Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
itunes_service01.exe

itunes_service01.exe


Plagegeister aller Art und deren Bekämpfung: itunes_service01.exe

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 05.05.2012, 11:28   #1
seppdepp56
 
itunes_service01.exe - Standard

itunes_service01.exe


Hallo Zusammen

Habe mir den Trojaner "itunes_service01.exe" eingefangen. Wäre es jemandem von Euch möglich, mir zu sagen, was ich in fix.txt eingeben muss, um dies mit OTLPENet zu beheben? Für Eure Hilfe wäre ich Euch sehr dankbar!

Anbei der Log:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 5/5/2012 12:41:53 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\Windows | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.77 Mb Free Space | 75.77% Space Free | Partition Type: NTFS
Drive D: | 1863.01 Gb Total Space | 0.14 Gb Free Space | 0.01% Space Free | Partition Type: NTFS
Drive E: | 763.78 Mb Total Space | 761.02 Mb Free Space | 99.64% Space Free | Partition Type: FAT
Drive F: | 465.66 Gb Total Space | 13.40 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012/04/05 22:16:02 | 000,236,544 | ---- | M] (AMD) [Auto] -- F:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- F:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012/02/16 16:49:19 | 000,076,888 | ---- | M] () [Auto] -- F:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/11/12 06:12:47 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- F:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/11/09 15:05:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- F:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2011/07/01 12:41:16 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- F:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- F:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/29 12:19:23 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- F:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/03/01 12:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand] -- F:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2010/12/28 04:00:34 | 001,296,728 | ---- | M] (www.BitComet.com) [On_Demand] -- F:\Program Files (x86)\BitComet\tools\BitCometService.exe -- (BITCOMET_HELPER_SERVICE)
SRV - [2010/11/29 05:41:26 | 000,058,944 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- F:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- F:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/28 09:33:01 | 000,096,896 | R--- | M] (ASUSTeK Computer Inc.) [Auto] -- F:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- F:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2005/02/09 05:59:00 | 000,014,165 | ---- | M] (Pinnacle Systems GmbH) [Auto] -- F:\Windows\SysWOW64\drivers\Pclepci.sys -- (PCLEPCI)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/04/06 01:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/04/05 21:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/02/23 08:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- F:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012/02/15 06:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/08/02 11:38:44 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2011/07/01 12:41:16 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- F:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/01 12:41:16 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- F:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/06/10 01:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- F:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/05/07 12:51:32 | 000,454,232 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- F:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV:64bit: - [2010/11/25 01:59:16 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- F:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/09/07 08:27:24 | 000,038,912 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- F:\Windows\System32\drivers\PcaSp60.sys -- (PcaSp60)
DRV:64bit: - [2010/05/15 07:11:48 | 001,327,520 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009/07/15 23:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand] -- F:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- F:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- F:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/02/24 13:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\mcdbus.sys -- (mcdbus)
DRV:64bit: - [2007/08/31 08:15:34 | 000,079,872 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\emAudio64.sys -- (emAudio)
DRV:64bit: - [2007/06/21 11:51:46 | 000,215,808 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\emDevice64.sys -- (DCamUSBEMPIA)
DRV:64bit: - [2007/06/21 11:51:32 | 000,006,400 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\emFilter64.sys -- (FiltUSBEMPIA)
DRV:64bit: - [2007/06/21 11:51:30 | 000,006,144 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand] -- F:\Windows\System32\drivers\emScan64.sys -- (ScanUSBEMPIA)
DRV:64bit: - [2005/09/23 17:18:34 | 000,261,120 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand] -- F:\Windows\System32\drivers\MarvinBus64.sys -- (MarvinBus)
DRV - [2010/09/07 08:27:24 | 000,038,912 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- F:\Windows\SysWOW64\drivers\PcaSp60.sys -- (PcaSp60)
DRV - [2009/02/24 13:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand] -- F:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Flo_Desktop\Desktop
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B4 F8 4D A6 26 47 CC 01  [binary data]
IE - HKU\Flo_Desktop_ON_F\..\URLSearchHook: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - Reg Error: Key error. File not found
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Flo_Desktop_ON_F\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: F:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@checkpoint.com/FFApi:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: F:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.104.0:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.116.0: F:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.118.0: F:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: F:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nosltd.com/getPlus+(R),version=1.6.2.97: F:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: F:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: F:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: F:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
 
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - F:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - F:\Program Files (x86)\Google\Chrome Frame\Application\18.0.1025.168\npchrome_frame.dll (Google Inc.)
O3 - HKU\Flo_Desktop_ON_F\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [AMD AVT] F:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] F:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] F:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [d31ybB8YFv9cUxg] F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] F:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HDAudDeck] F:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [StartCCC] F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm] F:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKU\Flo_Desktop_ON_F..\Run: [d31ybB8YFv9cUxg] F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O4 - HKU\Flo_Desktop_ON_F..\Run: [HydraVisionDesktopManager] F:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKU\Flo_Desktop_ON_F..\Run: [LaunchList] F:\Program Files (x86)\Pinnacle\Studio 11\LaunchList2.exe (Pinnacle Systems)
O4 - HKU\LocalService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_F..\Run: [Sidebar] F:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Flo_Desktop_ON_F..\RunOnce: [Application Restart #1] F:\Program Files (x86)\Google\Chrome Frame\Application\chrome.exe (Google Inc.)
O4 - HKU\LocalService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_F..\RunOnce: [mctadmin]  File not found
O4 - Startup: F:\Users\Flo_Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: F:\Users\Flo_Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - F:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - F:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {9101C0BA-5749-468F-B384-E00AF57C6EBA} https://www.usmshop.com/vusm/plugin/plugin/npvusm-5.3.cab (Perspectix P'X5 Configurator (vUSM))
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 62.2.17.61 62.2.24.158
O18:64bit: - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - F:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - F:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Flo_Desktop_ON_F Winlogon: Shell - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O20 - HKU\Flo_Desktop_ON_F Winlogon: UserInit - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/08/22 06:41:34 | 000,000,107 | ---- | M] () - F:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{2c9fa705-1c84-11e0-9547-20cf30e83136}\Shell - "" = AutoRun
O33 - MountPoints2\{2c9fa705-1c84-11e0-9547-20cf30e83136}\Shell\AutoRun\command - "" = F:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/05 06:09:16 | 000,000,000 | ---D | C] -- F:\FRST
[2012/04/29 15:02:34 | 000,000,000 | ---D | C] -- F:\Users\Flo_Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012/04/29 15:02:24 | 000,000,000 | ---D | C] -- F:\ProgramData\ATI
[2012/04/29 15:01:51 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\AMD AVT
[2012/04/29 15:01:43 | 000,000,000 | ---D | C] -- F:\Program Files (x86)\AMD APP
[2012/04/29 15:01:29 | 000,000,000 | ---D | C] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012/04/29 15:00:23 | 000,000,000 | -HSD | C] -- F:\Config.Msi
[2012/04/22 16:57:44 | 000,000,000 | -H-D | C] -- F:\Users\Flo_Desktop\Documents\Freemake_do_not_remove_this_folder634707322646010282
[2012/04/16 04:02:18 | 000,000,000 | -H-D | C] -- F:\Users\Flo_Desktop\Documents\Freemake_do_not_remove_this_folder
[2012/04/11 21:01:56 | 000,096,256 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\mshtmled.dll
[2012/04/11 21:01:56 | 000,072,704 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\mshtmled.dll
[2012/04/11 21:01:55 | 002,311,168 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\jscript9.dll
[2012/04/11 21:01:55 | 001,799,168 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\jscript9.dll
[2012/04/11 21:01:55 | 000,716,800 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\jscript.dll
[2012/04/11 21:01:55 | 000,248,320 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ieui.dll
[2012/04/11 21:01:55 | 000,237,056 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\url.dll
[2012/04/11 21:01:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\url.dll
[2012/04/11 21:01:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ieui.dll
[2012/04/11 21:01:54 | 001,493,504 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\inetcpl.cpl
[2012/04/11 21:01:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\inetcpl.cpl
[2012/04/11 21:01:54 | 000,818,688 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\jscript.dll
[2012/04/11 21:01:44 | 005,559,152 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\ntoskrnl.exe
[2012/04/11 21:01:44 | 003,968,368 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ntkrnlpa.exe
[2012/04/11 21:01:43 | 003,913,072 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\ntoskrnl.exe
[2012/04/11 21:00:19 | 000,023,408 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\drivers\fs_rec.sys
[2012/04/11 21:00:18 | 000,220,672 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\wintrust.dll
[2012/04/11 21:00:18 | 000,172,544 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\wintrust.dll
[2012/04/11 21:00:18 | 000,159,232 | ---- | C] (Microsoft Corporation) -- F:\Windows\SysWow64\imagehlp.dll
[2012/04/11 21:00:18 | 000,081,408 | ---- | C] (Microsoft Corporation) -- F:\Windows\System32\imagehlp.dll
[2012/04/08 04:53:06 | 000,000,000 | ---D | C] -- F:\Users\Flo_Desktop\Desktop\arma 2 deinstallation april 2012 restliche files
[2012/04/06 01:22:40 | 011,174,400 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\atikmdag.sys
[2012/04/05 22:22:00 | 000,159,744 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\atiapfxx.exe
[2012/04/05 22:16:52 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\ATIDEMGX.dll
[2012/04/05 22:16:46 | 000,503,808 | ---- | C] (AMD) -- F:\Windows\System32\atieclxx.exe
[2012/04/05 22:16:02 | 000,236,544 | ---- | C] (AMD) -- F:\Windows\System32\atiesrxx.exe
[2012/04/05 22:14:44 | 000,120,320 | ---- | C] (AMD) -- F:\Windows\System32\atitmm64.dll
[2012/04/05 22:14:30 | 000,021,504 | ---- | C] (AMD) -- F:\Windows\System32\atimuixx.dll
[2012/04/05 22:14:26 | 000,059,392 | ---- | C] (ATI Technologies, Inc.) -- F:\Windows\System32\atiedu64.dll
[2012/04/05 22:14:20 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- F:\Windows\SysWow64\ati2edxx.dll
[2012/04/05 22:13:42 | 006,800,896 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atidxx32.dll
[2012/04/05 22:10:50 | 026,181,632 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\atio6axx.dll
[2012/04/05 21:50:56 | 019,753,984 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\SysWow64\atioglxx.dll
[2012/04/05 21:35:24 | 001,120,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd6v.dll
[2012/04/05 21:34:50 | 001,831,424 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiumdmv.dll
[2012/04/05 21:34:34 | 004,731,904 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd6a.dll
[2012/04/05 21:30:16 | 000,051,200 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticalrt64.dll
[2012/04/05 21:30:14 | 000,046,080 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticalrt.dll
[2012/04/05 21:30:08 | 000,044,544 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticalcl64.dll
[2012/04/05 21:30:06 | 000,044,032 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticalcl.dll
[2012/04/05 21:29:54 | 016,090,624 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticaldd64.dll
[2012/04/05 21:25:30 | 013,764,096 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticaldd.dll
[2012/04/05 21:23:24 | 007,431,680 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd64.dll
[2012/04/05 21:11:20 | 000,360,448 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\SysWow64\atiadlxy.dll
[2012/04/05 21:11:06 | 000,017,408 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atig6pxx.dll
[2012/04/05 21:11:04 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiglpxx.dll
[2012/04/05 21:11:04 | 000,014,848 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiglpxx.dll
[2012/04/05 21:11:00 | 000,041,984 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atig6txx.dll
[2012/04/05 21:10:52 | 000,033,280 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atigktxx.dll
[2012/04/05 21:10:44 | 000,343,040 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\atikmpag.sys
[2012/04/05 21:09:48 | 000,041,984 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiuxpag.dll
[2012/04/05 21:09:42 | 000,044,544 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiu9p64.dll
[2012/04/05 21:09:02 | 000,053,248 | ---- | C] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\ati2erec.dll
[2012/04/05 21:06:08 | 000,054,784 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atimpc64.dll
[2012/04/05 21:06:08 | 000,054,784 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\amdpcom64.dll
[2012/04/05 21:06:04 | 000,053,760 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atimpc32.dll
[2012/04/05 21:06:04 | 000,053,760 | ---- | C] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\amdpcom32.dll
[2012/04/05 16:34:10 | 000,074,752 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\OpenVideo64.dll
[2012/04/05 16:34:04 | 000,064,512 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\OpenVideo.dll
[2012/04/05 16:33:56 | 000,063,488 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\OVDecode64.dll
[2012/04/05 16:33:52 | 000,056,320 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\OVDecode.dll
[2012/04/05 16:33:44 | 016,457,216 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\System32\amdocl64.dll
[2012/04/05 16:32:56 | 013,007,872 | ---- | C] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\amdocl.dll
[2 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\System32\drivers\*.tmp files -> F:\Windows\System32\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/05 05:26:53 | 000,067,584 | --S- | M] () -- F:\Windows\bootstat.dat
[2012/05/05 05:26:27 | 3214,188,544 | -HS- | M] () -- F:\hiberfil.sys
[2012/05/05 05:22:20 | 000,018,864 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/05 05:22:20 | 000,018,864 | -H-- | M] () -- F:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/05 05:15:04 | 000,001,116 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/05 04:31:00 | 000,001,120 | ---- | M] () -- F:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/04 18:32:27 | 000,654,150 | ---- | M] () -- F:\Windows\System32\perfh007.dat
[2012/05/04 18:32:27 | 000,616,032 | ---- | M] () -- F:\Windows\System32\perfh009.dat
[2012/05/04 18:32:27 | 000,130,022 | ---- | M] () -- F:\Windows\System32\perfc007.dat
[2012/05/04 18:32:27 | 000,106,412 | ---- | M] () -- F:\Windows\System32\perfc009.dat
[2012/05/04 18:26:01 | 000,268,800 | ---- | M] () -- F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe
[2012/04/30 12:47:27 | 000,283,304 | ---- | M] () -- F:\Windows\SysWow64\PnkBstrB.xtr
[2012/04/30 12:47:27 | 000,283,304 | ---- | M] () -- F:\Windows\SysWow64\PnkBstrB.exe
[2012/04/30 12:47:12 | 000,280,904 | ---- | M] () -- F:\Windows\SysWow64\PnkBstrB.ex0
[2012/04/29 15:01:49 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/04/29 15:01:29 | 000,000,000 | ---D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012/04/23 13:08:37 | 000,155,263 | ---- | M] () -- F:\Users\Flo_Desktop\Desktop\Hamlet.pdf
[2012/04/22 12:54:21 | 291,468,273 | ---- | M] () -- F:\Users\Flo_Desktop\Desktop\sternstundephilosophie_20120422_110121_vpodcast_h264_16zu9_mq1.m4v
[2012/04/21 03:45:28 | 000,100,616 | -H-- | M] () -- F:\Windows\SysWow64\mlfcache.dat
[2012/04/16 04:03:02 | 000,136,858 | ---- | M] () -- F:\Users\Flo_Desktop\Desktop\Merkblatt_NIV.pdf
[2012/04/16 03:57:59 | 000,032,324 | ---- | M] () -- F:\Users\Flo_Desktop\Desktop\Kundeninformationen_zur_periodischen_Sicherheitskontrolle4.pdf
[2012/04/15 05:42:04 | 000,978,069 | ---- | M] () -- F:\Users\Flo_Desktop\Desktop\kontrovers-0801.pdf
[2012/04/08 12:46:57 | 000,395,058 | ---- | M] () -- 
F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eidos
[2012/04/08 04:49:05 | 000,000,000 | R--D | M] -- F:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/04/06 01:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\atikmdag.sys
[2012/04/05 22:23:06 | 000,245,896 | ---- | M] () -- F:\Windows\SysWow64\atiapfxx.blb
[2012/04/05 22:23:06 | 000,245,896 | ---- | M] () -- F:\Windows\System32\atiapfxx.blb
[2012/04/05 22:22:00 | 000,159,744 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\atiapfxx.exe
[2012/04/05 22:21:52 | 000,909,312 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\aticfx32.dll
[2012/04/05 22:20:04 | 001,067,520 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\aticfx64.dll
[2012/04/05 22:16:52 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\ATIDEMGX.dll
[2012/04/05 22:16:46 | 000,503,808 | ---- | M] (AMD) -- F:\Windows\System32\atieclxx.exe
[2012/04/05 22:16:02 | 000,236,544 | ---- | M] (AMD) -- F:\Windows\System32\atiesrxx.exe
[2012/04/05 22:14:44 | 000,120,320 | ---- | M] (AMD) -- F:\Windows\System32\atitmm64.dll
[2012/04/05 22:14:30 | 000,021,504 | ---- | M] (AMD) -- F:\Windows\System32\atimuixx.dll
[2012/04/05 22:14:26 | 000,059,392 | ---- | M] (ATI Technologies, Inc.) -- F:\Windows\System32\atiedu64.dll
[2012/04/05 22:14:20 | 000,043,520 | ---- | M] (ATI Technologies, Inc.) -- F:\Windows\SysWow64\ati2edxx.dll
[2012/04/05 22:13:42 | 006,800,896 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atidxx32.dll
[2012/04/05 22:10:50 | 026,181,632 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\atio6axx.dll
[2012/04/05 22:00:10 | 000,064,000 | ---- | M] (AMD) -- F:\Windows\System32\coinst.dll
[2012/04/05 21:54:46 | 007,479,296 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atidxx64.dll
[2012/04/05 21:50:56 | 019,753,984 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\SysWow64\atioglxx.dll
[2012/04/05 21:35:24 | 001,120,768 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd6v.dll
[2012/04/05 21:34:50 | 001,831,424 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiumdmv.dll
[2012/04/05 21:34:34 | 004,731,904 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd6a.dll
[2012/04/05 21:34:04 | 006,203,392 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiumdag.dll
[2012/04/05 21:30:16 | 000,051,200 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticalrt64.dll
[2012/04/05 21:30:14 | 000,046,080 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticalrt.dll
[2012/04/05 21:30:08 | 000,044,544 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticalcl64.dll
[2012/04/05 21:30:06 | 000,044,032 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticalcl.dll
[2012/04/05 21:29:54 | 016,090,624 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\aticaldd64.dll
[2012/04/05 21:29:34 | 002,631,008 | ---- | M] () -- F:\Windows\System32\atiumd6a.cap
[2012/04/05 21:25:30 | 013,764,096 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\aticaldd.dll
[2012/04/05 21:23:24 | 007,431,680 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiumd64.dll
[2012/04/05 21:22:54 | 004,795,904 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiumdva.dll
[2012/04/05 21:21:42 | 002,664,704 | ---- | M] () -- F:\Windows\SysWow64\atiumdva.cap
[2012/04/05 21:11:28 | 000,514,560 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\atiadlxx.dll
[2012/04/05 21:11:20 | 000,360,448 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\SysWow64\atiadlxy.dll
[2012/04/05 21:11:06 | 000,017,408 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atig6pxx.dll
[2012/04/05 21:11:04 | 000,014,848 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiglpxx.dll
[2012/04/05 21:11:04 | 000,014,848 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiglpxx.dll
[2012/04/05 21:11:00 | 000,041,984 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atig6txx.dll
[2012/04/05 21:10:52 | 000,033,280 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atigktxx.dll
[2012/04/05 21:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\atikmpag.sys
[2012/04/05 21:09:56 | 000,054,784 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiuxp64.dll
[2012/04/05 21:09:48 | 000,041,984 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiuxpag.dll
[2012/04/05 21:09:42 | 000,044,544 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atiu9p64.dll
[2012/04/05 21:09:34 | 000,032,256 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atiu9pag.dll
[2012/04/05 21:09:02 | 000,053,248 | ---- | M] (Advanced Micro Devices, Inc.) -- F:\Windows\System32\drivers\ati2erec.dll
[2012/04/05 21:06:08 | 000,054,784 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\atimpc64.dll
[2012/04/05 21:06:08 | 000,054,784 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\System32\amdpcom64.dll
[2012/04/05 21:06:04 | 000,053,760 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\atimpc32.dll
[2012/04/05 21:06:04 | 000,053,760 | ---- | M] (Advanced Micro Devices, Inc. ) -- F:\Windows\SysWow64\amdpcom32.dll
[2012/04/05 16:34:26 | 000,187,392 | ---- | M] () -- F:\Windows\System32\clinfo.exe
[2012/04/05 16:34:10 | 000,074,752 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\OpenVideo64.dll
[2012/04/05 16:34:04 | 000,064,512 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\OpenVideo.dll
[2012/04/05 16:33:56 | 000,063,488 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\OVDecode64.dll
[2012/04/05 16:33:52 | 000,056,320 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\OVDecode.dll
[2012/04/05 16:33:44 | 016,457,216 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\System32\amdocl64.dll
[2012/04/05 16:32:56 | 013,007,872 | ---- | M] (Advanced Micro Devices Inc.) -- F:\Windows\SysWow64\amdocl.dll
[2 F:\Windows\SysWow64\*.tmp files -> F:\Windows\SysWow64\*.tmp -> ]
[1 F:\Windows\System32\drivers\*.tmp files -> F:\Windows\System32\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/05/04 18:26:06 | 000,268,800 | ---- | C] () -- F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe
[2012/04/23 13:08:37 | 000,155,263 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\Hamlet.pdf
[2012/04/22 12:51:34 | 291,468,273 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\sternstundephilosophie_20120422_110121_vpodcast_h264_16zu9_mq1.m4v
[2012/04/21 03:45:28 | 000,100,616 | -H-- | C] () -- F:\Windows\SysWow64\mlfcache.dat
[2012/04/16 04:03:02 | 000,136,858 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\Merkblatt_NIV.pdf
[2012/04/16 03:57:59 | 000,032,324 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\Kundeninformationen_zur_periodischen_Sicherheitskontrolle4.pdf
[2012/04/15 05:42:04 | 000,978,069 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\kontrovers-0801.pdf
[2012/04/08 10:59:33 | 082,423,808 | ---- | C] () -- [2012/04/07 10:35:36 | 000,395,058 | ---- | C] () -- F:\Users\Flo_Desktop\Desktop\dsgsdgsdgs.png
[2012/04/05 22:23:06 | 000,245,896 | ---- | C] () -- F:\Windows\SysWow64\atiapfxx.blb
[2012/04/05 22:23:06 | 000,245,896 | ---- | C] () -- F:\Windows\System32\atiapfxx.blb
[2012/04/05 21:29:34 | 002,631,008 | ---- | C] () -- F:\Windows\System32\atiumd6a.cap
[2012/04/05 21:21:42 | 002,664,704 | ---- | C] () -- F:\Windows\SysWow64\atiumdva.cap
[2012/04/05 16:34:26 | 000,187,392 | ---- | C] () -- F:\Windows\System32\clinfo.exe
[2012/03/09 08:06:14 | 000,024,576 | ---- | C] () -- F:\Windows\SysWow64\kdbsdk32.dll
[2012/02/14 22:36:36 | 000,204,952 | ---- | C] () -- F:\Windows\SysWow64\ativvsvl.dat
[2012/02/14 22:36:36 | 000,157,144 | ---- | C] () -- F:\Windows\SysWow64\ativvsva.dat
[2011/11/12 16:52:15 | 000,283,304 | ---- | C] () -- F:\Windows\SysWow64\PnkBstrB.exe
[2011/11/12 16:52:12 | 000,076,888 | ---- | C] () -- F:\Windows\SysWow64\PnkBstrA.exe
[2011/09/12 19:06:16 | 000,003,917 | ---- | C] () -- F:\Windows\SysWow64\atipblag.dat
[2011/08/22 06:41:34 | 000,196,096 | ---- | C] () -- F:\Windows\SysWow64\macd32.dll
[2011/08/22 06:41:34 | 000,138,752 | ---- | C] () -- F:\Windows\SysWow64\mase32.dll
[2011/08/22 06:41:34 | 000,136,192 | ---- | C] () -- F:\Windows\SysWow64\mamc32.dll
[2011/08/22 06:41:34 | 000,057,856 | ---- | C] () -- F:\Windows\SysWow64\masd32.dll
[2011/08/22 06:41:34 | 000,027,648 | ---- | C] () -- F:\Windows\SysWow64\ma32.dll
[2011/02/27 09:14:41 | 000,252,928 | ---- | C] () -- F:\Windows\SysWow64\DShowRdpFilter.dll
[2011/02/19 08:30:39 | 000,010,752 | ---- | C] () -- F:\Users\Flo_Desktop\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/31 06:57:29 | 000,007,665 | ---- | C] () -- F:\Users\Flo_Desktop\AppData\Local\Resmon.ResmonCfg
[2010/12/27 16:50:32 | 000,024,576 | R--- | C] () -- F:\Windows\SysWow64\AsIO.dll
[2010/12/27 16:50:32 | 000,013,440 | R--- | C] () -- F:\Windows\SysWow64\drivers\AsIO.sys
[2010/12/27 16:40:11 | 000,001,769 | ---- | C] () -- F:\Windows\Language_trs.ini
[2010/12/27 16:40:08 | 000,026,966 | ---- | C] () -- F:\Windows\Ascd_tmp.ini
[2010/12/27 16:38:06 | 000,000,000 | ---- | C] () -- F:\Windows\ativpsrm.bin
[2010/12/27 16:32:32 | 000,451,072 | ---- | C] () -- F:\Windows\SysWow64\ISSRemoveSP.exe
[2009/11/06 05:58:04 | 000,178,975 | ---- | C] () -- F:\Windows\SysWow64\xlive.dll.cat
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- F:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- F:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- F:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- F:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- F:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- F:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- F:\Windows\SysWow64\msjetoledb40.dll
[2009/07/05 22:48:34 | 000,013,368 | R--- | C] () -- F:\Windows\SysWow64\drivers\AsUpIO.sys
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- F:\Windows\SysWow64\mlang.dat
[2009/04/02 08:30:14 | 000,010,296 | ---- | C] () -- F:\Windows\SysWow64\drivers\ASUSHWIO.SYS
 
========== LOP Check ==========
 
[2012/04/29 15:01:52 | 000,000,000 | ---D | M] -- F:\ProgramData\AMD
[2010/12/27 16:30:35 | 000,000,000 | -HSD | M] -- F:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Application Data
[2011/01/02 12:50:37 | 000,000,000 | ---D | M] -- F:\ProgramData\ASUS OC Profiles
[2010/12/27 16:45:20 | 000,000,000 | ---D | M] -- F:\ProgramData\CheckPoint
[2011/01/29 06:22:41 | 000,000,000 | ---D | M] -- F:\ProgramData\Codemasters
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Documents
[2010/12/27 16:30:35 | 000,000,000 | -HSD | M] -- F:\ProgramData\Dokumente
[2011/11/12 16:55:19 | 000,000,000 | ---D | M] -- F:\ProgramData\EA Core
[2012/02/18 07:19:05 | 000,000,000 | ---D | M] -- F:\ProgramData\EA Logs
[2011/11/12 16:55:22 | 000,000,000 | ---D | M] -- F:\ProgramData\Electronic Arts
[2010/12/27 16:30:35 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Favorites
[2012/03/24 06:24:48 | 000,000,000 | ---D | M] -- F:\ProgramData\Freemake
[2011/01/22 07:18:24 | 000,000,000 | ---D | M] -- F:\ProgramData\FreePDF
[2011/11/12 16:55:02 | 000,000,000 | ---D | M] -- F:\ProgramData\Origin
[2011/08/22 06:44:50 | 000,000,000 | ---D | M] -- F:\ProgramData\Pinnacle
[2011/08/22 06:44:58 | 000,000,000 | ---D | M] -- F:\ProgramData\Pinnacle Studio
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Start Menu
[2010/12/27 16:30:35 | 000,000,000 | -HSD | M] -- F:\ProgramData\Startmenü
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- F:\ProgramData\Templates
[2010/12/27 16:30:35 | 000,000,000 | -HSD | M] -- F:\ProgramData\Vorlagen
[2012/03/24 05:26:58 | 000,000,000 | ---D | M] -- F:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/05/02 12:59:53 | 000,032,640 | ---- | M] () -- F:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---
FYI: Habe die Datei "itunes_service01.exe" einfach gelöscht und konnte mich dann zumindest wieder normal einloggen und auf den Browser über das Startmenü zugreifen. Mit Malewarebytes' Anti Maleware habe ich dan den ganzen Dreck entfernt (Malware Analysis and Removal). Desktopsymbole wurden jedoch nicht angezeigt. Dies lässt sich lösen, indem man einfach mit Rechtsklick (nach Entfernung mit Malewarebyte) auf den Desktop klickt --> Ansicht --> Desktopsymbole anzeigen. Komischerweise zeigt es mir bei Windows trotz korrekter Zeitzone noch die falsche Uhrzeit an?

Alt 05.05.2012, 17:03   #2
markusg
/// Malware-holic
 
itunes_service01.exe - Standard

itunes_service01.exe


auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
ATTFilter
:OTL
O20 - HKLM Winlogon: Shell - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe
()
O20 - HKU\Flo_Desktop_ON_F Winlogon: Shell - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe
()
O20 - HKU\Flo_Desktop_ON_F Winlogon: UserInit - (C:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe) - F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe
()
O4 - HKU\Flo_Desktop_ON_F..\Run: [d31ybB8YFv9cUxg] F:\Users\Flo_Desktop\AppData\Roaming\itunes_service01.exe ()
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Flo_Desktop_ON_F\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
:Files
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus
__________________

__________________
Antwort

Themen zu itunes_service01.exe
.com, adobe, anti maleware, antivir, asus, avira, bho, bonjour, defender, desktop, disabletaskmgr, download, error, explorer, firefox, format, helper, kunde, langs, launch, log, logfile, microsoft, plug-in, realtek, registry, scan, sicherheitskontrolle, software, trojaner, vdeck.exe, version=1.0, winlogon


« und noch ein Windows Verschlüsselungstrojaner über WEB.DE | GVU problem, »


Zum Thema itunes_service01.exe - Hallo Zusammen Habe mir den Trojaner "itunes_service01.exe" eingefangen. Wäre es jemandem von Euch möglich, mir zu sagen, was ich in fix.txt eingeben muss, um dies mit OTLPENet zu beheben? Für - itunes_service01.exe...
Archiv
Du betrachtest: itunes_service01.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24