| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: neuer BKA-Trojaner? (GVU)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.07.2012, 22:17
| #1 |
| |  neuer BKA-Trojaner? (GVU) Hallo, seit heute Mittag wird mir mein PC gesperrt - allerdings nur, wenn ich einen Internetzugang herstelle (offline) läuft der PC. Ich habe recherchiert und festgestellt, dass es der BKA-Trojaner oder auch GVU-Trojaner ist. Allerdings habe ich diesen weder mit dem Kaspersky winunlocker 10.0 noch mit dem 10.0.3 entfernen können (Anleitung nach Chip bzw. botfrei.de). Nach einiger Suche bin ich auf diese Seite gelangt und habe die Anleitung für die "Hilfesuchenden" durchgearbeitet. Code:
ATTFilter 7.2012 22:15:05 - Run 1 OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Ingo\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,97 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 66,54% Memory free 3,93 Gb Paging File | 3,17 Gb Available in Paging File | 80,60% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 49,26 Gb Total Space | 15,09 Gb Free Space | 30,63% Space Free | Partition Type: NTFS Drive D: | 62,40 Gb Total Space | 51,49 Gb Free Space | 82,51% Space Free | Partition Type: NTFS Drive E: | 24,00 Mb Total Space | 14,24 Mb Free Space | 59,34% Space Free | Partition Type: NTFS Drive I: | 1,92 Gb Total Space | 0,50 Gb Free Space | 25,96% Space Free | Partition Type: FAT Computer Name: THINKPAD | User Name: Ingo | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.02 22:03:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe PRC - [2012.06.12 18:19:31 | 000,935,480 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe PRC - [2012.06.12 18:19:30 | 001,196,600 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\ScriptHelperInstaller\11.1.0\ScriptHelper.exe PRC - [2012.06.12 18:19:29 | 001,104,440 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe PRC - [2012.05.18 01:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe PRC - [2011.12.14 13:23:34 | 001,212,224 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe PRC - [2011.12.14 13:23:32 | 001,514,304 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe PRC - [2011.08.01 15:56:42 | 001,821,576 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliPoint\ipoint.exe PRC - [2011.04.19 03:52:00 | 000,143,360 | ---- | M] () -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.04.23 00:16:46 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe PRC - [2008.07.15 17:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE ========== Modules (No Company Name) ========== MOD - [2012.07.02 15:08:59 | 000,242,336 | ---- | M] () -- C:\Users\Ingo\AppData\Local\Temp\0_0u_l.exe MOD - [2012.06.12 18:19:32 | 000,132,664 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\SiteSafety.dll MOD - [2012.06.12 18:19:30 | 001,196,600 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\ScriptHelperInstaller\11.1.0\ScriptHelper.exe MOD - [2012.06.12 18:19:29 | 001,104,440 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe MOD - [2012.06.12 18:19:28 | 002,068,536 | ---- | M] () -- C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF MOD - [2011.02.09 02:56:38 | 000,296,448 | ---- | M] () -- C:\Programme\MyToolsNotepad++\NppShell_04.dll ========== Win32 Services (SafeList) ========== SRV - [2012.06.24 16:41:29 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.06.12 18:19:31 | 000,935,480 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe -- (vToolbarUpdater11.1.0) SRV - [2012.05.27 18:00:11 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.03.30 12:21:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2011.12.14 13:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.12.14 13:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp) SRV - [2011.06.12 12:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2011.04.19 03:52:00 | 000,292,200 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Programme\ThinkPad\Utilities\DOZESVC.EXE -- (DozeSvc) SRV - [2011.04.19 03:52:00 | 000,143,360 | ---- | M] () [Auto | Running] -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc) SRV - [2011.04.19 03:52:00 | 000,083,304 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service) SRV - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service) SRV - [2010.12.03 10:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD) SRV - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC) SRV - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC) SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.12.12 01:47:44 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2008.07.15 17:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters) SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV - [2012.07.02 22:06:38 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8306A756-E9C7-4760-9224-E145ADD30EBC}\MpKsl183decf0.sys -- (MpKsl183decf0) DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2011.09.22 18:10:46 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2011.07.18 15:31:56 | 000,033,088 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\psadd.sys -- (psadd) DRV - [2011.06.25 17:27:43 | 000,083,872 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2011.06.25 17:27:43 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2011.04.19 03:52:00 | 000,025,968 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DOZEHDD.SYS -- (DozeHDD) DRV - [2011.04.19 03:52:00 | 000,013,424 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\TPPWR32V.SYS -- (TPPWRIF) DRV - [2011.04.18 15:43:36 | 000,009,216 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter) DRV - [2011.04.18 15:43:26 | 000,072,832 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2011.01.13 14:04:50 | 000,122,992 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsX86.sys -- (Shockprf) DRV - [2011.01.13 14:02:56 | 000,020,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsHM86.sys -- (TPDIGIMN) DRV - [2010.12.30 13:20:22 | 000,114,688 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnet.sys -- (ZTEusbnet) DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zteusbvoice.sys -- (ZTEusbvoice) DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k) DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea) DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.09.07 14:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\smiif32.sys -- (lenovo.smi) DRV - [2009.12.12 01:48:04 | 000,025,984 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901) DRV - [2009.09.06 00:21:46 | 009,833,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.07.14 01:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R) DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R) DRV - [2009.07.02 10:16:22 | 000,038,336 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tvti2c.sys -- (TVTI2C) DRV - [2009.05.11 09:33:48 | 000,088,832 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LenovoRd.sys -- (LenovoRd) DRV - [2008.11.28 14:34:56 | 000,035,840 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf_devolo.sys -- (NPF_devolo) NetGroup Packet Filter Driver (devolo) DRV - [2007.02.24 15:42:00 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007.01.23 17:40:00 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006.11.27 17:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={FDE24DCE-A0F5-43A0-B374-AB601787B7AC}&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&lang=de&ds=tt014&pr=sa&d=&v=&sap=hp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 04 6F 7F ED CB B9 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={30CB5269-6515-447F-8BB2-33E14680D356}&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&lang=de&ds=tt014&pr=sa&d=2011-12-22 15:23:52&v=10.0.0.7&sap=dsp&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7Bec844494-319f-433c-8a66-184484e51697%7D&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&ds=tt014&v=10.2.0.3&lang=de&pr=sa&d=2011-12-22%2015%3A23%3A52&sap=ku&q=" FF - prefs.js..network.proxy.type: 4 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll () FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.14 21:28:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.24 16:41:30 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.14 18:09:47 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.14 21:28:05 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.24 16:41:30 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.14 18:09:47 | 000,000,000 | ---D | M] [2011.04.13 22:03:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ingo\AppData\Roaming\mozilla\Extensions [2012.06.29 20:03:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ingo\AppData\Roaming\mozilla\Firefox\Profiles\pczb0y18.default\extensions [2012.04.18 23:25:48 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Ingo\AppData\Roaming\mozilla\Firefox\Profiles\pczb0y18.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.06.28 18:56:44 | 000,000,853 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\11-suche.xml [2012.06.28 18:56:44 | 000,002,209 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\englische-ergebnisse.xml [2012.06.28 18:56:44 | 000,010,506 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\gmx-suche.xml [2012.06.28 18:56:44 | 000,002,368 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\lastminute.xml [2012.06.28 18:56:44 | 000,005,489 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\webde-suche.xml [2012.01.03 12:38:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.04.14 16:00:35 | 000,340,198 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI [2012.06.29 20:03:16 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.02.11 10:21:35 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI [2012.06.28 18:56:28 | 000,578,962 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI [2012.06.24 16:41:30 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.12.14 12:41:14 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.06.24 16:41:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.12 18:19:28 | 000,003,768 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml [2012.06.24 16:41:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.24 16:41:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.24 16:41:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.24 16:41:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.24 16:41:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll () O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [nwiz] C:\Windows\System32\nwiz.exe () O4 - HKLM..\Run: [ROC_roc_dec12] C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe () O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe () O4 - Startup: C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LocalAccountTokenFilterPolicy = 1 O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Free YouTube Download - C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB0A1241-CD6B-41F7-85AF-F5CB4E20441F}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CAF25033-F873-4971-9454-7088B2344526}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll () O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{c3b1f613-6c31-11e0-9af6-001c25bab085}\Shell - "" = AutoRun O33 - MountPoints2\{c3b1f613-6c31-11e0-9af6-001c25bab085}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.02 22:11:28 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe [2012.06.28 17:26:07 | 000,000,000 | ---D | C] -- C:\Program Files\Quick Stego [2012.06.20 20:04:42 | 000,000,000 | ---D | C] -- C:\Users\Ingo\workspace [2012.06.15 21:15:22 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Google [2012.06.15 21:15:21 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2012.06.15 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Thunderbird [2012.06.15 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Thunderbird [2012.06.11 19:20:41 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\Outlook-Dateien [2012.06.08 17:26:45 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\My Photos [2012.06.08 17:26:45 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\My Documents [2012.06.08 17:25:02 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Outlook [2012.06.08 17:23:16 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\ASUS [2012.06.08 17:01:27 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\{FFFA2FB9-4857-4475-8379-F36343DA5801} [2012.06.08 16:55:38 | 000,000,000 | ---D | C] -- C:\temp [2012.06.08 16:53:31 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\{BA5F88F1-D2F2-4E27-85A3-42F74C7F2FC2} [2012.06.08 16:53:26 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\Asus WebStorage [2012.06.08 16:53:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS [2012.06.08 16:53:22 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\ASUS WebStorage [2012.06.08 16:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ASUS WebStorage [2012.06.08 16:53:04 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS [2012.06.08 16:48:54 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\eCareme [2012.06.05 19:45:30 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tools [2012.06.05 17:14:06 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Skype [2012.06.05 17:14:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.06.05 17:13:59 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.06.05 17:13:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.06.03 19:22:44 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Microsoft_Corporation ========== Files - Modified Within 30 Days ========== [2012.07.02 22:13:44 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.02 22:13:44 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.02 22:12:25 | 000,000,000 | ---- | M] () -- C:\Users\Ingo\defogger_reenable [2012.07.02 22:06:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.02 22:04:08 | 000,302,592 | ---- | M] () -- C:\Users\Ingo\Desktop\ez0msq3b.exe [2012.07.02 22:03:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe [2012.07.02 22:02:34 | 000,050,477 | ---- | M] () -- C:\Users\Ingo\Desktop\Defogger.exe [2012.07.02 21:47:06 | 004,503,728 | ---- | M] () -- C:\ProgramData\l_u0_0.pad [2012.07.02 21:05:18 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.02 16:55:52 | 000,656,500 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.07.02 16:55:52 | 000,618,342 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.07.02 16:55:52 | 000,131,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.07.02 16:55:52 | 000,107,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.07.02 15:12:05 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job [2012.07.02 15:09:00 | 000,001,885 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.01 11:34:13 | 000,003,304 | ---- | M] () -- C:\bootsqm.dat [2012.06.29 23:06:38 | 000,034,649 | ---- | M] () -- C:\Users\Ingo\.recently-used.xbel [2012.06.28 07:03:30 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job [2012.06.14 18:55:55 | 000,416,840 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.06.10 20:26:17 | 000,000,046 | ---- | M] () -- C:\Users\Ingo\.prolog_console_history ========== Files Created - No Company Name ========== [2012.07.02 22:12:25 | 000,000,000 | ---- | C] () -- C:\Users\Ingo\defogger_reenable [2012.07.02 22:11:28 | 000,302,592 | ---- | C] () -- C:\Users\Ingo\Desktop\ez0msq3b.exe [2012.07.02 22:11:28 | 000,050,477 | ---- | C] () -- C:\Users\Ingo\Desktop\Defogger.exe [2012.07.02 15:08:59 | 004,503,728 | ---- | C] () -- C:\ProgramData\l_u0_0.pad [2012.07.02 15:08:59 | 000,001,885 | ---- | C] () -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.01 11:34:13 | 000,003,304 | ---- | C] () -- C:\bootsqm.dat [2012.06.29 23:06:38 | 000,034,649 | ---- | C] () -- C:\Users\Ingo\.recently-used.xbel [2012.06.28 17:26:08 | 000,001,018 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quick Stego.lnk [2012.06.10 20:25:14 | 000,000,046 | ---- | C] () -- C:\Users\Ingo\.prolog_console_history [2012.03.03 00:27:17 | 000,017,985 | ---- | C] () -- C:\Windows\War3Unin.dat [2011.12.15 17:04:52 | 000,000,154 | ---- | C] () -- C:\Users\Ingo\.appletviewer [2011.09.05 09:19:56 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config [2011.08.21 12:11:13 | 000,000,268 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc [2011.06.25 17:25:19 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2011.06.25 17:25:14 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011.04.14 21:22:27 | 000,262,652 | ---- | C] () -- C:\Windows\hpwins23.dat [2011.04.14 21:22:27 | 000,002,075 | ---- | C] () -- C:\Windows\hpwmdl23.dat [2011.04.13 21:36:46 | 001,731,104 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll [2011.04.13 21:36:46 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe [2011.04.13 21:36:46 | 001,514,016 | ---- | C] () -- C:\Windows\System32\nView.dll [2011.04.13 21:36:46 | 001,108,512 | ---- | C] () -- C:\Windows\System32\nvwimg.dll [2011.04.13 21:36:46 | 000,473,632 | ---- | C] () -- C:\Windows\System32\nvShell.dll [2011.04.13 21:36:46 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvAppBar.exe [2011.04.13 21:36:46 | 000,267,296 | ---- | C] () -- C:\Windows\System32\nvTaskbar.exe ========== LOP Check ========== [2012.06.26 19:59:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\.purple [2011.06.18 13:08:25 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Ashampoo [2012.06.29 14:39:44 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\ASUS [2012.06.08 16:53:22 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\ASUS WebStorage [2012.04.18 23:26:15 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\DVDVideoSoft [2012.04.18 23:25:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers [2012.06.08 16:48:54 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\eCareme [2011.04.14 08:49:41 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Foxit Software [2012.06.29 22:25:01 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\gtk-2.0 [2011.09.02 15:51:14 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\JavaEditor [2011.04.14 08:18:31 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Notepad++ [2012.06.08 17:25:02 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Outlook [2011.05.03 20:23:12 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\PCDr [2011.08.15 21:32:02 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Promethean [2011.05.01 13:12:50 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\PwrMgr [2011.12.04 16:21:26 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\SWI-Prolog [2012.06.15 19:23:50 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Thunderbird [2011.10.22 21:17:56 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\TightVNC [2011.10.14 10:50:55 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\TuneUp Software [2011.05.03 20:16:05 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Update [2011.04.27 18:19:05 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Vodafone [2011.04.23 20:02:09 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Vodafone Mobile Broadband [2011.08.21 12:11:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\WinCachebox [2012.06.28 07:03:30 | 000,000,528 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job [2012.06.12 07:01:27 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.07.02 15:12:05 | 000,000,466 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job ========== Purity Check ========== < End of report > Diesen Beitrag habe ich von einem 2. PC geschrieben ... der andere lies ja keinen Internetzugriff mehr zu. |
|
03.07.2012, 18:34
| #2 |
| /// Malware-holic   | neuer BKA-Trojaner? (GVU) hi
__________________dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
[2012.07.02 15:08:59 | 000,001,885 | ---- | C] () -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
:Files
:Commands
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
__________________ |
|
| Themen zu neuer BKA-Trojaner? (GVU) |
| adobe, application/pdf:, autorun, avg, avg secure search, avg security toolbar, bho, cid, converter, defender, document, entfernen, explorer, firefox, firefox 13.0.1, flash player, format, gesperrt, home, kaspersky, langs, locker, monitor, mozilla, mp3, plug-in, registry, scan, searchscopes, secure search, security, senden, software, temp, vtoolbarupdater, windows |
Linear-Darstellung
