03:08:24 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2012.04.07 03:08:24 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2012.04.07 03:08:24 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.04.07 03:08:24 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2012.04.07 03:08:24 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2012.04.07 03:08:23 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.04.07 03:08:23 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2012.04.07 03:08:23 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2012.04.07 03:06:32 | 001,619,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL [2012.04.07 03:06:31 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll [2012.04.07 03:06:31 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2012.04.07 03:06:31 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2012.04.07 03:06:31 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2012.04.07 03:06:31 | 000,283,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2012.04.07 03:06:31 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2012.04.07 03:06:31 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2012.04.07 03:06:31 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2012.04.07 03:06:30 | 003,181,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2012.04.07 03:06:30 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2012.04.07 03:06:30 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll [2012.04.07 03:04:54 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [2012.04.07 03:04:34 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys [2012.04.07 03:03:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2012.04.07 03:01:45 | 003,957,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2012.04.07 03:01:42 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2012.04.07 02:54:24 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys [2012.04.07 02:54:24 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2012.04.03 22:13:15 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.04.03 22:03:24 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe [2012.04.03 21:49:29 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Malwarebytes [2012.04.03 21:48:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.04.03 21:48:57 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.04.03 21:48:56 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.04.03 21:46:22 | 000,389,024 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Christoph\Desktop\unhide.exe [2012.04.03 18:07:54 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2012.04.03 18:07:54 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2012.04.03 17:57:41 | 000,398,336 | ---- | C] (Intel(R) Corporation) -- C:\Windows\System32\TVWizudlg.exe [2012.04.03 17:57:41 | 000,000,000 | ---D | C] -- C:\Windows\System32\Lang [2012.04.03 17:57:38 | 000,000,000 | ---D | C] -- C:\Program Files\Intel [2012.04.03 16:48:19 | 001,002,008 | ---- | C] (Intel Corporation) -- C:\Windows\System32\igxpun.exe [2012.04.03 16:48:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\x64 [2012.04.03 16:44:56 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2012.04.03 16:44:56 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll [2012.04.03 16:44:56 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe [2012.04.03 16:44:46 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll [2012.04.01 22:19:57 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD ========== Files - Modified Within 30 Days ========== [2012.04.08 00:47:41 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.04.07 03:33:50 | 000,014,016 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.04.07 03:33:50 | 000,014,016 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.04.07 03:33:47 | 000,643,866 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.04.07 03:33:47 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.04.07 03:33:47 | 000,126,394 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.04.07 03:33:47 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.04.07 03:28:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.04.07 03:27:58 | 1602,797,568 | -HS- | M] () -- C:\hiberfil.sys [2012.04.07 03:08:35 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2012.04.07 03:08:34 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2012.04.07 03:08:34 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.04.07 03:08:33 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.04.07 03:08:33 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2012.04.07 03:08:33 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2012.04.07 03:08:33 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2012.04.07 03:08:33 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2012.04.07 03:08:33 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2012.04.07 03:08:33 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2012.04.07 03:08:33 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2012.04.07 03:08:33 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2012.04.07 03:08:31 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2012.04.07 03:08:30 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2012.04.07 03:08:30 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2012.04.07 03:08:30 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2012.04.07 03:08:29 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2012.04.07 03:08:29 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.04.07 03:08:29 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2012.04.07 03:08:29 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2012.04.07 03:08:29 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2012.04.07 03:08:29 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2012.04.07 03:08:28 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.04.07 03:08:28 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2012.04.07 03:08:28 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2012.04.07 03:08:28 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2012.04.07 03:08:28 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2012.04.07 03:08:27 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.04.07 03:08:27 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2012.04.07 03:08:25 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.04.07 03:08:24 | 001,798,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.04.07 03:08:24 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2012.04.07 03:08:24 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2012.04.07 03:08:24 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.04.07 03:08:24 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2012.04.07 03:08:24 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2012.04.07 03:08:23 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2012.04.07 03:08:23 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2012.04.07 03:06:32 | 001,619,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL [2012.04.07 03:06:31 | 001,495,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll [2012.04.07 03:06:31 | 001,170,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2012.04.07 03:06:31 | 001,074,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2012.04.07 03:06:31 | 000,739,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2012.04.07 03:06:31 | 000,283,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2012.04.07 03:06:31 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2012.04.07 03:06:31 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2012.04.07 03:06:31 | 000,135,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2012.04.07 03:06:30 | 003,181,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2012.04.07 03:06:30 | 000,442,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2012.04.07 03:06:30 | 000,196,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll [2012.04.03 23:09:12 | 179,504,553 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.04.03 22:03:32 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe [2012.04.03 21:46:25 | 000,389,024 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Christoph\Desktop\unhide.exe [2012.04.03 11:29:16 | 000,000,168 | ---- | M] () -- C:\ProgramData\-kHgcl9l0j4347Jr [2012.04.03 11:29:16 | 000,000,000 | ---- | M] () -- C:\ProgramData\-kHgcl9l0j4347J [2012.04.03 11:28:42 | 000,000,256 | ---- | M] () -- C:\ProgramData\kHgcl9l0j4347J [2012.04.01 22:19:58 | 000,000,647 | ---- | M] () -- C:\Users\Christoph\Desktop\SMART_HDD.lnk ========== Files Created - No Company Name ========== [2012.04.07 03:08:29 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2012.04.03 22:18:05 | 179,504,553 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.04.03 17:57:41 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll [2012.04.03 17:57:41 | 000,121,232 | ---- | C] () -- C:\Windows\System32\IScrNB.bmp [2012.04.03 11:29:16 | 000,000,168 | ---- | C] () -- C:\ProgramData\-kHgcl9l0j4347Jr [2012.04.03 11:29:15 | 000,000,000 | ---- | C] () -- C:\ProgramData\-kHgcl9l0j4347J [2012.04.01 22:19:58 | 000,000,647 | ---- | C] () -- C:\Users\Christoph\Desktop\SMART_HDD.lnk [2012.04.01 22:19:54 | 000,000,256 | ---- | C] () -- C:\ProgramData\kHgcl9l0j4347J [2011.12.23 16:09:08 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll < End of report > |
|
07.04.2012, 19:52
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
__________________Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ |
|
08.04.2012, 08:59
| #3 | |
| | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Oh der OTL Log ist falsch, hatte Ihn ohne das script laufen lassen. Sobald ich ihn mit script laufen lasse stüzt OTL am ende ab und sagt mir das ich zu wenig Speicher habe.... wie kann ich das ändern?
__________________Das hier ist der einzige frühere LOG von Malwarebytes: Zitat:
|
|
08.04.2012, 16:51
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
10.04.2012, 12:49
| #5 |
| | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein ZugriffCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=5d3fd0b9146eac46b08aeb8e9625faf1
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-09 12:14:43
# local_time=2012-04-09 02:14:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1792 16777215 100 0 14775516 14775516 0 0
# compatibility_mode=4864 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 0 86403704 0 0
# compatibility_mode=8192 67108863 100 0 140 140 0 0
# scanned=278289
# found=0
# cleaned=0
# scan_time=8722
|
|
10.04.2012, 14:21
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Was ist mit dem Vollscan mit Malwarebytes?
__________________ --> Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff |
|
13.04.2012, 18:22
| #7 |
| | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein ZugriffCode:
ATTFilter Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.04.13.06 Windows 7 x86 NTFS Internet Explorer 9.0.8112.16421 Christoph :: ACER [Administrator] Schutz: Deaktiviert 13.04.2012 18:33:34 mbam-log-2012-04-13 (19-21-08).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 325948 Laufzeit: 40 Minute(n), 7 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Windows.old\Users\Christoph\AppData\Local\Temp\Rar$EX00.830\IsoBuster.Pro.2.6.0.0.FinalMultiLang_www.dl4all.com\Keygen.EXE (Trojan.Downloader) -> Keine Aktion durchgeführt. (Ende) Den einen Befall habe ich nun entfernt! |
|
14.04.2012, 19:47
| #8 |
| | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff Also den einen Befall den Malware angezeigt hat. |
|
15.04.2012, 15:48
| #9 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein ZugriffZitat:
Siehe auch => http://www.trojaner-board.de/95393-c...-software.html Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden. Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!! Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein! In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Smart HDD, TRAgent 299008.37, schwarzer Hintergrund, kein Zugriff |
| acer, adblock, administrator, anti-malware, autostart, dateien, dateisystem, daten, error, explorer, gen, heuristiks/extra, heuristiks/shuriken, hintergrund, kein zugriff, langs, laptop, leute, minute, partition, plug-in, problem, registrierung, s.m.a.r.t., schnellstartleiste, schwarz, searchscopes, smart, speicher, symbole, systemwarnungen, test, tragent, version, zugriff |
Linear-Darstellung
