| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus: Computerkriminalität des criminal Inteligence Service /BPD Einheit 5.2Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.07.2012, 12:01
| #1 |
| |  Virus: Computerkriminalität des criminal Inteligence Service /BPD Einheit 5.2 Schönen Montag, liebes Trojan-Board Team, habe mir einen fiesen Trojaner eingefangen, bei dem, die euch wohl schon bekannte, oben angeführte Meldung erscheint.  Fehlermeldung, welche den Bildschirm sperrt: Computerkriminalität des Criminal Intelligence Service Einheit 5.2. mit Staatswappen (Österreich) und zusätzlicher Aufforderung einen Gelbetrag von 100 Euro via Paypal zu überweisen. Da der Computer sich sofort nach laden von Windows 7 sperrt (bzw. die Fehlermeldung erscheint) habe ich den Abesicherten Modus gestartet und mich übers Inet schlau gemacht. Ich habe noch 3 Programme im abgesicherten Modus installiert, jedoch, da wie ich auch schon vorher gedacht habe eine Registrierung Notwenig ist mich dieshingehend nicht weiterbeschäftigt. Denke jedoch nicht, dass die 3 Programme wenn sie nicht ausgeführt werden Schaden können ? der Link der angeführten Programme und der Virusbehebung: hxxp://www.killallvirus.com/download/ Nach weiterem stöbern im I-net habe ich dann Gott Sei Dank euer Forum entdeckt. Ich habe die Anweisungen von T'John  , welche in einem anderen Thema schon gepost wurden befolgt und darf euch anbei meine Scann Ergebnisse posten.Foreneintrag von T'John: http://www.trojaner-board.de/119928-...eit-5-2-a.html Ich hoffe auch mir kann geholfen werden  Code:
ATTFilter OTL logfile created on: 7/23/2012 1:10:47 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Ultimate (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.61 Mb Free Space | 75.61% Space Free | Partition Type: NTFS
Drive D: | 195.21 Gb Total Space | 18.05 Gb Free Space | 9.25% Space Free | Partition Type: NTFS
Drive E: | 503.32 Gb Total Space | 202.88 Gb Free Space | 40.31% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2012/06/11 13:19:14 | 000,239,616 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012/06/11 07:12:16 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- D:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012/07/20 11:07:11 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/20 13:07:29 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand] -- D:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/12/16 15:58:11 | 001,872,320 | ---- | M] (Emsi Software GmbH) [Auto] -- D:\Program Files (x86)\a-squared Free\a2service.exe -- (a2free)
SRV - [2010/12/02 15:45:18 | 000,218,432 | ---- | M] () [Auto] -- D:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/04 17:38:00 | 000,071,096 | ---- | M] () [Auto] -- D:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2009/07/21 08:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/13 10:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012/06/11 14:59:38 | 010,248,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2012/06/11 14:59:38 | 010,248,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/06/11 12:26:14 | 000,367,616 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/03/05 10:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto] -- D:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV:64bit: - [2012/02/23 08:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2011/05/18 02:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2010/09/29 13:14:00 | 000,030,208 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motmodem.sys -- (motmodem)
DRV:64bit: - [2010/09/29 13:13:36 | 000,021,504 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motccgp.sys -- (motccgp)
DRV:64bit: - [2010/04/27 19:57:20 | 000,016,200 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2010/04/27 19:57:14 | 000,036,936 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WmHidLo.sys -- (WmHidLo)
DRV:64bit: - [2010/04/27 19:57:12 | 000,026,440 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2010/04/27 17:03:12 | 000,077,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2010/04/27 17:02:42 | 000,043,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2010/04/01 09:44:06 | 000,026,624 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Motousbnet.sys -- (Motousbnet)
DRV:64bit: - [2010/02/18 03:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010/02/09 19:00:50 | 000,314,016 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010/02/09 19:00:49 | 000,043,680 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010/01/25 14:57:54 | 000,010,240 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motusbdevice.sys -- (motusbdevice)
DRV:64bit: - [2009/12/28 16:53:34 | 000,074,880 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2009/12/27 18:05:43 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- D:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2009/07/24 02:49:00 | 000,119,312 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/07/10 08:06:50 | 000,031,744 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motoandroid.sys -- (motandroidusb)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/28 12:47:38 | 000,033,160 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\point64k.sys -- (Point64)
DRV:64bit: - [2009/05/22 10:52:30 | 000,215,040 | ---- | M] (Realtek ) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/05/04 12:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot] -- D:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/01/29 12:18:12 | 000,009,216 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motccgpfl.sys -- (motccgpfl)
DRV:64bit: - [2009/01/29 12:11:38 | 000,006,144 | ---- | M] (Motorola Inc) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motfilt.sys -- (BTCFilterService)
DRV:64bit: - [2008/11/03 22:20:56 | 000,098,144 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- D:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2008/01/15 04:42:20 | 000,081,280 | ---- | M] (MCCI) [Kernel | On_Demand] -- D:\Windows\System32\drivers\zebrceb.sys -- (zebrceb) Sony Ericsson Cable Emulation Bus (WDM)
DRV:64bit: - [2007/11/02 10:52:02 | 000,008,576 | ---- | M] (Motorola) [Kernel | On_Demand] -- D:\Windows\System32\drivers\motswch.sys -- (MotoSwitchService)
DRV:64bit: - [2007/02/15 20:57:06 | 000,040,648 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2009/11/12 08:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand] -- D:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/02/19 05:39:06 | 000,044,344 | ---- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand] -- D:\Program Files (x86)\MSI\AutoBoot\NTGLM7X64.sys -- (AutoBoot)
DRV - [2008/12/12 10:27:46 | 000,018,432 | ---- | M] () [Kernel | On_Demand] -- D:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys -- (LGII2CDevice)
DRV - [2008/12/12 10:27:46 | 000,014,336 | ---- | M] () [Kernel | On_Demand] -- D:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys -- (LGDDCDevice)
DRV - [2007/02/15 20:57:06 | 000,040,648 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- D:\Windows\SysWOW64\drivers\ElbyCDFL.sys -- (ElbyCDFL)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Michael_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKU\Michael_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKU\Michael_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKU\Michael_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CA 74 86 09 72 E9 CA 01 [binary data]
IE - HKU\Michael_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: D:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: D:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/20 11:07:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/02 13:26:50 | 000,000,000 | ---D | M]
[2012/03/14 13:54:26 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/20 11:07:11 | 000,136,672 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/23 17:48:12 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/26 14:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012/06/20 13:14:48 | 000,001,392 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/06/20 13:14:48 | 000,002,252 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/20 13:14:48 | 000,001,153 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/06/20 13:14:48 | 000,006,805 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/20 13:14:48 | 000,001,178 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/06/20 13:14:48 | 000,001,105 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - D:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - D:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] D:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] D:\Windows\System32\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] D:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Start WingMan Profiler] D:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [AMD AVT] D:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CloneCDTray] D:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] D:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [PC Suite for Smartphones] D:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe ()
O4 - HKLM..\Run: [PDFPrint] D:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [PWRISOVM.EXE] D:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [StartCCC] D:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Michael_ON_D..\Run: [] D:\Users\Michael\AppData\Local\Temp\rgnygtgcuex.exe ()
O4 - HKU\Michael_ON_D..\Run: [{27D8AA53-36EE-7F65-C61D-A702705856CA}] File not found
O4 - HKU\Michael_ON_D..\Run: [Canaveral] File not found
O4 - HKU\Michael_ON_D..\Run: [DAEMON Tools Lite] D:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\Michael_ON_D..\Run: [EA Core] File not found
O4 - HKU\Michael_ON_D..\Run: [FreeAC] D:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe (Comfort Software Group)
O4 - HKU\Michael_ON_D..\Run: [msnmsgr] File not found
O4 - HKU\Michael_ON_D..\Run: [Steam] D:\Program Files (x86)\civ5\Steam\steam.exe (Valve Corporation)
O4 - HKU\Michael_ON_D..\Run: [Update] D:\Users\Michael\AppData\Roaming\rool0_pk.exe ()
O4 - HKU\Michael_ON_D..\Run: [VaultSysUi] File not found
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - D:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - D:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/07/23 02:56:42 | 000,000,000 | ---D | C] -- D:\sh4ldr
[2012/07/23 02:56:42 | 000,000,000 | ---D | C] -- D:\Program Files\Enigma Software Group
[2012/07/23 02:47:37 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Roaming\SpeedyPC Software
[2012/07/23 02:47:37 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Roaming\DriverCure
[2012/07/23 02:47:25 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedyPC Software
[2012/07/23 02:47:24 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Common Files\SpeedyPC Software
[2012/07/23 02:47:21 | 000,000,000 | ---D | C] -- D:\ProgramData\SpeedyPC Software
[2012/07/23 02:47:21 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\SpeedyPC Software
[2012/07/22 05:10:31 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Roaming\hellomoto
[2012/07/21 20:26:06 | 000,000,000 | ---D | C] -- D:\ProgramData\ATI
[2012/07/21 20:26:03 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\AMD APP
[2012/07/21 20:25:47 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012/07/21 20:08:57 | 000,000,000 | ---D | C] -- D:\Users\Michael\Desktop\Savegames
[2012/07/21 19:15:51 | 059,672,465 | ---- | C] (F1Pole.de) -- D:\Users\Michael\Desktop\Saison 2012 Mod 25.exe
[2012/07/21 15:23:42 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\rFactor
[2012/07/21 15:23:42 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\rFactor
[2012/07/21 14:01:28 | 000,000,000 | ---D | C] -- D:\Users\Michael\AppData\Local\Logitech
[2012/07/21 13:58:25 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012/07/21 13:57:56 | 000,000,000 | ---D | C] -- D:\Program Files\Common Files\Logitech
[2012/07/21 13:47:15 | 000,000,000 | ---D | C] -- D:\Users\Michael\Desktop\f12011savegames
[2012/07/15 10:35:37 | 000,000,000 | ---D | C] -- D:\Users\Michael\Desktop\Brena
[15 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ]
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/07/23 04:14:29 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2012/07/23 04:14:23 | 3219,841,024 | -HS- | M] () -- D:\hiberfil.sys
[2012/07/23 03:38:12 | 000,001,108 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/23 01:36:00 | 000,001,112 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/22 21:46:59 | 000,141,312 | ---- | M] () -- D:\Users\Michael\AppData\Roaming\rool0_pk.exe
[2012/07/22 16:51:37 | 000,000,876 | ---- | M] () -- D:\Users\Public\Desktop\Race Injection.lnk
[2012/07/22 16:51:35 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimBin
[2012/07/22 05:25:58 | 016,473,290 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2012/07/22 05:25:58 | 005,357,450 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2012/07/22 05:25:58 | 005,114,262 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2012/07/22 05:25:58 | 004,590,096 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2012/07/22 05:24:45 | 000,010,480 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/22 05:24:45 | 000,010,480 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/21 20:25:47 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012/07/21 19:37:51 | 000,466,520 | ---- | M] (Creative Labs) -- D:\Windows\System32\wrap_oal.dll
[2012/07/21 19:37:51 | 000,445,016 | ---- | M] (Creative Labs) -- D:\Windows\SysWow64\wrap_oal.dll
[2012/07/21 19:37:51 | 000,122,968 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\System32\OpenAL32.dll
[2012/07/21 19:37:51 | 000,109,144 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\SysWow64\OpenAL32.dll
[2012/07/21 19:23:48 | 000,001,190 | ---- | M] () -- D:\Users\Michael\Desktop\F1-2011 - Verknüpfung.lnk
[2012/07/21 19:22:48 | 000,000,260 | ---- | M] () -- D:\Users\Michael\Desktop\F1-2011.bat
[2012/07/21 18:26:50 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Ripple Sound
[2012/07/21 16:08:34 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/07/21 15:23:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\rFactor
[2012/07/21 13:58:25 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012/07/20 11:07:13 | 000,002,044 | ---- | M] () -- D:\Users\Michael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[15 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ]
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/07/22 19:42:10 | 000,141,312 | ---- | C] () -- D:\Users\Michael\AppData\Roaming\rool0_pk.exe
[2012/07/22 16:51:37 | 000,000,876 | ---- | C] () -- D:\Users\Public\Desktop\Race Injection.lnk
[2012/07/21 19:23:51 | 000,001,190 | ---- | C] () -- D:\Users\Michael\Desktop\F1-2011 - Verknüpfung.lnk
[2012/07/21 19:19:24 | 000,134,974 | ---- | C] () -- D:\Users\Michael\Desktop\Konfiguration Anleitung.jpg
[2012/07/21 19:19:24 | 000,000,260 | ---- | C] () -- D:\Users\Michael\Desktop\F1-2011.bat
[2012/03/27 19:02:15 | 000,204,952 | ---- | C] () -- D:\Windows\SysWow64\ativvsvl.dat
[2012/03/27 19:02:15 | 000,157,144 | ---- | C] () -- D:\Windows\SysWow64\ativvsva.dat
[2012/03/27 19:02:15 | 000,003,917 | ---- | C] () -- D:\Windows\SysWow64\atipblag.dat
[2012/01/31 01:00:24 | 000,016,896 | ---- | C] () -- D:\Windows\SysWow64\kdbsdk32.dll
[2011/08/02 08:59:26 | 000,043,520 | ---- | C] () -- D:\Windows\SysWow64\CmdLineExt03.dll
[2011/07/19 14:34:23 | 000,000,041 | -HS- | C] () -- D:\ProgramData\.zreglib
[2011/04/21 08:05:39 | 000,000,001 | ---- | C] () -- D:\Windows\SysWow64\SI.bin
[2011/04/09 12:55:28 | 000,179,261 | ---- | C] () -- D:\Windows\SysWow64\xlive.dll.cat
[2010/12/09 16:08:04 | 000,001,492 | ---- | C] () -- D:\ProgramData\ss.ini
[2010/10/09 21:16:46 | 000,007,599 | ---- | C] () -- D:\Users\Michael\AppData\Local\Resmon.ResmonCfg
[2010/09/10 13:31:12 | 000,003,584 | ---- | C] () -- D:\Users\Michael\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/10 11:45:48 | 000,006,254 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/19 09:33:30 | 000,007,168 | ---- | C] () -- D:\Windows\SysWow64\drivers\StarOpen.sys
[2010/04/17 04:44:30 | 000,000,295 | ---- | C] () -- D:\Windows\EReg072.dat
[2009/12/29 12:04:17 | 000,000,207 | ---- | C] () -- D:\Users\Michael\AppData\Roaming\default.rss
[2009/12/27 15:39:44 | 000,146,432 | ---- | C] () -- D:\Windows\SysWow64\APOMngr.DLL
[2009/12/27 15:39:44 | 000,072,704 | ---- | C] () -- D:\Windows\SysWow64\CmdRtr.DLL
[2009/12/27 15:30:57 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat
========== LOP Check ==========
[2012/07/21 20:25:04 | 000,000,000 | ---D | M] -- D:\ProgramData\AMD
[2009/12/27 14:30:33 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2010/05/19 09:33:39 | 000,000,000 | ---D | M] -- D:\ProgramData\Canneverbe Limited
[2012/07/21 15:50:48 | 000,000,000 | ---D | M] -- D:\ProgramData\Codemasters
[2009/12/27 18:05:12 | 000,000,000 | ---D | M] -- D:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2009/12/27 14:30:33 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/07/15 18:04:40 | 000,000,000 | -HSD | M] -- D:\ProgramData\DSS
[2011/05/05 17:08:09 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core
[2011/05/05 17:08:09 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts
[2009/12/27 14:30:33 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2010/12/09 16:08:01 | 000,000,000 | ---D | M] -- D:\ProgramData\FreeRIP
[2009/12/29 08:02:28 | 000,000,000 | ---D | M] -- D:\ProgramData\LightScribe
[2012/06/04 14:05:38 | 000,000,000 | ---D | M] -- D:\ProgramData\PMB Files
[2011/10/28 09:06:28 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield
[2012/07/23 02:47:24 | 000,000,000 | ---D | M] -- D:\ProgramData\SpeedyPC Software
[2012/03/29 16:56:50 | 000,000,000 | ---D | M] -- D:\ProgramData\Stardock
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2009/12/27 14:30:33 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2010/05/12 07:04:57 | 000,000,000 | ---D | M] -- D:\ProgramData\Teleca
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2009/12/27 14:30:33 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2012/05/12 03:12:34 | 000,032,640 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 24 bytes -> D:\Windows:C6458A5A33C16FD5
< End of report >
Geändert von juriorsolov (23.07.2012 um 12:15 Uhr) |
| Themen zu Virus: Computerkriminalität des criminal Inteligence Service /BPD Einheit 5.2 |
| antivir, autorun, avira, b 5.2, bho, bildschirm, bpd einheit 5.2, browser, cdburnerxp, criminal intelligence service, defender, desktop, enigma, error, euro, explorer, fiese, firefox, format, google earth, langs, logfile, mozilla, nvidia, object, plug-in, poweriso, realtek, registry, scan, software, temp, trojaner, virus, windows |
Baum-Darstellung