| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten reinWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
31.05.2012, 09:50
| #1 |
 |  Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Habe genau dasselbe Problem wie http://www.trojaner-board.de/115927-...nten-rein.html Die Funde bei 'mirres' scheinen nichts mit dem Popup-Fenster zu tun zu haben. Bei mir blieben sämtliche Scans (Kaspersky, AVM, Avira, MS Essentials)ohne Fund! Auch Malwarebytes hat nichts gefunden. Werde das Thema bei 'mirres' weiterverfolgen. Falls ich etwas dazu beitragen kann, gerne. |
|
31.05.2012, 15:10
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten reinZitat:
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
31.05.2012, 17:35
| #3 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Hab noch ESETS laufen lassen:
__________________Code:
ATTFilter ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=a0b47ed9f39c5c4fa050a1b484b18c8f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-05-31 04:20:26
# local_time=2012-05-31 06:20:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 23863295 90091718 0 0
# compatibility_mode=8192 67108863 100 0 84 84 0 0
# scanned=3916352
# found=5
# cleaned=0
# scan_time=19358
C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe Win32/Toolbar.Widgi application (unable to clean) 00000000000000000000000000000000 I
F:\Downloads\Software\PDFCreator-1_2_3_setup.exe multiple threats (unable to clean) 00000000000000000000000000000000 I
F:\Downloads\Software\SUPERsetup.exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I
F:\Downloads\Software\Win7PE_SE_20120416.7z Win32/HideRun.A application (unable to clean) 00000000000000000000000000000000 I
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.05.30.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 ***** ***** :: *****-PC [Administrator] Schutz: Deaktiviert 30.05.2012 22:34:42 mbam-log-2012-05-30 (22-34-42).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 1132041 Laufzeit: 52 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
31.05.2012, 18:56
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten reinZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
31.05.2012, 20:45
| #5 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Das ist der WinBuilder. Mit diesem Tool habe ich mir einen bootbaren Memory Stick erstellt, nachdem ich die Malware entdeckt habe. WinBuilder (link einfügen geht nicht: -> hxxp://en.wikipedia.org/wiki/WinBuilder) Habe nun auch noch den ActiveScan laufen lassen. Nix gefunden ausser ein paar Tracking Cookies: Code:
ATTFilter ;***********************************************************************************************************************************************************************************
ANALYSIS: 2012-05-31 21:31:29
PROTECTIONS: 1
MALWARE: 43
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Microsoft Security Essentials Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ku05u0v3.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\q3xlln6k.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\zu3pgpe9.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\peb3gxxm.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7yc8a7e7.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oeajyy2y.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oeajyy2y.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7yc8a7e7.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\1arouc54.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\1arouc54.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\zu3pgpe9.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\peb3gxxm.txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\xizgi6gg.txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0ewn2zhs.txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dibcj278.txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\7zd15klo.txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\7zd15klo.txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jg9msep5.txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1bghls01.txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1bghls01.txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\lq6z477q.txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\zvf4oohp.txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\swzop4k6.txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dax9jhbj.txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t0rmf1dr.txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t0rmf1dr.txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dax9jhbj.txt
00145869 Cookie/SpyLog TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jpk1sfdo.txt
00145869 Cookie/SpyLog TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\jpk1sfdo.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\536aejfi.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\536aejfi.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ek9smhb2.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\lkbxlinx.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\c95feb6b.txt
00147036 Cookie/Adverserve TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\lkbxlinx.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\nn98apwi.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\d7vfr1kk.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\6a6g340l.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\11ad9fmr.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\11ad9fmr.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\nn98apwi.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\d7vfr1kk.txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\6a6g340l.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ke4vtfdw.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\10y3hvo6.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\10y3hvo6.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\29juvgzi.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\29juvgzi.txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gs0f9dxr.txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\m1nps27u.txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\m1nps27u.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\q4vmudeu.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\rvckqcmd.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\rvckqcmd.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\q4vmudeu.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dhzup9oa.txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dhzup9oa.txt
00167724 Cookie/HotLog TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gtnem7fv.txt
00167724 Cookie/HotLog TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gtnem7fv.txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mt76t4lg.txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dk63azwu.txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dk63azwu.txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mt76t4lg.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\gk8d4hk2.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\gbtvb3wg.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\tvcfypcb.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\gk8d4hk2.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\rpg39lzk.txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\tvcfypcb.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\0y8xmus3.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\z80d0jmm.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mlgo2l4v.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\avyp5ph1.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\h1wp66q3.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\avyp5ph1.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\0y8xmus3.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\z80d0jmm.txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\mlgo2l4v.txt
00167756 Cookie/Sexsuche TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\f4ltyaxx.txt
00167756 Cookie/Sexsuche TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\f4ltyaxx.txt
00167760 Cookie/Hitslink TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\axvqq7wy.txt
00167760 Cookie/Hitslink TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\b6cdbhb3.txt
00167760 Cookie/Hitslink TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\axvqq7wy.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\1f4w355o.txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\qjz41uc7.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\h3agq12g.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\yjuumyyf.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\39lchpq0.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c8zjrh3k.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\wwn5lypm.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\h3agq12g.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\39lchpq0.txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c8zjrh3k.txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\pqn0apvp.txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\v1j637h9.txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\czl2z1u9.txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\czl2z1u9.txt
00168095 Cookie/888 TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dpffwcqb.txt
00168095 Cookie/888 TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\dpffwcqb.txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ttc4gv1a.txt
00168106 Cookie/Weborama TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ttc4gv1a.txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dx58ceul.txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\lm3zab6r.txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0tgzxth3.txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0tgzxth3.txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\wsx3gl07.txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\wsx3gl07.txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\daf1mr5e.txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c9q0nb9q.txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\c9q0nb9q.txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\daf1mr5e.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\vgfr6hu0.txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ukbu89iy.txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\qx1h1z33.txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\kbtw2vre.txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t9gmbwfj.txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\kbtw2vre.txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\t9gmbwfj.txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\bw5tg1wj.txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\bw5tg1wj.txt
00170557 Cookie/Com.com TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\95f28ssc.txt
00170557 Cookie/Com.com TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\95f28ssc.txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0wo1unof.txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\0wo1unof.txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\a9gy40e8.txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\ss8qaxqd.txt
00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\kidfsoq5.txt
00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\kidfsoq5.txt
00182104 Cookie/Hitbox TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\w7qblwdv.txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dab68xc4.txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\dab68xc4.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oecos2zi.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\5tsqsibz.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\aajabxqt.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\wj8v2u8n.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\aajabxqt.txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\oecos2zi.txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\6r17bv04.txt
00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\i2knh3hl.txt
00286732 Cookie/Cgi-bin TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7p6liwhh.txt
00286732 Cookie/Cgi-bin TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\7p6liwhh.txt
00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No c:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\emf6d93h.txt
00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No h:\users\***** *****\appdata\roaming\microsoft\windows\cookies\low\emf6d93h.txt
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
;===================================================================================================================================================================================
Geändert von ambit01 (31.05.2012 um 20:51 Uhr) |
|
31.05.2012, 21:23
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ --> Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein |
|
31.05.2012, 22:28
| #7 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein First: Vielen Dank an Arne. Finde es toll, dass sich hier Jemand dem Problem annimmt. Ich bin begeistert! Second: OTL bleibt hängen. Out of Memory bei: Manual File Scan - Getting folder structure :-( Danke, Adrian |
|
01.06.2012, 08:50
| #8 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein OTL Quick-Scan OHNE Custom Scans OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.06.2012 09:39:55 - Run 1 OTL by OldTimer - Version 3.2.44.0 Folder = F:\Downloads\Software 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy 15.98 Gb Total Physical Memory | 13.37 Gb Available Physical Memory | 83.67% Memory free 31.95 Gb Paging File | 29.16 Gb Available in Paging File | 91.27% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 238.38 Gb Total Space | 34.55 Gb Free Space | 14.49% Space Free | Partition Type: NTFS Drive F: | 223.57 Gb Total Space | 26.98 Gb Free Space | 12.07% Space Free | Partition Type: NTFS Drive Q: | 238.38 Gb Total Space | 34.55 Gb Free Space | 14.49% Space Free | Partition Type: CSC-CACHE Computer Name: *****-PC | User Name: ***** ***** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.05.31 22:31:35 | 000,595,968 | ---- | M] (OldTimer Tools) -- F:\Downloads\Software\OTL.exe PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe ========== Modules (No Company Name) ========== MOD - [2012.04.04 07:53:56 | 000,312,832 | ---- | M] () -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DEU MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf MOD - [2010.12.21 01:15:30 | 001,041,248 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.10.26 04:00:58 | 000,204,288 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2011.06.29 11:51:26 | 000,171,688 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R) PROSet Monitoring Service) Intel(R) SRV:64bit: - [2011.04.12 21:37:20 | 007,681,536 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe -- (MySQL) SRV:64bit: - [2010.11.20 15:26:50 | 000,084,992 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\Mcx2Svc.dll -- (Mcx2Svc) SRV:64bit: - [2009.07.14 03:41:27 | 000,097,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\mprdim.dll -- (RemoteAccess) SRV:64bit: - [2009.07.14 03:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.04.03 17:10:50 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.11.29 18:07:55 | 003,483,600 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv) SRV - [2011.11.10 11:10:16 | 005,899,240 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe -- (syncagentsrv) SRV - [2011.11.10 11:09:44 | 001,124,616 | ---- | M] (Acronis) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2011.09.19 09:40:00 | 001,406,080 | R--- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.08\AsusFanControlService.exe -- (AsusFanControlService) SRV - [2011.08.09 04:56:04 | 000,947,328 | R--- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AAHM\1.00.15\aaHMSvc.exe -- (asHmComSvc) SRV - [2011.08.09 04:55:00 | 000,918,144 | R--- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AXSP\1.00.16\atkexComSvc.exe -- (asComSvc) SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2011.05.24 10:33:30 | 001,840,128 | ---- | M] (MAGIX AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2011.05.05 22:36:05 | 000,022,528 | ---- | M] () [Disabled | Stopped] -- C:\Programme\DAZ 3D\Content Management Service\ContentManagementServer.exe -- (DAZContentManagementService) SRV - [2011.04.26 13:54:12 | 002,702,848 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2011.04.01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc) SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010.10.21 11:52:26 | 000,586,880 | R--- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService) SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.08.26 02:17:22 | 000,134,944 | ---- | M] (Nuance Communications, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe -- (PDFProFiltSrv) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysWOW64\mprdim.dll -- (RemoteAccess) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.10 22:39:58 | 000,089,920 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.01 19:35:06 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2011.11.29 18:08:00 | 000,367,200 | ---- | M] (Acronis) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\afcdp.sys -- (afcdp) DRV:64bit: - [2011.11.29 18:07:52 | 001,285,216 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tdrpman.sys -- (tdrpman) DRV:64bit: - [2011.11.29 18:07:47 | 000,986,208 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter) DRV:64bit: - [2011.11.29 18:07:31 | 000,211,040 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vididr.sys -- (vididr) DRV:64bit: - [2011.11.29 18:07:24 | 000,142,944 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsflt61.sys -- (vidsflt61) Acronis Disk Storage Filter (61) DRV:64bit: - [2011.11.29 18:07:21 | 000,310,368 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman) DRV:64bit: - [2011.11.29 18:07:17 | 000,133,728 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fltsrv.sys -- (fltsrv) DRV:64bit: - [2011.11.14 13:02:30 | 000,340,008 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Si3124r5.sys -- (Si3124r5) DRV:64bit: - [2011.11.14 13:02:30 | 000,022,568 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiWinAcc.sys -- (SiFilter) DRV:64bit: - [2011.11.14 13:02:30 | 000,016,936 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiRemFil.sys -- (SiRemFil) DRV:64bit: - [2011.10.26 05:05:10 | 010,496,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.10.26 03:21:58 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.10.07 10:24:12 | 000,152,064 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ser2pl64.sys -- (Ser2pl) DRV:64bit: - [2011.09.14 18:05:34 | 000,394,216 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:64bit: - [2011.09.14 18:05:34 | 000,129,000 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:64bit: - [2011.08.15 11:30:04 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R) DRV:64bit: - [2011.08.09 07:42:36 | 000,315,696 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mvs91xx.sys -- (mvs91xx) DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.07.20 03:37:56 | 000,342,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) Intel(R) DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.06.07 00:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2011.05.18 08:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB) DRV:64bit: - [2011.05.17 16:44:46 | 000,044,480 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0) DRV:64bit: - [2011.03.23 16:41:28 | 000,036,448 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2010.11.20 11:26:11 | 000,328,192 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\udfs.sys -- (udfs) DRV:64bit: - [2010.09.21 10:07:08 | 000,312,184 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ArcSec.sys -- (ArcSec) DRV:64bit: - [2010.08.17 19:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT) Intel(R) Watchdog Timer Driver (Intel(R) WDT) DRV:64bit: - [2010.04.27 09:30:52 | 000,184,968 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.04.27 09:29:54 | 000,083,080 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.03.10 09:02:18 | 000,102,624 | R--- | M] (Mobile Action Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\gpslc64.sys -- (gpslc64) DRV:64bit: - [2009.08.09 23:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,024,144 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\crcdisk.sys -- (crcdisk) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\ws2ifsl.sys -- (ws2ifsl) DRV:64bit: - [2009.07.14 01:19:47 | 000,092,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\SysNative\drivers\cdfs.sys -- (cdfs) DRV:64bit: - [2009.06.30 10:37:16 | 000,033,800 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.01.19 01:10:30 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\InprocServer32 File not found IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heise.de/ IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 30 73 DB A2 61 CC 01 [binary data] IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\InprocServer32 File not found IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes,DefaultScope = {D492C723-FCAA-44C1-8975-8E64552FE353} IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{5B59ED8B-AB3D-46FA-823E-398A5EDF1EE2}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms} IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\..\SearchScopes\{D492C723-FCAA-44C1-8975-8E64552FE353}: "URL" = hxxp://www.google.ch/search?q={searchTerms} IE - HKU\S-1-5-21-3339107563-512239636-558935408-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaultthis.engineName: "Freeware.de Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2736476&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\***** *****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\microsoft.com/DpeCiDetectorPlugin: C:\Users\***** *****\AppData\Local\Apps\2.0\3JV2876W.ZM7\O8RN4POV.048\cont..tion_c3bce3770c238a49_0001.0000_cd0e32ce0c5b3ab8\npDpeCiDetectorPlugin.dll (Microsoft) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.10 13:01:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.08.30 08:37:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***** *****\AppData\Roaming\mozilla\Extensions [2012.05.12 22:19:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***** *****\AppData\Roaming\mozilla\Firefox\Profiles\k00bo4vt.default\extensions [2012.05.10 13:01:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.05.07 18:04:35 | 000,001,398 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 93.115.241.27 www.google-analytics.com. O1 - Hosts: 93.115.241.27 ad-emea.doubleclick.net. O1 - Hosts: 93.115.241.27 www.statcounter.com. O1 - Hosts: 108.163.215.51 www.google-analytics.com. O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net. O1 - Hosts: 108.163.215.51 www.statcounter.com. O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll File not found O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll File not found O2:64bit: - BHO: (no name) - AutorunsDisabled - No CLSID value found. O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll File not found O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKU\S-1-5-21-3339107563-512239636-558935408-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8:64bit: - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8:64bit: - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8:64bit: - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8:64bit: - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O8 - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation) O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.0.cab (DLM Control) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: DhcpNameServer = 10.0.3.10 10.0.3.11 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: Domain = *****.******.**** O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{928B20C8-9DCE-4683-92D8-6850A87AF2FA}: NameServer = 10.0.3.10 10.0.3.11 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B4827602-B9CD-4900-8CA2-1A87B729BC06}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1DBC193-78EA-4388-8106-53D58B8FAA89}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2e634b82-cd94-11e0-9ac6-bcaec5159772}\Shell - "" = AutoRun O33 - MountPoints2\{2e634b82-cd94-11e0-9ac6-bcaec5159772}\Shell\AutoRun\command - "" = E:\setup.exe O33 - MountPoints2\{ebab1660-3a42-11e1-b5e6-5404a62f3bca}\Shell - "" = AutoRun O33 - MountPoints2\{ebab1660-3a42-11e1-b5e6-5404a62f3bca}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL H:\Win-Azure.pdf O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.05.31 18:49:05 | 000,033,800 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\pavboot64.sys [2012.05.31 18:49:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda Security [2012.05.31 12:56:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.05.31 09:56:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2012.05.31 09:56:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.05.31 09:56:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2012.05.30 18:07:22 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\Malwarebytes [2012.05.30 18:07:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.05.30 18:07:16 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.05.30 18:07:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.05.30 18:07:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.05.30 16:59:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung [2012.05.30 16:56:11 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.05.30 16:23:51 | 000,000,000 | RHSD | C] -- C:\acroldr [2012.05.25 00:15:06 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\FrontDesign [2012.05.25 00:14:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontplatten Designer [2012.05.25 00:14:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FrontDesign [2012.05.21 18:53:58 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\Crosshairs Embedded [2012.05.21 18:53:08 | 000,000,000 | ---D | C] -- C:\Users\***** *****\Documents\Crosshairs Embedded [2012.05.21 18:20:01 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\controlSUITE [2012.05.21 18:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\controlSUITE [2012.05.21 18:17:14 | 000,000,000 | ---D | C] -- C:\Program Files\controlSUITE [2012.05.15 14:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2012.05.15 14:31:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2012.05.14 23:01:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2012.05.12 19:11:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Ant [2012.05.12 12:36:21 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.05.12 12:31:13 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2012.05.12 01:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.05.12 01:56:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.05.10 22:41:19 | 000,000,000 | ---D | C] -- C:\WinPEx64 [2012.05.10 22:25:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows AIK [2012.05.10 22:25:27 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Imaging [2012.05.10 22:25:23 | 000,000,000 | ---D | C] -- C:\Program Files\Windows AIK [2012.05.09 23:34:34 | 000,000,000 | ---D | C] -- C:\Windows\pss [2012.05.07 19:43:24 | 000,000,000 | ---D | C] -- C:\Users\***** *****\AppData\Roaming\AllDup [2012.05.07 19:43:07 | 002,369,456 | ---- | C] (Codejock Software) -- C:\Windows\SysWow64\Codejock.CommandBars.v13.4.2.ocx [2012.05.07 19:43:07 | 001,000,992 | ---- | C] (Bennet-Tec Information Systems, Inc) -- C:\Windows\SysWow64\TList8.ocx [2012.05.07 19:43:07 | 000,450,560 | ---- | C] (LogicNP Software (hxxp://www.ssware.com)) -- C:\Windows\SysWow64\fldrvw90.ocx [2012.05.07 19:43:07 | 000,171,752 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtRTF2.ocx [2012.05.07 19:43:07 | 000,089,888 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtFrame.ocx [2012.05.07 19:43:07 | 000,077,504 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtScrollContainer.ocx [2012.05.07 19:43:07 | 000,044,736 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSubclass.dll [2012.05.07 19:43:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AllDup [2012.05.07 19:43:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AllDup [2012.05.07 19:43:06 | 000,086,016 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSplitter.ocx [2012.05.07 19:43:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AllDup [2012.05.06 13:54:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AbleMP3 [2012.05.06 01:45:07 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\MAGIX_Music_Maker_MX_Production_Suite [2012.05.04 10:20:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client [2012.05.04 10:20:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2012.05.04 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Systernals ========== Files - Modified Within 30 Days ========== [2012.06.01 08:51:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.01 08:48:38 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.01 08:48:38 | 000,014,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.01 08:45:45 | 001,806,450 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.01 08:45:45 | 000,773,364 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.01 08:45:45 | 000,715,840 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.01 08:45:45 | 000,174,948 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.01 08:45:45 | 000,142,886 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.01 08:41:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.01 08:41:24 | 4276,207,614 | -HS- | M] () -- C:\hiberfil.sys [2012.05.31 18:32:41 | 000,001,346 | ---- | M] () -- C:\Users\***** *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2012.05.31 11:23:53 | 000,002,073 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-Bit.lnk [2012.05.31 09:56:40 | 000,001,264 | ---- | M] () -- C:\Users\***** *****\Desktop\Spybot - Search & Destroy.lnk [2012.05.31 08:48:34 | 000,002,050 | ---- | M] () -- C:\Users\***** *****\Documents\xRM-Entwicklung.RDP [2012.05.30 18:07:18 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.05.30 17:06:57 | 000,504,016 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.05.30 16:55:53 | 000,000,866 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog [2012.05.28 17:53:10 | 000,000,218 | ---- | M] () -- C:\Users\***** *****\.recently-used.xbel [2012.05.28 14:34:59 | 000,000,063 | ---- | M] () -- C:\Users\***** *****\.gtk-bookmarks [2012.05.27 22:34:54 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI [2012.05.27 20:50:40 | 000,001,299 | ---- | M] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.fpd [2012.05.27 20:49:20 | 000,001,299 | ---- | M] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.bak [2012.05.25 17:03:34 | 000,001,470 | ---- | M] () -- C:\Users\***** *****\swissmap.properties [2012.05.22 23:06:17 | 000,042,625 | ---- | M] () -- C:\Windows\SysWow64\6.skb [2012.05.22 23:01:15 | 000,037,681 | ---- | M] () -- C:\Windows\SysWow64\5.skb [2012.05.22 22:56:10 | 000,019,378 | ---- | M] () -- C:\Windows\SysWow64\4.skb [2012.05.22 12:58:23 | 000,098,871 | ---- | M] () -- C:\Users\***** *****\Desktop\2.skb [2012.05.22 12:53:22 | 000,022,355 | ---- | M] () -- C:\Users\***** *****\Desktop\1.skb [2012.05.22 12:45:26 | 000,019,720 | ---- | M] () -- C:\Users\***** *****\Desktop\0.skb [2012.05.22 00:15:22 | 000,030,779 | ---- | M] () -- C:\Windows\SysWow64\3.skb [2012.05.22 00:08:58 | 000,028,544 | ---- | M] () -- C:\Windows\SysWow64\2.skb [2012.05.22 00:03:10 | 000,028,708 | ---- | M] () -- C:\Windows\SysWow64\1.skb [2012.05.21 23:58:06 | 000,010,740 | ---- | M] () -- C:\Windows\SysWow64\0.skb [2012.05.18 18:34:21 | 000,002,070 | ---- | M] () -- C:\Users\***** *****\Documents\HostEurope_xRM.RDP [2012.05.17 14:47:43 | 000,178,237 | ---- | M] () -- C:\Users\***** *****\Documents\100km2012.xml [2012.05.15 17:35:39 | 000,334,720 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Windows\SysNative\RootkitRevealer.exe [2012.05.14 13:34:48 | 000,129,533 | ---- | M] () -- C:\Users\***** *****\Documents\IntelliPlanArchive.zip [2012.05.10 13:41:41 | 000,107,991 | ---- | M] () -- C:\Users\***** *****\Documents\Track_26km.gpx [2012.05.10 13:41:21 | 000,103,030 | ---- | M] () -- C:\Users\***** *****\Documents\Route_26km.gpx [2012.05.10 13:01:56 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.05.07 19:43:07 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\AllDup.lnk [2012.05.07 18:04:35 | 000,001,398 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2012.05.06 01:45:34 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk [2012.05.04 10:20:48 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.05.04 10:20:11 | 001,831,984 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI ========== Files Created - No Company Name ========== [2012.05.31 18:32:41 | 000,001,346 | ---- | C] () -- C:\Users\***** *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2012.05.31 11:23:53 | 000,002,081 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.1 64-Bit.lnk [2012.05.31 11:23:53 | 000,002,073 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-Bit.lnk [2012.05.31 09:56:40 | 000,001,264 | ---- | C] () -- C:\Users\***** *****\Desktop\Spybot - Search & Destroy.lnk [2012.05.31 08:45:54 | 000,002,050 | ---- | C] () -- C:\Users\***** *****\Documents\xRM-Entwicklung.RDP [2012.05.30 18:07:18 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.05.28 17:53:10 | 000,000,218 | ---- | C] () -- C:\Users\***** *****\.recently-used.xbel [2012.05.28 14:34:59 | 000,000,063 | ---- | C] () -- C:\Users\***** *****\.gtk-bookmarks [2012.05.25 00:17:48 | 000,001,299 | ---- | C] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.fpd [2012.05.25 00:17:48 | 000,001,299 | ---- | C] () -- C:\Users\***** *****\Documents\Frontplatte_37x30mm.bak [2012.05.22 23:06:17 | 000,042,625 | ---- | C] () -- C:\Windows\SysWow64\6.skb [2012.05.22 23:01:15 | 000,037,681 | ---- | C] () -- C:\Windows\SysWow64\5.skb [2012.05.22 22:56:10 | 000,019,378 | ---- | C] () -- C:\Windows\SysWow64\4.skb [2012.05.22 12:58:23 | 000,098,871 | ---- | C] () -- C:\Users\***** *****\Desktop\2.skb [2012.05.22 12:53:22 | 000,022,355 | ---- | C] () -- C:\Users\***** *****\Desktop\1.skb [2012.05.22 12:45:26 | 000,019,720 | ---- | C] () -- C:\Users\***** *****\Desktop\0.skb [2012.05.22 00:15:22 | 000,030,779 | ---- | C] () -- C:\Windows\SysWow64\3.skb [2012.05.22 00:08:58 | 000,028,544 | ---- | C] () -- C:\Windows\SysWow64\2.skb [2012.05.22 00:03:10 | 000,028,708 | ---- | C] () -- C:\Windows\SysWow64\1.skb [2012.05.21 23:58:06 | 000,010,740 | ---- | C] () -- C:\Windows\SysWow64\0.skb [2012.05.18 18:34:21 | 000,002,070 | ---- | C] () -- C:\Users\***** *****\Documents\HostEurope_xRM.RDP [2012.05.17 14:47:43 | 000,178,237 | ---- | C] () -- C:\Users\***** *****\Documents\100km2012.xml [2012.05.10 13:41:41 | 000,107,991 | ---- | C] () -- C:\Users\***** *****\Documents\Track_26km.gpx [2012.05.10 13:41:21 | 000,103,030 | ---- | C] () -- C:\Users\***** *****\Documents\Route_26km.gpx [2012.05.10 13:01:56 | 000,001,136 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.05.07 19:43:07 | 000,000,985 | ---- | C] () -- C:\Users\Public\Desktop\AllDup.lnk [2012.05.06 01:45:34 | 000,001,096 | ---- | C] () -- C:\Users\Public\Desktop\MAGIX Music Maker MX Production Suite Download-Version.lnk [2012.05.04 10:20:28 | 000,001,921 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2012.04.22 11:04:46 | 000,159,527 | ---- | C] () -- C:\Windows\FlyChart Uninstaller.exe [2012.04.22 10:59:22 | 000,159,866 | ---- | C] () -- C:\Windows\FlyChart Uninstaller.exe.bak [2012.03.31 00:45:22 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2012.03.30 23:50:40 | 000,000,046 | ---- | C] () -- C:\Windows\SysWow64\DonationCoder_urlsnooper_InstallInfo.dat [2012.01.31 19:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2012.01.31 19:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2012.01.31 19:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2012.01.31 19:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.12.06 01:35:05 | 000,000,000 | ---- | C] () -- C:\Windows\gconf.INI [2011.12.01 20:16:46 | 005,506,256 | ---- | C] () -- C:\Windows\PE_File.dll [2011.12.01 20:13:41 | 005,444,880 | ---- | C] () -- C:\Windows\PE_Rom.dll [2011.12.01 17:25:38 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.11.29 16:27:39 | 000,043,736 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.11.29 16:14:59 | 000,036,550 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2011.11.10 15:30:55 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.10.26 03:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011.10.26 03:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.10.25 22:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.14 12:47:40 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.23 16:41:08 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.08.23 16:41:08 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd9045cd.dat [2011.08.23 16:41:08 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2011.08.23 16:40:23 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL [2011.08.23 16:40:21 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI [2011.08.23 16:30:55 | 001,831,984 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.08.23 16:07:48 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.08.23 15:28:48 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.08.23 15:21:29 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2010.08.03 07:21:24 | 000,014,464 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys ========== LOP Check ========== [2012.05.21 19:34:56 | 000,000,000 | ---D | M] -- C:\Users\a0273787\AppData\Roaming\Texas Instruments, Inc [2011.11.29 18:09:21 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Acronis [2012.05.07 23:58:28 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\AllDup [2012.03.28 21:59:05 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Amazon [2012.05.04 09:42:36 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Biep [2011.12.20 21:10:21 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Blender Foundation [2012.03.30 23:22:55 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Bolide(R) Software [2011.11.06 10:58:04 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.09.09 21:17:17 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2012.05.30 21:04:17 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\controlSUITE [2012.05.21 18:53:58 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Crosshairs Embedded [2011.12.24 01:25:13 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\DAZ 3D [2012.04.29 12:31:06 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\digital publishing [2012.03.30 23:50:40 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\DonationCoder [2012.05.24 23:29:22 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FileZilla [2011.11.28 22:22:44 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FreeCommander [2012.05.25 00:15:07 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\FrontDesign [2011.09.03 16:28:06 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\GARMIN [2011.12.10 20:16:42 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\GHISLER [2012.05.28 14:38:23 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\gtk-2.0 [2011.12.08 02:08:05 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\ibf [2011.09.08 19:10:09 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\ImgBurn [2012.05.06 01:54:12 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MAGIX [2012.05.23 17:33:50 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MediaMonkey [2011.09.22 18:47:19 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Mobile Action [2011.11.05 21:39:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\MySQL [2011.08.31 23:10:38 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Nuance [2012.01.25 23:14:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\pdfforge [2011.12.23 13:38:54 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Poser Debut [2011.08.30 00:06:30 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\proDAD [2011.11.14 12:31:44 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\PTGui [2012.02.27 18:36:47 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Samsung [2011.11.13 14:00:39 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\TrueCrypt [2011.12.22 23:59:26 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Unity [2011.08.29 22:19:37 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Windows Live Writer [2012.04.25 09:17:32 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Ybxow [2012.05.02 21:28:14 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Zaux [2011.08.23 18:52:03 | 000,000,000 | ---D | M] -- C:\Users\***** *****\AppData\Roaming\Zeon [2012.04.28 21:48:21 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:0574215C < End of report > |
|
01.06.2012, 13:32
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Probier den CustomScan im abgesicherten Modus mit Netzwerk bitte aus
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.06.2012, 14:11
| #10 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein OTL Custom Scan im abgesichterten Modus mit Netzwerk ausgeführt. Wieder beim Punkt 'Manual File Scan - Getting folder structure ' etwa 8 Minuten hängengeblieben und danach die Fehlermeldung 'Out of Memory' ausgegeben. Neu seit gestern Abend: Redirection von Links auf 'normalen' Webseiten. Z. Bsp. von einem Links auf winfuture.de auf hxxp://search.bpath.com/toolbar/search/.. und dann auf eine Werbeseite umgeleitet. Gmbl grmbl grmbl .... |
|
01.06.2012, 14:35
| #11 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten reinZitat:
 Firmenrechner? Werden hier eigentlich nicht bereinigt Siehe => http://www.trojaner-board.de/108422-...-anfragen.html Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.06.2012, 15:03
| #12 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Don't panic. Das ist mein privater PC. Ich habe im Logfile aber alle persönlichen Angaben anonymisiert, so auch den Internetzugang zur Firma. ;-) Adrian |
|
01.06.2012, 15:50
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten reinZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.06.2012, 15:55
| #14 |
| | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein arbeiten ... per VPN ohne Probleme ... bis jetzt |
|
02.06.2012, 15:25
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein Da du mit diesem Rechner auch wirklich wichtige Dinge über VPN im Firmennetz machst, solltest du wirklich mal überlegen, ob man diesen nicht besser neu aufsetzt. Viele Firmen haben bestimmte Richtlinien und man kann nicht einfach irgendeinen PC in einer beliebigen Konfig ins Firmennetz hängen - technisch vllt möglich, aber sinnvoll ist das nicht. Sprich mal mit deiner IT darüber.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Popup rechts unten im Browser, nervende Werbung auch als Flash, schiebt sich von unten rein |
| .html, avira, browser, dasselbe, essen, essentials, flash, funde, gefunde, kaspersky, malwarebytes, nerve, nervende, nichts, popup, popup-fenster, problem, rechts, scans, schei, sämtliche, thema, werbung |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
