Malware auf der Festplatte (CK Visitenkarten Designer)

Emmanuil · 29.06.2012, 14:31

Ich wollte mir gestern, 28.06.2012, neue Visitenkarten erstellen und suchte bei Google nach Visitenkarten Software kostenlos downloaden. Habe dann die CK Visitenkarten Designer genommen und downgeloaded. Das war aber eine Malware, denn prompt kam eine Tafel, die sagte, ich hätte eine Menge Probleme im Rechner und soll die Software kaufen, um sie zu beseitigen. Tat ich nicht und versuchte die downgeloadete Software zu deinstallieren, war aber unmöglich, denn dann wurde ich aufgefordert, die zu speichern uns.

Zugleich erschienen andere Programme wir Reg Clean Pro, Advance System Protection, Systeak u.a., die ich mühevoll deinstalliert bzw. gelöscht habe.

Geblieben ist jetzt CK Visitenkarten Designer und die löst sich leider nicht deinstallieren

Ich wollte mir gestern, 28.06.2012, neue Visitenkarten erstellen und suchte bei Google nach Visitenkarten Software kostenlos downloaden. Aus dem Angebot habe ich dann die "CK Visitenkarten Designer" (hxxp://ck-visitenkarten-designer.softonic.de/download) genommen und downgeloaded. Das war aber eine Malware, denn prompt kam eine Tafel, die sagte, ich hätte eine Menge Probleme im Rechner und sollte eine angebotene Software kaufen, um sie zu beseitigen. Tat ich nicht und versuchte die downgeloadete Software zu deinstallieren, war aber unmöglich, denn dann wurde ich aufgefordert, die zu speichern.

Zugleich erschienen andere Programme wie Reg Clean Pro, Advance System Protection, Systeak u.a., die ich mühevoll deinstalliert bzw. gelöscht habe.

Geblieben ist jetzt CK Visitenkarten Designer und die löst sich leider nicht deinstallieren[/QUOTE]

markusg · 29.06.2012, 19:21

hi wieso schreibst du deinen text 2 mal :-)
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Emmanuil · 30.06.2012, 10:06

Hallo Markus,
trotz Dr.-Titel bin ich in technischen Sachen nicht zu gebrauchen. Nach stundenlangem hin und her habe ich den Scan, wie hier unten, hingekriegt. Ich glaube, es ist nicht richtig, aber weiter komme ich leider nicht. Oder sehr schwer, ich bemühe mich ja. Den txt Scan habe ich nicht hingekriegt.
Zu deiner Frage, weshalb ich den Text zwei mal geschrieben habe. Ja, ich wollte einiges korrigieren und das System hat den Text nochmal produziert.
Ich hoffe, du hast etwas Geduld mit mir
Ein schönes Wochenende noch
Emmanuil
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 30.06.2012 10:42:19 - Run 4
OTL by OldTimer - Version 3.2.53.0     Folder = C:\Users\Manolis\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,88 Gb Total Physical Memory | 2,18 Gb Available Physical Memory | 56,24% Memory free
7,76 Gb Paging File | 5,66 Gb Available in Paging File | 72,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 414,66 Gb Total Space | 372,22 Gb Free Space | 89,76% Space Free | Partition Type: NTFS
Drive D: | 50,00 Gb Total Space | 24,60 Gb Free Space | 49,20% Space Free | Partition Type: NTFS
 
Computer Name: MANOLIS-PC | User Name: Manolis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.30 10:41:54 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Manolis\Downloads\OTL (6).exe
PRC - [2012.06.07 10:14:45 | 001,239,576 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012.02.02 01:29:58 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2012.02.02 01:29:56 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.04.24 23:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
PRC - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.16 10:31:58 | 000,489,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\8ab16b2721684612a1c9053401797082\IAStorUtil.ni.dll
MOD - [2012.06.16 10:31:58 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\0ac5296285b1a74de78ded1c844cfb60\IAStorCommon.ni.dll
MOD - [2012.06.16 09:21:12 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.15 08:18:27 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.06.15 08:18:01 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.06.15 08:17:52 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.06.15 08:17:48 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.06.15 08:17:45 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.06.15 08:17:44 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.06.15 08:17:37 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.06.07 10:14:43 | 000,441,880 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
MOD - [2012.06.07 10:14:42 | 003,922,456 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\pdf.dll
MOD - [2012.06.07 10:13:27 | 000,553,496 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\libglesv2.dll
MOD - [2012.06.07 10:13:26 | 000,117,784 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\libegl.dll
MOD - [2012.06.07 10:13:16 | 000,134,696 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\avutil-51.dll
MOD - [2012.06.07 10:13:15 | 000,250,408 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\avformat-54.dll
MOD - [2012.06.07 10:13:14 | 002,375,720 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\avcodec-54.dll
MOD - [2012.06.07 09:23:19 | 009,252,040 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
MOD - [2012.06.07 09:23:19 | 009,252,040 | ---- | M] () -- C:\PROGRA~2\Google\Chrome\APPLIC~1\190108~1.56\gcswf32.dll
MOD - [2011.04.24 23:13:30 | 007,008,656 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll
MOD - [2011.04.24 23:13:28 | 000,192,912 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll
MOD - [2011.04.24 23:13:26 | 001,270,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll
MOD - [2011.04.24 23:13:26 | 000,758,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll
MOD - [2011.04.24 23:13:24 | 002,118,032 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll
MOD - [2011.04.24 23:13:24 | 002,089,360 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll
MOD - [2011.04.20 19:56:28 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.06.15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.14 17:53:54 | 000,332,272 | ---- | M] (Google Inc.) [On_Demand | Stopped] -- C:\ProgramData\Partner\Partner.exe -- (Partner Service)
SRV - [2012.03.07 09:57:59 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) Intel(R)
SRV - [2012.02.02 01:29:58 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2012.01.31 11:24:02 | 000,070,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.09.28 02:47:38 | 000,025,824 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe -- (MemeoBackgroundService)
SRV - [2011.04.24 23:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe -- (AVP)
SRV - [2011.03.11 14:08:32 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011.03.11 14:08:31 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.06.14 17:55:16 | 000,615,728 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2012.03.07 09:58:19 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2012.03.07 09:57:43 | 014,741,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012.03.06 15:31:32 | 000,648,808 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.02 01:16:40 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.08.02 02:47:30 | 000,391,144 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:64bit: - [2011.08.02 02:47:30 | 000,129,000 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:64bit: - [2011.03.11 14:08:31 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.10 18:36:24 | 000,029,488 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2011.03.04 13:23:28 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl2.sys -- (kl2)
DRV:64bit: - [2011.03.04 13:23:24 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1)
DRV:64bit: - [2010.11.25 15:59:00 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.09.23 22:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.11.02 20:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKCU\..\SearchScopes,DefaultScope = {B618DE6F-1DA0-4558-9E28-39561D629424}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{B618DE6F-1DA0-4558-9E28-39561D629424}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_deDE489
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2012.06.30 09:02:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2012.06.30 09:02:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2012.06.30 09:02:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.29 11:56:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.15 08:43:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.06.15 08:43:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Manolis\AppData\Roaming\mozilla\Extensions
[2012.06.29 11:56:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.15 00:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNE_enDE393
CHR - default_search_provider: suggest_url = 
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U3 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\
CHR - Extension: Anti-Banner = C:\Users\Manolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4 - Startup: C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45E4EAE5-E5F5-48B8-9F27-7BB134DABC47}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 0
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.29 16:07:27 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Windows Live
[2012.06.29 16:07:12 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\{C5BA48B7-70A6-4CD7-90D5-4255F4FAE72F}
[2012.06.29 11:56:08 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Mozilla
[2012.06.29 11:56:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.06.29 11:56:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.06.29 11:55:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.06.28 18:07:48 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.06.28 17:30:05 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\ElevatedDiagnostics
[2012.06.28 16:57:29 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\MediaServer
[2012.06.28 15:57:16 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Systweak
[2012.06.28 15:57:12 | 000,018,832 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe
[2012.06.28 15:30:56 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Diagnostics
[2012.06.24 15:11:18 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\BilderPrivat2012
[2012.06.23 10:08:26 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Searches
[2012.06.20 09:34:22 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Analysi Krisi Ellada_files
[2012.06.19 10:03:31 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Videos
[2012.06.16 12:17:13 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Keramoti
[2012.06.16 12:17:13 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Juden-Zionismus-HolokaustLeugner
[2012.06.16 12:17:13 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Griechen-DiasporaEtc
[2012.06.16 12:17:13 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Gesundheit
[2012.06.16 12:17:13 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Geschichte
[2012.06.16 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\FlyerInfosRundmails
[2012.06.16 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\FalscheFlagge-Verschwörungen-Spionage
[2012.06.16 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Drafts
[2012.06.16 12:17:12 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\DJV
[2012.06.16 12:17:11 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Briefe
[2012.06.16 12:17:11 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Botschaft
[2012.06.16 12:17:10 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Berlin-Athen
[2012.06.16 12:17:10 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Balkan
[2012.06.16 12:17:09 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\ArtikelOnline
[2012.06.16 12:17:09 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Adressen
[2012.06.16 12:17:08 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Terrorismus
[2012.06.16 12:17:07 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Sprache
[2012.06.16 12:16:50 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Software-InternetProvider
[2012.06.16 12:16:50 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Religion
[2012.06.16 12:16:44 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\ReiseGR-Fotos-5-6.2010
[2012.06.16 12:15:24 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Privat
[2012.06.16 12:15:24 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Politik
[2012.06.16 12:15:24 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\NGOs
[2012.06.16 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\MTheo-KostasPap
[2012.06.16 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\MM
[2012.06.16 12:15:23 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Latsos
[2012.06.16 12:03:19 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Bilder Privat
[2012.06.16 11:35:19 | 000,000,000 | ---D | C] -- C:\Users\Manolis\Documents\Updater
[2012.06.16 11:35:10 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Adobe
[2012.06.16 11:34:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe Systems
[2012.06.16 11:30:46 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe PDF
[2012.06.16 11:30:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe Systems Shared
[2012.06.16 11:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.06.15 13:45:08 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Google
[2012.06.15 11:02:54 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.06.15 10:26:49 | 000,000,000 | ---D | C] -- C:\ProgramData\VirtualizedApplications
[2012.06.15 08:43:07 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Mozilla
[2012.06.15 08:43:06 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Thunderbird
[2012.06.15 08:43:06 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Thunderbird
[2012.06.15 08:43:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.06.15 08:34:43 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Adobe
[2012.06.15 02:44:57 | 000,000,000 | ---D | C] -- C:\Intel
[2012.06.14 18:09:32 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Google
[2012.06.14 17:58:17 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\SoftGrid Client
[2012.06.14 17:58:17 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\SoftGrid Client
[2012.06.14 17:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (Deutsch)
[2012.06.14 17:57:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.06.14 17:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.06.14 17:57:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Application Virtualization Client
[2012.06.14 17:56:52 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Intel Corporation
[2012.06.14 17:56:49 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\TP
[2012.06.14 17:56:25 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Identities
[2012.06.14 17:56:23 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Contacts
[2012.06.14 17:56:23 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.06.14 17:56:23 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\VirtualStore
[2012.06.14 17:56:16 | 000,000,000 | RHSD | C] -- C:\Users\Manolis\Documents\Eigene Bilder
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Vorlagen
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\AppData\Local\Verlauf
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\AppData\Local\Temporary Internet Files
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Startmenü
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\SendTo
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Recent
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Netzwerkumgebung
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Lokale Einstellungen
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Documents\Eigene Videos
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Documents\Eigene Musik
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Eigene Dateien
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Druckumgebung
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Cookies
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\AppData\Local\Anwendungsdaten
[2012.06.14 17:56:16 | 000,000,000 | -HSD | C] -- C:\Users\Manolis\Anwendungsdaten
[2012.06.14 17:56:15 | 000,000,000 | --SD | C] -- C:\Users\Manolis\AppData\Roaming\Microsoft
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Pictures
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Music
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Links
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Favorites
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Downloads
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Documents
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\Desktop
[2012.06.14 17:56:15 | 000,000,000 | R--D | C] -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.06.14 17:56:15 | 000,000,000 | -H-D | C] -- C:\Users\Manolis\AppData
[2012.06.14 17:56:15 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Temp
[2012.06.14 17:56:15 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Microsoft
[2012.06.14 17:56:15 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Media Center Programs
[2012.06.14 17:56:15 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Roaming\Macromedia
[2012.06.14 17:55:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Rescue Disk 10
[2012.06.14 17:55:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CyberLink
[2012.06.14 17:55:52 | 000,000,000 | ---D | C] -- C:\Users\Manolis\AppData\Local\Power2Go
[2012.06.14 17:55:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2012
[2012.06.14 17:55:40 | 000,000,000 | R--D | C] -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.06.14 17:55:40 | 000,000,000 | R--D | C] -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.06.14 17:55:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012.06.14 17:55:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2012.06.14 17:55:16 | 000,615,728 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.06.14 17:54:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Memeo
[2012.06.14 17:54:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Memeo
[2012.06.14 17:54:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Memeo
[2012.06.14 17:54:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mediathek
[2012.06.14 17:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady
[2012.06.14 17:53:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\watchmi
[2012.06.14 17:53:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\watchmi
[2012.06.14 17:53:57 | 000,000,000 | ---D | C] -- C:\ProgramData\TvdPersonal
[2012.06.14 17:53:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Partner
[2012.06.14 17:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.06.14 17:53:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.06.14 17:53:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.06.14 17:51:49 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.06.14 17:51:49 | 000,000,000 | -HSD | C] -- C:\Documents and Settings
[2012.06.14 17:51:45 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.30 10:06:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.30 09:51:56 | 000,051,977 | ---- | M] () -- C:\Users\Manolis\Documents\Trojaner Board - 85104-otl-otlogfile-by-oldtimer.html
[2012.06.30 09:04:54 | 000,113,541 | ---- | M] () -- C:\Users\Manolis\Desktop\screen2.png
[2012.06.30 08:49:01 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.30 08:49:01 | 000,017,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.30 08:47:18 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.30 08:46:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.30 08:27:43 | 3126,571,008 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.29 14:47:26 | 000,000,000 | ---- | M] () -- C:\Users\Manolis\defogger_reenable
[2012.06.29 11:56:02 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.06.29 11:27:23 | 001,500,294 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.29 11:27:23 | 000,654,602 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.29 11:27:23 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.29 11:27:23 | 000,130,216 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.29 11:27:23 | 000,106,606 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.28 17:18:16 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.28 17:17:19 | 000,000,017 | ---- | M] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012.06.25 14:29:35 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.06.22 12:19:22 | 000,059,868 | ---- | M] () -- C:\Users\Manolis\Documents\DasElendeBildVonAthen.htm
[2012.06.22 10:30:49 | 000,150,510 | ---- | M] () -- C:\Users\Manolis\Documents\2012_06rechnung_4749610874.pdf
[2012.06.20 09:34:22 | 000,051,825 | ---- | M] () -- C:\Users\Manolis\Documents\Analysi Krisi Ellada.htm
[2012.06.17 13:07:49 | 000,033,123 | ---- | M] () -- C:\Users\Manolis\Documents\SYRIZA-Elpida-images.gif
[2012.06.17 10:25:28 | 000,017,408 | ---- | M] () -- C:\Users\Manolis\AppData\Local\WebpageIcons.db
[2012.06.17 08:28:35 | 000,001,107 | ---- | M] () -- C:\Users\Manolis\Desktop\Dokumente.lnk
[2012.06.16 11:33:56 | 000,002,049 | ---- | M] () -- C:\Users\Manolis\Desktop\Adobe Photoshop CS2.lnk
[2012.06.16 11:30:48 | 000,001,389 | ---- | M] () -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
[2012.06.15 13:49:21 | 011,027,660 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.06.15 09:06:56 | 000,002,666 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.06.15 08:43:03 | 000,002,094 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.06.15 08:29:08 | 000,001,304 | ---- | M] () -- C:\Users\Manolis\Desktop\Notepad.lnk
[2012.06.15 08:25:47 | 000,002,467 | ---- | M] () -- C:\Users\Manolis\Desktop\Microsoft Excel Starter 2010.lnk
[2012.06.15 08:25:33 | 000,002,465 | ---- | M] () -- C:\Users\Manolis\Desktop\Microsoft Word Starter 2010.lnk
[2012.06.15 02:50:37 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.06.15 02:50:37 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.06.14 18:24:54 | 000,152,233 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat
[2012.06.14 18:24:53 | 000,107,177 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat
[2012.06.14 17:55:16 | 000,615,728 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.06.05 13:34:28 | 000,018,832 | ---- | M] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.30 09:51:56 | 000,051,977 | ---- | C] () -- C:\Users\Manolis\Documents\Trojaner Board - 85104-otl-otlogfile-by-oldtimer.html
[2012.06.30 09:05:10 | 000,113,541 | ---- | C] () -- C:\Users\Manolis\Desktop\screen2.png
[2012.06.29 14:47:26 | 000,000,000 | ---- | C] () -- C:\Users\Manolis\defogger_reenable
[2012.06.29 11:56:02 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.06.29 11:56:02 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.06.28 17:17:19 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012.06.28 15:57:44 | 000,016,896 | ---- | C] () -- C:\Windows\SysNative\sasnative64.exe
[2012.06.25 14:29:35 | 000,002,023 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012.06.24 17:18:53 | 000,150,510 | ---- | C] () -- C:\Users\Manolis\Documents\2012_06rechnung_4749610874.pdf
[2012.06.23 10:28:19 | 302,561,935 | ---- | C] () -- C:\Users\Manolis\Documents\PS9_Tryout_d.zip
[2012.06.22 12:19:38 | 000,059,868 | ---- | C] () -- C:\Users\Manolis\Documents\DasElendeBildVonAthen.htm
[2012.06.20 09:34:21 | 000,051,825 | ---- | C] () -- C:\Users\Manolis\Documents\Analysi Krisi Ellada.htm
[2012.06.17 13:07:49 | 000,033,123 | ---- | C] () -- C:\Users\Manolis\Documents\SYRIZA-Elpida-images.gif
[2012.06.17 10:25:28 | 000,017,408 | ---- | C] () -- C:\Users\Manolis\AppData\Local\WebpageIcons.db
[2012.06.17 08:28:35 | 000,001,107 | ---- | C] () -- C:\Users\Manolis\Desktop\Dokumente.lnk
[2012.06.16 12:28:01 | 000,346,177 | ---- | C] () -- C:\Users\Manolis\Documents\PDF in Word Umwandeln — 100% Kostenlos!.mht
[2012.06.16 12:28:01 | 000,061,945 | ---- | C] () -- C:\Users\Manolis\Documents\ManolisUrlaub10.07.2010.pdf
[2012.06.16 12:28:00 | 000,459,887 | R--- | C] () -- C:\Users\Manolis\Documents\bailout.jpg
[2012.06.16 12:28:00 | 000,435,803 | ---- | C] () -- C:\Users\Manolis\Documents\Arkturos115D6D3-n2.pdf
[2012.06.16 12:28:00 | 000,002,426 | ---- | C] () -- C:\Users\Manolis\Documents\Giannoukos-Medium Format Photography by Dimitrios Giannoukos.mht
[2012.06.16 11:33:56 | 000,002,049 | ---- | C] () -- C:\Users\Manolis\Desktop\Adobe Photoshop CS2.lnk
[2012.06.16 11:30:58 | 000,002,093 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help Center.lnk
[2012.06.16 11:30:48 | 000,001,389 | ---- | C] () -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
[2012.06.16 11:30:39 | 000,002,075 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge.lnk
[2012.06.16 11:30:19 | 000,002,049 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS2.lnk
[2012.06.16 11:30:19 | 000,002,046 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ImageReady CS2.lnk
[2012.06.15 08:43:03 | 000,002,106 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.06.15 08:43:03 | 000,002,094 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.06.15 08:29:08 | 000,001,304 | ---- | C] () -- C:\Users\Manolis\Desktop\Notepad.lnk
[2012.06.15 08:25:47 | 000,002,467 | ---- | C] () -- C:\Users\Manolis\Desktop\Microsoft Excel Starter 2010.lnk
[2012.06.15 08:25:33 | 000,002,465 | ---- | C] () -- C:\Users\Manolis\Desktop\Microsoft Word Starter 2010.lnk
[2012.06.15 02:43:29 | 3126,571,008 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.14 17:57:24 | 011,027,660 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.06.14 17:55:55 | 000,152,233 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat
[2012.06.14 17:55:55 | 000,107,177 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat
[2012.06.14 17:55:44 | 000,001,413 | ---- | C] () -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.06.14 17:55:41 | 000,001,447 | ---- | C] () -- C:\Users\Manolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.06.14 17:54:09 | 000,002,101 | ---- | C] () -- C:\Users\Public\Desktop\Erstellen Sie Ihre Support-DVD.lnk
[2012.06.14 17:54:09 | 000,002,003 | ---- | C] () -- C:\Users\Public\Desktop\ALDI Nord Foto Service.lnk
[2012.06.14 17:54:09 | 000,001,943 | ---- | C] () -- C:\Users\Public\Desktop\MEDION Serviceportal.lnk
[2012.06.14 17:54:09 | 000,001,197 | ---- | C] () -- C:\Users\Public\Desktop\ALDI Nord Startseite.lnk
[2012.06.14 17:53:58 | 000,002,527 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk
[2012.06.14 17:53:55 | 000,002,360 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[2012.06.14 17:53:46 | 000,002,666 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.06.14 17:53:37 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.14 17:53:37 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.13 00:49:53 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012.03.13 00:49:51 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012.03.13 00:49:48 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012.03.13 00:49:48 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012.03.13 00:49:46 | 013,212,672 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.01.11 06:39:16 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
 
========== LOP Check ==========
 
[2012.06.29 20:09:59 | 000,000,000 | ---D | M] -- C:\Users\Manolis\AppData\Roaming\SoftGrid Client
[2012.06.28 18:18:03 | 000,000,000 | ---D | M] -- C:\Users\Manolis\AppData\Roaming\Systweak
[2012.06.15 08:43:06 | 000,000,000 | ---D | M] -- C:\Users\Manolis\AppData\Roaming\Thunderbird
[2012.06.14 17:58:40 | 000,000,000 | ---D | M] -- C:\Users\Manolis\AppData\Roaming\TP
[2009.07.14 07:08:49 | 000,031,012 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2012.06.28 20:25:22 | 000,022,743 | ---- | M] ()(C:\Users\Manolis\Documents\? ?e???? St?? t?? ????d??.docx) -- C:\Users\Manolis\Documents\Η Μεγάλη Στοά της Ελλάδος.docx
[2012.06.28 20:22:24 | 000,022,743 | ---- | C] ()(C:\Users\Manolis\Documents\? ?e???? St?? t?? ????d??.docx) -- C:\Users\Manolis\Documents\Η Μεγάλη Στοά της Ελλάδος.docx
[2012.06.23 09:53:15 | 000,041,481 | ---- | M] ()(C:\Users\Manolis\Documents\G???????S ?e?µe??.rtf) -- C:\Users\Manolis\Documents\ΓΕΡΜΑΝΙΑΣ κειμενο.rtf
[2012.06.23 08:47:09 | 000,041,481 | ---- | C] ()(C:\Users\Manolis\Documents\G???????S ?e?µe??.rtf) -- C:\Users\Manolis\Documents\ΓΕΡΜΑΝΙΑΣ κειμενο.rtf
[2012.06.17 08:27:51 | 000,180,216 | ---- | M] ()(C:\Users\Manolis\Documents\? ?at??a t?? pe????.docx) -- C:\Users\Manolis\Documents\Η κατάρα του πεύκου.docx
[2012.06.17 08:25:26 | 000,180,216 | ---- | C] ()(C:\Users\Manolis\Documents\? ?at??a t?? pe????.docx) -- C:\Users\Manolis\Documents\Η κατάρα του πεύκου.docx
[2012.06.16 12:28:00 | 000,711,168 | ---- | C] ()(C:\Users\Manolis\Documents\?as??????t????.doc) -- C:\Users\Manolis\Documents\ΒασικόςΜέτοχος.doc
[2012.06.16 12:28:00 | 000,625,152 | ---- | C] ()(C:\Users\Manolis\Documents\??????eta??????????.doc) -- C:\Users\Manolis\Documents\ΑρθροΜεταΤιςΕκλογές.doc
[2012.06.16 12:28:00 | 000,212,480 | ---- | C] ()(C:\Users\Manolis\Documents\Chatzitheodorou16.4.12-Î£Î±Î»Ï?Î¯Ï?Î¼Î± Î³Î¹Î± Î?Ï?Ï?Ï?Î½Î¹Ï?Î·.doc) -- C:\Users\Manolis\Documents\Chatzitheodorou16.4.12-Î£Î±Î»Ï€Î¯ÏƒÎ¼Î± Î³Î¹Î± Î‘Ï†Ï…Ï€Î½Î¹ÏƒÎ·.doc
[2012.06.16 12:28:00 | 000,082,432 | R--- | C] ()(C:\Users\Manolis\Documents\????s ?a? ?pe?????s.doc) -- C:\Users\Manolis\Documents\Λογοσ και Υπερλογοσ.doc
[2012.06.16 12:28:00 | 000,080,384 | ---- | C] ()(C:\Users\Manolis\Documents\St?at????? pe??ß?????ta ?a? e?????? st?at?????? ?a? ?? e?e??e?a???.doc) -- C:\Users\Manolis\Documents\Στρατηγικά περιβάλλοντα και εθνικές στρατηγικές και οι ενεργειακοί.doc
[2012.06.16 12:28:00 | 000,071,680 | ---- | C] ()(C:\Users\Manolis\Documents\?a ???????Ge???t???a????Ge?µa??a?.doc) -- C:\Users\Manolis\Documents\Τα χρέηΤηςΓενοκτονίαςΤηςΓερμανίας.doc
[2012.06.16 12:28:00 | 000,068,608 | ---- | C] ()(C:\Users\Manolis\Documents\???t?????.doc) -- C:\Users\Manolis\Documents\Αρκτουρος.doc
[2012.06.16 12:28:00 | 000,037,888 | ---- | C] ()(C:\Users\Manolis\Documents\?p?t??pe?a.doc) -- C:\Users\Manolis\Documents\Επιτροπεία.doc
[2012.06.16 12:28:00 | 000,036,864 | ---- | C] ()(C:\Users\Manolis\Documents\????????a???.doc) -- C:\Users\Manolis\Documents\Κουλουριανος.doc
[2012.06.16 12:28:00 | 000,021,504 | ---- | C] ()(C:\Users\Manolis\Documents\?????te?a?a?a???a?aF??????a?t??µa??a.doc) -- C:\Users\Manolis\Documents\ΑνοίξτεΤαΠαραθυραΝαΦυγουνΤαΝτουμανια.doc
[2012.06.16 12:17:09 | 000,000,000 | ---D | M](C:\Users\Manolis\Documents\?a???µ?e?-Sprichwörter) -- C:\Users\Manolis\Documents\Παροιμιες-Sprichwörter
[2012.06.16 12:17:09 | 000,000,000 | ---D | C](C:\Users\Manolis\Documents\?a???µ?e?-Sprichwörter) -- C:\Users\Manolis\Documents\Παροιμιες-Sprichwörter
[2012.05.11 13:19:52 | 000,625,152 | ---- | M] ()(C:\Users\Manolis\Documents\??????eta??????????.doc) -- C:\Users\Manolis\Documents\ΑρθροΜεταΤιςΕκλογές.doc
[2012.04.17 14:35:42 | 000,212,480 | ---- | M] ()(C:\Users\Manolis\Documents\Chatzitheodorou16.4.12-Î£Î±Î»Ï?Î¯Ï?Î¼Î± Î³Î¹Î± Î?Ï?Ï?Ï?Î½Î¹Ï?Î·.doc) -- C:\Users\Manolis\Documents\Chatzitheodorou16.4.12-Î£Î±Î»Ï€Î¯ÏƒÎ¼Î± Î³Î¹Î± Î‘Ï†Ï…Ï€Î½Î¹ÏƒÎ·.doc
[2012.02.20 18:47:02 | 000,071,680 | ---- | M] ()(C:\Users\Manolis\Documents\?a ???????Ge???t???a????Ge?µa??a?.doc) -- C:\Users\Manolis\Documents\Τα χρέηΤηςΓενοκτονίαςΤηςΓερμανίας.doc
[2012.01.31 13:48:54 | 000,037,888 | ---- | M] ()(C:\Users\Manolis\Documents\?p?t??pe?a.doc) -- C:\Users\Manolis\Documents\Επιτροπεία.doc
[2012.01.26 14:19:10 | 000,080,384 | ---- | M] ()(C:\Users\Manolis\Documents\St?at????? pe??ß?????ta ?a? e?????? st?at?????? ?a? ?? e?e??e?a???.doc) -- C:\Users\Manolis\Documents\Στρατηγικά περιβάλλοντα και εθνικές στρατηγικές και οι ενεργειακοί.doc
[2012.01.11 15:23:28 | 000,068,608 | ---- | M] ()(C:\Users\Manolis\Documents\???t?????.doc) -- C:\Users\Manolis\Documents\Αρκτουρος.doc
[2011.12.15 14:57:56 | 000,036,864 | ---- | M] ()(C:\Users\Manolis\Documents\????????a???.doc) -- C:\Users\Manolis\Documents\Κουλουριανος.doc
[2011.12.12 16:16:28 | 000,711,168 | ---- | M] ()(C:\Users\Manolis\Documents\?as??????t????.doc) -- C:\Users\Manolis\Documents\ΒασικόςΜέτοχος.doc
[2011.12.02 10:26:26 | 000,082,432 | R--- | M] ()(C:\Users\Manolis\Documents\????s ?a? ?pe?????s.doc) -- C:\Users\Manolis\Documents\Λογοσ και Υπερλογοσ.doc
[2011.11.28 13:13:10 | 000,021,504 | ---- | M] ()(C:\Users\Manolis\Documents\?????te?a?a?a???a?aF??????a?t??µa??a.doc) -- C:\Users\Manolis\Documents\ΑνοίξτεΤαΠαραθυραΝαΦυγουνΤαΝτουμανια.doc

< End of report >

--- --- ---

markusg · 30.06.2012, 12:49

hi
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Emmanuil · 01.07.2012, 08:15

Hallo Markus,
ich habe die Malwarebytes downgeloaded und installiert

Ich kann aber bei Malwarebytes nicht auf Aktualisierung --> Suche
nach Aktualisierung klicken, da die angezeigte Tafel nicht aktiv ist

Nach vielen Versuchen bin ich nahe an der Verzweiflung, so doof kann ich doch nicht sein.

Was mache ich bloss falsch? Außerdem habe ich plötzlich babylon als Startseite, wo ich früher google hatte, ich wollte aber babylon nicht. Doch das werde ich irgendwie

Schönen Gruß
Emmanuil

markusg · 01.07.2012, 11:50

hi dann scanne mal ohne update.

Emmanuil · 01.07.2012, 15:18

Hallo Markus,
so oft ich es versucht habe, ich kriege die Malwarebytes nicht richtig installiert, folglich funktionieren sie nicht.
Ich fühle mich wie in einem Programmier-Dschungel, in dem ich mich nicht im geringsten auskenne.
Muss das alles so schwierig sein? Einen normalen Kopf habe ich schon
Gruß
Emmanuel

Hallo Markus,
endlich habs raus. Es kann nur funktionieren, wenn ich die Software kaufe.
Gruß
Emmanuil

markusg · 02.07.2012, 13:38

nein, das stimmt nicht, malwarebytes funktioniert auch in der kostenlosen version.
bist du sicher das du Malwarebytes instaliert hast und nicht irgendwas anderes?

Emmanuil · 02.07.2012, 15:03

Hallo Markus,

irgendwie habe ich den Link downgeloaded und einen Quick-Start gemacht.
Hier die Ergebnisse:

Infizierte Dateien: 2
C:\Users\Manolis\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt.
C:\Users\Manolis\AppData\Local\Temp\ICReinstall_ICReinstall_DownloadManagerSetup.exe (PUP.Adware.InstallCore) -> Keine Aktion durchgeführt.

Die beiden Datein wurden entfernt oder in Quarantäne geschoben.

Ich hoffe, das wars

Hab vielen Dank
Emmanuil

markusg · 03.07.2012, 14:03

poste das vollständig log bitte, und mache dann noch mal nen vollständigen scan

01.07.2012, 11:50	#6
markusg /// Malware-holic	Malware auf der Festplatte (CK Visitenkarten Designer) hi dann scanne mal ohne update. __________________ --> Malware auf der Festplatte (CK Visitenkarten Designer)

Malware auf der Festplatte (CK Visitenkarten Designer)

Log-Analyse und Auswertung: Malware auf der Festplatte (CK Visitenkarten Designer)