| |
| |||||||
Log-Analyse und Auswertung: TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.07.2012, 20:36
| #1 |
| |  TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Sehr geehrte Experten, ich habe die beigefügte Datei im Anhang einer Email erhalten und intelligenterweise angeklickt. Laut Avira Free Antivirus ist sie mit dem Virus TR/Reveton.ZT infiziert: Avira Free Antivirus Erstellungsdatum der Reportdatei: Freitag, 27. Juli 2012 21:22 Es wird nach 3998769 Virenstämmen gesucht. Das Programm läuft als uneingeschränkte Vollversion. Online-Dienste stehen zur Verfügung. Lizenznehmer : Avira AntiVir Personal - Free Antivirus Seriennummer : 0000149996-ADJIE-0000001 Plattform : Windows 7 Professional Windowsversion : (Service Pack 1) [6.1.7601] Boot Modus : Normal gebootet Benutzername : User Computername : USER-PC Versionsinformationen: BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00 AVSCAN.EXE : 12.3.0.15 466896 Bytes 08.05.2012 19:15:02 AVSCAN.DLL : 12.3.0.15 66256 Bytes 08.05.2012 19:15:02 LUKE.DLL : 12.3.0.15 68304 Bytes 08.05.2012 19:15:03 AVSCPLR.DLL : 12.3.0.14 97032 Bytes 08.05.2012 19:15:03 AVREG.DLL : 12.3.0.17 232200 Bytes 10.05.2012 19:14:43 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 09:07:39 VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 21:12:18 VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 20:57:13 VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:38:04 VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 13:35:23 VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 13:35:23 VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 13:35:23 VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 13:35:23 VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 13:35:24 VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 13:35:24 VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 13:35:24 VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 13:35:24 VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 13:35:24 VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 19:10:22 VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 19:10:27 VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 17:16:40 VBASE017.VDF : 7.11.35.143 126464 Bytes 09.07.2012 17:16:40 VBASE018.VDF : 7.11.35.235 151552 Bytes 12.07.2012 17:16:40 VBASE019.VDF : 7.11.36.45 118784 Bytes 13.07.2012 17:16:40 VBASE020.VDF : 7.11.36.107 123904 Bytes 16.07.2012 17:16:46 VBASE021.VDF : 7.11.36.147 238592 Bytes 17.07.2012 17:16:47 VBASE022.VDF : 7.11.36.209 135168 Bytes 19.07.2012 18:05:53 VBASE023.VDF : 7.11.37.19 116224 Bytes 21.07.2012 20:08:38 VBASE024.VDF : 7.11.37.79 149504 Bytes 23.07.2012 20:08:41 VBASE025.VDF : 7.11.37.137 992256 Bytes 25.07.2012 17:21:25 VBASE026.VDF : 7.11.37.195 120832 Bytes 26.07.2012 18:14:21 VBASE027.VDF : 7.11.37.196 2048 Bytes 26.07.2012 18:14:21 VBASE028.VDF : 7.11.37.197 2048 Bytes 26.07.2012 18:14:21 VBASE029.VDF : 7.11.37.198 2048 Bytes 26.07.2012 18:14:21 VBASE030.VDF : 7.11.37.199 2048 Bytes 26.07.2012 18:14:22 VBASE031.VDF : 7.11.37.228 50688 Bytes 27.07.2012 18:14:22 Engineversion : 8.2.10.120 AEVDF.DLL : 8.1.2.10 102772 Bytes 15.07.2012 17:16:44 AESCRIPT.DLL : 8.1.4.36 459131 Bytes 27.07.2012 18:14:23 AESCN.DLL : 8.1.8.2 131444 Bytes 27.01.2012 06:55:13 AESBX.DLL : 8.2.5.12 606578 Bytes 15.06.2012 14:34:40 AERDL.DLL : 8.1.9.15 639348 Bytes 08.09.2011 21:16:06 AEPACK.DLL : 8.3.0.18 807287 Bytes 27.07.2012 18:14:23 AEOFFICE.DLL : 8.1.2.42 201083 Bytes 19.07.2012 18:05:55 AEHEUR.DLL : 8.1.4.80 5075318 Bytes 27.07.2012 18:14:23 AEHELP.DLL : 8.1.23.2 258422 Bytes 01.07.2012 13:35:29 AEGEN.DLL : 8.1.5.34 434548 Bytes 19.07.2012 18:05:54 AEEXP.DLL : 8.1.0.72 86389 Bytes 27.07.2012 18:14:23 AEEMU.DLL : 8.1.3.2 393587 Bytes 15.07.2012 17:16:41 AECORE.DLL : 8.1.27.2 201078 Bytes 15.07.2012 17:16:41 AEBB.DLL : 8.1.1.0 53618 Bytes 01.09.2011 21:46:01 AVWINLL.DLL : 12.3.0.15 27344 Bytes 08.05.2012 19:15:02 AVPREF.DLL : 12.3.0.15 51920 Bytes 08.05.2012 19:15:02 AVREP.DLL : 12.3.0.15 179208 Bytes 08.05.2012 19:15:03 AVARKT.DLL : 12.3.0.15 211408 Bytes 08.05.2012 19:15:02 AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 08.05.2012 19:15:02 SQLITE3.DLL : 3.7.0.1 398288 Bytes 08.05.2012 19:15:03 AVSMTP.DLL : 12.3.0.15 63440 Bytes 08.05.2012 19:15:02 NETNT.DLL : 12.3.0.15 17104 Bytes 08.05.2012 19:15:03 RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 08.05.2012 19:15:02 RCTEXT.DLL : 12.3.0.15 98512 Bytes 08.05.2012 19:15:02 Konfiguration für den aktuellen Suchlauf: Job Name..............................: ShlExt Konfigurationsdatei...................: C:\Users\User\AppData\Local\Temp\9c484db7.avp Protokollierung.......................: standard Primäre Aktion........................: interaktiv Sekundäre Aktion......................: ignorieren Durchsuche Masterbootsektoren.........: ein Durchsuche Bootsektoren...............: ein Bootsektoren..........................: C:, Durchsuche aktive Programme...........: aus Durchsuche Registrierung..............: aus Suche nach Rootkits...................: aus Integritätsprüfung von Systemdateien..: aus Datei Suchmodus.......................: Intelligente Dateiauswahl Durchsuche Archive....................: ein Rekursionstiefe einschränken..........: 20 Archiv Smart Extensions...............: ein Makrovirenheuristik...................: ein Dateiheuristik........................: erweitert Beginn des Suchlaufs: Freitag, 27. Juli 2012 21:22 Der Suchlauf über die ausgewählten Dateien wird begonnen: Beginne mit der Suche in 'C:\Users\User\Desktop\Markus Mahnung 16.06.2012.zip' C:\Users\User\Desktop\Markus Mahnung 16.06.2012.zip [0] Archivtyp: ZIP --> Varlage Ihrer šberweisug.zip [1] Archivtyp: ZIP --> Varlage Ihrer šberweisug.com [FUND] Ist das Trojanische Pferd TR/Reveton.ZT Beginne mit der Desinfektion: C:\Users\User\Desktop\Markus Mahnung 16.06.2012.zip [FUND] Ist das Trojanische Pferd TR/Reveton.ZT [WARNUNG] Die Datei wurde ignoriert. Ende des Suchlaufs: Freitag, 27. Juli 2012 21:27 Benötigte Zeit: 00:00 Minute(n) Der Suchlauf wurde vollständig durchgeführt. 0 Verzeichnisse wurden überprüft 3 Dateien wurden geprüft 1 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 0 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 0 Dateien konnten nicht durchsucht werden 2 Dateien ohne Befall 2 Archive wurden durchsucht 1 Warnungen 0 Hinweise Malwarebytes findet zwar in dieser Datei nichts: Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.27.09 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Aktiviert 27.07.2012 21:33:07 mbam-log-2012-07-27 (21-33-07).txt Art des Suchlaufs: Benutzerdefinierter Suchlauf (C:\Users\User\Desktop\Markus Mahnung 16.06.2012.zip|) Aktivierte Suchlaufeinstellungen: Dateisystem | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Heuristiks/Extra | P2P Durchsuchte Objekte: 1 Laufzeit: 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Dafür findet Malwarebytes aber in einer anderen Datei auf dem Rechner einen "Backdoor.Bot": Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.23.11 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Aktiviert 23.07.2012 23:07:02 mbam-log-2012-07-24 (07-37-30).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 343135 Laufzeit: 1 Stunde(n), 41 Minute(n), 6 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\User\Documents\80 Software\Sprachlernsoftware\Cambridge Dictionary\AUTORUN\AUTORUN.EXE (Backdoor.Bot) -> Keine Aktion durchgeführt. (Ende) OTL-Editor:OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.07.2012 00:20:29 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\User\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,93 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 61,87% Memory free 3,86 Gb Paging File | 2,94 Gb Available in Paging File | 76,12% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 931,51 Gb Total Space | 633,65 Gb Free Space | 68,02% Space Free | Partition Type: NTFS Computer Name: USER-PC | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.27 00:19:47 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe PRC - [2012.07.27 00:18:32 | 000,050,477 | ---- | M] () -- C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2NXLBRYM\Defogger.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.05.08 21:15:03 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.08 21:15:02 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.08 21:15:02 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 21:15:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.08.11 12:28:10 | 000,862,144 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Citrix\wfcrun32.exe PRC - [2011.08.11 12:27:02 | 000,358,336 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Citrix\concentr.exe PRC - [2011.08.11 12:20:46 | 000,075,712 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Citrix\ssonsvr.exe PRC - [2011.07.19 18:59:04 | 000,964,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Citrix\Receiver\Receiver.exe PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2007.03.22 03:25:48 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbxcoms.exe ========== Modules (No Company Name) ========== MOD - [2012.07.27 00:18:32 | 000,050,477 | ---- | M] () -- C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2NXLBRYM\Defogger.exe ========== Win32 Services (SafeList) ========== SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.06.26 18:27:28 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.05.08 21:15:03 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.08 21:15:02 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Disabled | Stopped] -- C:\Programme\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv) SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.05.31 16:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 16:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) SRV - [2007.03.22 03:25:48 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbxcoms.exe -- (lxbx_device) SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Adapter | Unavailable | Unknown] -- -- (PnSson) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.06.15 23:59:10 | 000,086,496 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vsflt67.sys -- (vidsflt67) DRV - [2012.06.15 23:59:05 | 000,080,416 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\fltsrv.sys -- (fltsrv) DRV - [2012.05.08 21:15:03 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.08 21:15:03 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.02.24 11:14:42 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) DRV - [2012.02.24 11:14:42 | 000,080,824 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.08.14 12:15:22 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05) DRV - [2011.08.10 23:20:24 | 000,066,776 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\ctxusbm.sys -- (ctxusbm) DRV - [2011.08.06 00:11:00 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc) DRV - [2011.08.06 00:11:00 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt) DRV - [2011.04.01 05:11:10 | 004,333,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) DRV - [2011.04.01 05:09:48 | 000,291,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.08.03 09:22:56 | 000,085,360 | ---- | M] (Juniper Networks) [Kernel | System | Running] -- C:\Windows\System32\drivers\NEOFLTR_650_16339.SYS -- (NEOFLTR_650_16339) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.05.16 12:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic) DRV - [2008.05.16 12:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5) DRV - [2008.05.16 12:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl) DRV - [2008.05.16 12:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm) DRV - [2008.05.16 12:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt) DRV - [2008.05.16 12:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex) DRV - [2008.05.16 12:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\User\Documents\20 Marc\20 Finance\10 Girokonto\2011 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 34 8F CC 70 19 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {842C1D1C-B5E1-454B-9E47-7B1361E76528} IE - HKCU\..\SearchScopes\{1CF38A25-90CD-4435-9DFF-9BFDE0FA51BE}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\..\SearchScopes\{2169E955-7EEC-4EB0-A603-EC7429AACEF7}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\..\SearchScopes\{2C25A384-282E-47BE-A191-49C57DC607B1}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie IE - HKCU\..\SearchScopes\{842C1D1C-B5E1-454B-9E47-7B1361E76528}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\..\SearchScopes\{DACE0168-D767-4951-8D29-B3A15687C892}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.24 20:21:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.24 20:21:11 | 000,000,000 | ---D | M] [2011.05.30 09:16:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions [2011.11.05 09:57:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.06 00:10:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.11.05 09:57:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011.11.12 17:52:19 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.08.11 12:18:12 | 000,128,960 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\CCMSDK.dll [2011.08.10 23:16:34 | 000,096,192 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\CgpCore.dll [2011.08.11 12:18:30 | 000,092,096 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\confmgr.dll [2011.08.11 12:18:08 | 000,022,976 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\ctxlogging.dll [2011.08.11 12:19:38 | 000,436,136 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npicaN.dll [2011.08.10 23:16:34 | 000,024,512 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\TcpPServ.dll [2011.11.12 17:52:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.11.12 17:52:14 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.11.12 17:52:14 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.11.12 17:52:14 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.11.12 17:52:14 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.12 17:52:14 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [LXBXCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.DLL () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://extranet.kfw.de/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5C2CC901-A27D-4816-BB75-C3B8152B8878}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B7890883-7F5A-49A7-BA92-287AB111BAE5}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\Shell - "" = AutoRun O33 - MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe O33 - MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\Shell - "" = AutoRun O33 - MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe O33 - MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\Shell - "" = AutoRun O33 - MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe O33 - MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\Shell - "" = AutoRun O33 - MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTE_Privacy_launcher.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.27 00:19:47 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2012.07.23 22:36:27 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\Malwarebytes [2012.07.23 22:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.23 22:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.23 22:36:12 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.07.23 22:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.07.15 06:20:44 | 000,000,000 | R--D | C] -- C:\Users\User\Music [2012.07.06 11:48:59 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\ElevatedDiagnostics [2012.07.01 23:24:16 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\FreePDF_XP [2012.07.01 22:24:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreePDF [2012.07.01 22:24:49 | 000,000,000 | ---D | C] -- C:\Program Files\FreePDF_XP [2012.07.01 22:24:49 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\FreePDF [2012.07.01 22:24:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ghostscript [2012.07.01 22:24:30 | 000,000,000 | ---D | C] -- C:\Program Files\gs [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Users\User\Desktop\*.tmp files -> C:\Users\User\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.27 00:19:47 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe [2012.07.27 00:18:41 | 000,000,000 | ---- | M] () -- C:\Users\User\defogger_reenable [2012.07.26 23:34:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.26 22:34:01 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.26 20:38:30 | 000,018,592 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.26 20:38:30 | 000,018,592 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.26 20:31:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.26 20:30:52 | 1554,694,144 | -HS- | M] () -- C:\hiberfil.sys [2012.07.23 22:36:14 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.19 00:02:16 | 000,657,938 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.07.19 00:02:16 | 000,619,184 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.07.19 00:02:16 | 000,131,296 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.07.19 00:02:16 | 000,107,504 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.07.18 23:59:04 | 000,001,621 | ---- | M] () -- C:\Users\User\Desktop\12.06.14 Über den Dächern von Frankfurt - Verknüpfung.lnk [2012.07.18 23:58:54 | 000,001,452 | ---- | M] () -- C:\Users\User\Desktop\12.07.07 Lausitz - Verknüpfung.lnk [2012.07.18 23:58:52 | 000,001,488 | ---- | M] () -- C:\Users\User\Desktop\12.06.21 Bling bling - Verknüpfung.lnk [2012.07.15 06:20:02 | 000,288,176 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.07.14 19:16:20 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Users\User\Desktop\*.tmp files -> C:\Users\User\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.27 00:18:41 | 000,000,000 | ---- | C] () -- C:\Users\User\defogger_reenable [2012.07.23 22:36:14 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.18 23:59:04 | 000,001,621 | ---- | C] () -- C:\Users\User\Desktop\12.06.14 Über den Dächern von Frankfurt - Verknüpfung.lnk [2012.07.18 23:58:54 | 000,001,452 | ---- | C] () -- C:\Users\User\Desktop\12.07.07 Lausitz - Verknüpfung.lnk [2012.07.18 23:58:52 | 000,001,488 | ---- | C] () -- C:\Users\User\Desktop\12.06.21 Bling bling - Verknüpfung.lnk [2012.07.01 22:24:51 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2012.07.01 22:24:51 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2011.12.28 20:10:17 | 000,000,536 | ---- | C] () -- C:\Windows\eReg.dat [2011.08.14 11:51:20 | 000,000,016 | ---- | C] () -- C:\Users\User\persistent_state [2011.08.09 22:07:49 | 000,038,412 | ---- | C] () -- C:\Users\User\AppData\Roaming\Microsoft Excel.ADR [2011.07.26 17:26:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.07.26 17:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2011.07.26 17:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.07.26 17:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.07.26 17:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2011.06.19 22:06:07 | 000,006,585 | ---- | C] () -- C:\Windows\CDPlayer.ini [2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2011.05.30 09:16:16 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2011.05.25 18:50:06 | 000,000,838 | ---- | C] () -- C:\Windows\wiso.ini [2011.05.25 11:19:06 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbxserv.dll [2011.05.25 11:19:06 | 000,995,328 | ---- | C] ( ) -- C:\Windows\System32\lxbxusb1.dll [2011.05.25 11:19:06 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbxhbn3.dll [2011.05.25 11:19:06 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbxcomc.dll [2011.05.25 11:19:06 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbxpmui.dll [2011.05.25 11:19:06 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbxlmpm.dll [2011.05.25 11:19:06 | 000,537,520 | ---- | C] ( ) -- C:\Windows\System32\lxbxcoms.exe [2011.05.25 11:19:06 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbxcomm.dll [2011.05.25 11:19:06 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbxinpa.dll [2011.05.25 11:19:06 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbxiesc.dll [2011.05.25 11:19:06 | 000,385,968 | ---- | C] ( ) -- C:\Windows\System32\lxbxih.exe [2011.05.25 11:19:06 | 000,381,872 | ---- | C] ( ) -- C:\Windows\System32\lxbxcfg.exe [2011.05.25 11:19:06 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\lxbxhcp.dll [2011.05.25 11:19:06 | 000,274,432 | ---- | C] () -- C:\Windows\System32\lxbxinst.dll [2011.05.25 11:19:06 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbxprox.dll [2011.05.25 11:19:06 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbxpplc.dll [2011.05.24 10:41:15 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.05.24 10:20:18 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011.05.23 19:46:52 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.04.01 05:07:02 | 010,877,272 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll [2011.04.01 05:07:02 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe [2011.04.01 05:06:56 | 000,331,608 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll [2011.04.01 04:56:00 | 000,027,872 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini [2011.03.22 23:58:22 | 000,014,168 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll [2011.02.11 19:10:52 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2011.02.11 19:10:50 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2011.02.11 19:10:50 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin [2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll [2011.02.11 18:38:44 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config ========== LOP Check ========== [2011.12.20 11:20:28 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\1&1 Mail & Media GmbH [2012.06.15 23:59:32 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\585F61AD-EA3F-4430-8DBE-56D0E84CD082 [2012.06.15 23:53:35 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Acronis [2011.06.11 13:17:46 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Amazon [2011.08.12 22:16:23 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Audacity [2011.05.25 18:54:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Buhl Data Service [2011.05.26 07:49:05 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Canneverbe Limited [2011.07.24 20:48:52 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DAEMON Tools Lite [2012.01.13 22:03:04 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\EFSoftware [2012.07.01 22:24:49 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\FreePDF [2012.04.24 21:41:30 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ICAClient [2012.05.05 20:38:39 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Juniper Networks [2011.05.23 19:53:50 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Leadertech [2012.07.18 23:47:56 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MediaMonkey [2011.07.28 22:01:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Nokia [2011.07.28 22:01:43 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PC Suite [2011.08.07 16:11:49 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Samsung [2012.06.02 14:36:55 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Temp [2012.01.10 21:52:16 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\UDC Profiles [2011.08.14 12:15:39 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\wxMozBrowserLib [2012.04.27 16:43:55 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > OTL Extras:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 27.07.2012 00:20:29 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\User\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,93 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 61,87% Memory free
3,86 Gb Paging File | 2,94 Gb Available in Paging File | 76,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931,51 Gb Total Space | 633,65 Gb Free Space | 68,02% Space Free | Partition Type: NTFS
Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{034C6FB4-757E-4073-A64E-8C76768A900C}" = rport=139 | protocol=6 | dir=out | app=system |
"{0FA370A4-DA7A-4417-968C-A88AE830A092}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{17EF1ABE-6B65-4AAF-AD65-B4AFEE2C4601}" = rport=445 | protocol=6 | dir=out | app=system |
"{1ED87930-1898-49B6-A6A6-3A3C66306CCC}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2B5667AA-7E27-4C44-B90C-0B02FC9011E3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{2DEAD836-4046-4235-9621-8CBF6FD36132}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{47263F9E-9C07-4596-B251-4BC0FF9942C7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5871166F-A757-4CB1-A12A-ECD130F6FC70}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5A70B7C8-98A4-4040-9D17-77A2CE572D34}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{61F8B19A-8585-4B8C-BB1F-0AFBEB7E690B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{67A7D35E-FA58-49DC-B39F-8B3EB8F0FBC0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6E69F2B6-01B3-4125-A6D8-94CFB5E78C0F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{79585C56-54A1-448D-BE9B-CCFD981418DF}" = lport=138 | protocol=17 | dir=in | app=system |
"{7D291BE4-DB2F-4DC4-90F1-ABF9B42073F2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{86776B2A-F9B5-4FB6-B037-69D02B7F3AAC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8BA27119-4F6A-48D1-81E5-1197ABBC3E57}" = rport=137 | protocol=17 | dir=out | app=system |
"{9240A698-AB9A-4659-95D6-67D73F9307C8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{94B0A29A-A74D-4FC4-BD03-C59B7662D276}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A26801C8-7875-4DD1-8CA5-6642D86D82C9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A73D9480-FA76-408C-A346-89FC2D9A4E08}" = lport=445 | protocol=6 | dir=in | app=system |
"{ADDC1DDA-83DC-43BF-A18B-4A8147329E77}" = rport=138 | protocol=17 | dir=out | app=system |
"{C483A50B-7D85-4B6A-816E-3D26399D959E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{D32B5F99-2C44-4ACF-8413-A8EA541CCCE4}" = lport=137 | protocol=17 | dir=in | app=system |
"{D736ED76-D12D-43E9-A893-B702EBF41995}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FF99D892-82C2-4788-84FD-CA3DC3662080}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003ADD99-F8C2-46BE-ACB7-40F3B6302E16}" = protocol=6 | dir=in | app=c:\program files\common files\acronis\syncagent\syncagentsrv.exe |
"{00519C5E-1D49-4217-BA1F-AA74FB7D334D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{024723CB-FC24-4F20-AB21-4E953E2FB0CE}" = protocol=6 | dir=out | app=system |
"{06E27B13-C8D0-4854-8D5C-307AB8C218B7}" = protocol=17 | dir=in | app=c:\program files\sonos\sonos.exe |
"{19DF7456-5BC3-4E87-8EA9-7838983BAF31}" = protocol=17 | dir=in | app=c:\windows\system32\lxbxcoms.exe |
"{1A6C3340-5EAA-4827-803B-CF7F55A0BFA9}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{1B7C2912-A404-48F6-9768-7E9F3C02980B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2833C4CF-A756-4860-A809-CE31086387A1}" = protocol=6 | dir=in | app=c:\windows\system32\lxbxcoms.exe |
"{49CFE3EB-B0AE-4024-A516-E006589F556C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{50999AAC-E912-466C-9E47-E75DB0785DBD}" = protocol=6 | dir=in | app=c:\program files\sonos\sonos.exe |
"{5347504F-12F3-4A5B-8B30-8F36940AE376}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5B7960DB-D342-417E-B4EC-912D19E2629E}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5DD94D2F-F58C-49F1-A6F8-952324994634}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5E47E25D-B06A-4EA3-9604-550D465222AC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{660D7DCB-3535-4BFD-B05E-1FEC3C84772F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{75910C7D-4288-4191-A87F-2B29FE49DF91}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{84412E0A-911C-4433-BAE7-ED6F2E79075C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{90822A2E-CF87-482E-8A09-81516DC4B4F6}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{914A1A1D-8156-45DD-9D9C-AAD957ACB39F}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{94080CAE-05C0-4433-93FC-CD8307D3D9F3}" = protocol=17 | dir=in | app=c:\program files\common files\acronis\syncagent\syncagentsrv.exe |
"{956C1073-304A-4F8F-AED2-F5D4E5FDB4BB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B3C64AE6-6946-43F8-AAC7-95461D74AED1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BD0BAE4E-0D27-436B-988F-B4EE6F3A0AAB}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbxpswx.exe |
"{C4FA0EEE-219A-4E0A-8D83-ECFE764040A0}" = protocol=17 | dir=in | app=c:\program files\sonos\sonos.exe |
"{C62F8AE6-5BB3-4BB0-A71A-585E4B4878B5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbxpswx.exe |
"{D2D59731-80EA-4382-A4F5-5618115FF12F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DB569DE7-8828-43BC-9AAC-E2AC7921E791}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DB992C1D-E7BB-4130-B745-C3DCDAE9F6D4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E11E3253-3F7E-4768-9787-AA1BD9B3127D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{ED7ACF1D-4EA6-4524-9479-46DE2F67607F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F1A7FE9E-02DB-4590-ACF3-5E3AF7E21294}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{F5D6E51A-3249-47D8-A1F8-1165F22337B0}" = protocol=6 | dir=in | app=c:\program files\sonos\sonos.exe |
"{FB67F1F1-8ED4-47B0-8D00-0768424BBA33}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{FC604B29-CDDE-4EA7-949B-12DA4BA11E62}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{FCAB4F6F-0581-4093-A933-103564BCC738}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"TCP Query User{1F365554-2D2B-450C-9A0A-0B1B5F3010CA}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{87E49A66-435E-45C5-BB26-B0ADA38CCBEB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{164B26C5-9BC9-48E8-8FB5-C3C0AC0FE1C8}" = Citrix Receiver Inside
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1E5AB1FE-F17E-4A40-A79C-FC7CE0E6916C}" = Citrix Receiver(SSON)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 29
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}" = Sonos Controller
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90B45DFA-5DD9-47F0-BCC7-F25B9562A738}" = Citrix Receiver (USB)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AE2E0F4A-E08F-4A15-B4DC-D8FC9CEFF9C7}" = Online Plug-in
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1D603C4-8C68-40F3-85AE-6DBEF3B712B5}" = Citrix Receiver (HDX Flash-Umleitung)
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Anti-Twin 2012-02-09 20.04.03" = Anti-Twin (Installation 09.02.2012)
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"CitrixOnlinePluginFull" = Citrix Receiver (Enterprise)
"Der große Aufbaukurs Französisch" = Der große Aufbaukurs Französisch
"FormatFactory" = FormatFactory 2.60
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.04" = GPL Ghostscript
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"Lexmark 7100 Series" = Lexmark 7100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MediaMonkey_is1" = MediaMonkey 4.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"Neoteris_Secure_Application_Manager" = Juniper Networks Secure Application Manager
"Picasa 3" = Picasa 3
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Tunatic" = Tunatic
"WinLiveSuite" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Juniper_Networks_Cache_Cleaner 6.5.0" = Juniper Networks Cache Cleaner 6.5.0
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Neoteris_Host_Checker" = Juniper Networks Host Checker
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.07.2012 16:03:40 | Computer Name = User-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Citrix\MFC80.DLL".
Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Citrix\Microsoft.VC80.MFCLOC.MANIFEST"
in Zeile 5. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der
angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition:
Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Verwenden
Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 22.07.2012 16:42:18 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
Error - 23.07.2012 12:42:34 | Computer Name = User-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Citrix\MFC80.DLL".
Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Citrix\Microsoft.VC80.MFCLOC.MANIFEST"
in Zeile 5. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der
angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition:
Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Verwenden
Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 23.07.2012 12:42:35 | Computer Name = User-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Citrix\MFC80.DLL".
Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Citrix\Microsoft.VC80.MFCLOC.MANIFEST"
in Zeile 5. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der
angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition:
Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Verwenden
Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 23.07.2012 14:13:37 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
Error - 23.07.2012 19:28:23 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
Error - 26.07.2012 14:31:39 | Computer Name = User-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Citrix\MFC80.DLL".
Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Citrix\Microsoft.VC80.MFCLOC.MANIFEST"
in Zeile 5. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der
angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition:
Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Verwenden
Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 26.07.2012 14:31:40 | Computer Name = User-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Citrix\MFC80.DLL".
Fehler in Manifest- oder Richtliniendatei "C:\Program Files\Citrix\Microsoft.VC80.MFCLOC.MANIFEST"
in Zeile 5. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der
angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0".
Definition:
Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762".
Verwenden
Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 26.07.2012 17:05:05 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
Error - 26.07.2012 18:00:02 | Computer Name = User-PC | Source = System Restore | ID = 8193
Description =
[ System Events ]
Error - 01.07.2012 05:26:03 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 05:26:03 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 05:45:04 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 06:20:43 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 09:35:12 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 11:49:47 | Computer Name = User-PC | Source = Server | ID = 2505
Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht
\Device\NetBT_Tcpip_{5C2CC901-A27D-4816-BB75-C3B8152B8878} vom Serverdienst nicht
gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error - 01.07.2012 11:49:47 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :20" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 11:49:47 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 01.07.2012 11:50:53 | Computer Name = User-PC | Source = NetBT | ID = 4321
Description = Der Name "USER-PC :0" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.33 registriert werden. Der Computer mit IP-Adresse 192.168.2.32
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 24.07.2012 06:42:43 | Computer Name = User-PC | Source = DCOM | ID = 10010
Description =
< End of report >
Vielen, vielen Dank für Eure Hilfe! Geändert von deeprybka (24.10.2015 um 17:05 Uhr) Grund: Name entfernt |
|
28.07.2012, 14:56
| #2 |
| /// Helfer-Team  | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Du dachtest du wohl, ich lad das ding hier hoch, damit sich andere auch infizieren koennen oder wie? Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
DRV - File not found [Adapter | Unavailable | Unknown] -- -- (PnSson)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes,DefaultScope = {842C1D1C-B5E1-454B-9E47-7B1361E76528}
IE - HKCU\..\SearchScopes\{1CF38A25-90CD-4435-9DFF-9BFDE0FA51BE}: "URL" = http://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{2169E955-7EEC-4EB0-A603-EC7429AACEF7}: "URL" = http://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{2C25A384-282E-47BE-A191-49C57DC607B1}: "URL" = http://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{842C1D1C-B5E1-454B-9E47-7B1361E76528}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{DACE0168-D767-4951-8D29-B3A15687C892}: "URL" = http://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.startup.homepage: "http://www.google.de/"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
[2011.05.30 09:16:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\User\AppData\Roaming\mozilla\Extensions
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O4 - HKLM..\Run: [LXBXCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXBXtime.DLL ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\Shell - "" = AutoRun
O33 - MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe
O33 - MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\Shell - "" = AutoRun
O33 - MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe
O33 - MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\Shell - "" = AutoRun
O33 - MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTVP_Launcher.exe
O33 - MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\Shell - "" = AutoRun
O33 - MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\Shell\AutoRun\command - "" = E:\DTE_Privacy_launcher.exe
[2012.07.01 22:24:51 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2011.08.09 22:07:49 | 000,038,412 | ---- | C] () -- C:\Users\User\AppData\Roaming\Microsoft Excel.ADR
[2012.06.15 23:59:32 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\585F61AD-EA3F-4430-8DBE-56D0E84CD082
[2012.07.26 23:34:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.26 22:34:01 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
:Files
C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2NXLBRYM\Defogger.exe
C:\Users\User\Documents\80 Software\Sprachlernsoftware\Cambridge Dictionary\
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
28.07.2012, 20:53
| #3 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe t'john, mein Held
__________________vielen Dank für Deine kurzfristige Antwort! Ich habe alles getan wie von Dir beschrieben - hier das OTL-Logfile: All processes killed ========== OTL ========== Error: No service named PnSson was found to stop! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PnSson deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1CF38A25-90CD-4435-9DFF-9BFDE0FA51BE}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF38A25-90CD-4435-9DFF-9BFDE0FA51BE}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2169E955-7EEC-4EB0-A603-EC7429AACEF7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2169E955-7EEC-4EB0-A603-EC7429AACEF7}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2C25A384-282E-47BE-A191-49C57DC607B1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C25A384-282E-47BE-A191-49C57DC607B1}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{842C1D1C-B5E1-454B-9E47-7B1361E76528}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{842C1D1C-B5E1-454B-9E47-7B1361E76528}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DACE0168-D767-4951-8D29-B3A15687C892}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DACE0168-D767-4951-8D29-B3A15687C892}\ not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage Prefs.js: 0 removed from network.proxy.type Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully. C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully. File C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found. C:\Users\User\AppData\Roaming\mozilla\Extensions folder moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C424171E-592A-415A-9EB1-DFD6D95D3530} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\LXBXCATS not found. C:\Windows\System32\spool\drivers\w32x86\3\lxbxtime.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\Windows\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\autoexec.bat moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86dabd11-9b4d-11e0-a31c-00238b4dccaf}\ not found. File E:\DTVP_Launcher.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a7d012be-a7d7-11e1-b2b1-00238b4dccaf}\ not found. File E:\DTVP_Launcher.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d604e13e-9aba-11e1-b310-00238b4dccaf}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d604e13e-9aba-11e1-b310-00238b4dccaf}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d604e13e-9aba-11e1-b310-00238b4dccaf}\ not found. File E:\DTVP_Launcher.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d634ad7f-9aea-11e0-8648-00238b4dccaf}\ not found. File E:\DTE_Privacy_launcher.exe not found. C:\Windows\System32\unredmon.exe moved successfully. C:\Users\User\AppData\Roaming\Microsoft Excel.ADR moved successfully. C:\Users\User\AppData\Roaming\585F61AD-EA3F-4430-8DBE-56D0E84CD082 folder moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully. ========== FILES ========== File\Folder C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2NXLBRYM\Defogger.exe not found. Folder C:\Users\User\Documents\80 Software\Sprachlernsoftware\Cambridge Dictionary not found. < ipconfig /flushdns /c > Windows-IP-Konfiguration Der DNS-Aufl”sungscache wurde geleert. C:\Users\User\Desktop\cmd.bat deleted successfully. C:\Users\User\Desktop\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: User ->Temp folder emptied: 254411 bytes ->Temporary Internet Files folder emptied: 12830766 bytes ->Java cache emptied: 4562448 bytes ->FireFox cache emptied: 47725517 bytes ->Flash cache emptied: 649 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 62,00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: Public User: User ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.55.0 log created on 07282012_214703 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot... 1000 Dank! |
|
28.07.2012, 20:57
| #4 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Sehr gut!  1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
29.07.2012, 15:11
| #5 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe t'john, Du Engel, hier die Textdatei des AdwCleaners, unten das Logfile von Malwarebytes: # AdwCleaner v1.703 - Logfile created 07/29/2012 at 16:06:51 # Updated 20/07/2012 by Xplode # Operating system : Windows 7 Professional Service Pack 1 (32 bits) # User : User - USER-PC # Running from : C:\Users\User\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Found : HKLM\SOFTWARE\DT Soft Key Found : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556} Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v7.0.1 (de) ************************* AdwCleaner[R1].txt - [1040 octets] - [29/07/2012 16:06:51] ########## EOF - C:\AdwCleaner[R1].txt - [1168 octets] ########## Logfile von Malwarebytes: Malwarebytes Anti-Malware (Test) 1.62.0.1300 Malwarebytes : Free Anti-Malware download Datenbank Version: v2012.07.29.07 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 User :: USER-PC [Administrator] Schutz: Deaktiviert 29.07.2012 15:01:06 mbam-log-2012-07-29 (15-01-06).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 335335 Laufzeit: 1 Stunde(n), 3 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Ich bin ehrlich begeistert von Deiner Hilfe: Zwei Antworten binnen 24 Stunden - sogar über's Wochende! Vielen, vielen Dank!!! |
|
29.07.2012, 18:46
| #6 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe |
|
30.07.2012, 05:54
| #7 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe t'john, Du guter, hier der Log vom AdwCleaner. Emisoft hat nichts gefunden. Klugerweise habe ich vergessen, auf "Bericht anzeigen" zu klicken - soll ich den Scan sicherheitshalbe nochmal laufen lassen und den Bericht posten? Oder kann ich die unter C:\Program Files\Emsisoft Anti-Malware\Logs gespeicherte "logs.db3" irgendwie öffnen? # AdwCleaner v1.703 - Logfile created 07/29/2012 at 21:43:54 # Updated 20/07/2012 by Xplode # Operating system : Windows 7 Professional Service Pack 1 (32 bits) # User : User - USER-PC # Running from : C:\Users\User\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Deleted : HKLM\SOFTWARE\DT Soft Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v7.0.1 (de) ************************* AdwCleaner[R1].txt - [1169 octets] - [29/07/2012 16:06:51] AdwCleaner[S1].txt - [1112 octets] - [29/07/2012 21:43:54] ########## EOF - C:\AdwCleaner[S1].txt - [1240 octets] ########## Dir für immer in Dank ergeben! |
|
30.07.2012, 15:08
| #8 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Sehr gut! Gabs Funde? Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
30.07.2012, 21:24
| #9 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Liebster t'john, Emisoft hatte nichts gefunden, ist nun deinstalliert. Hier der Log von ESET: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=c04cd0e6161c884ca863f3f09e4884de # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-07-30 08:11:25 # local_time=2012-07-30 10:11:25 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 100 94 37430144 95304523 0 0 # compatibility_mode=8192 67108863 100 0 84 84 0 0 # scanned=167634 # found=0 # cleaned=0 # scan_time=5754 Wie immer: Mille gracie!!! |
|
30.07.2012, 22:40
| #10 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html |
|
31.07.2012, 22:05
| #11 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Hi t'john, Java ist wie beschrieben aktualisiert. Muss ich noch weitere Schritte durchführen? Schöne Grüße und Danke für immer |
|
31.07.2012, 22:33
| #12 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Sehr gut! damit bist Du sauber und entlassen!  Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html |
|
01.08.2012, 22:04
| #13 |
| | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe Liebster t'john, ich will jetzt nicht sentimental werden - aber ich bin erhlich begeistert von Deiner Hilfsbereitschaft, Deiner Expertise, Deiner Reaktionszeit und Deiner Geduld! Ich kann meine Dankbarkeit nicht in Worte fassen. Birne2012 |
|
02.08.2012, 03:44
| #14 |
| /// Helfer-Team | TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe wuensche Dir eine virenfrie Zeit! |
|
| Themen zu TR/Reveton.ZT in Emailanhang geöffnet und Backdoor.Bot in autorun.exe |
| acedrv05.sys, antivirus, autorun, avira, backdoor.bot, bho, desktop, email, emailanhang, error, excel, fehler, firefox, flash player, helper, iexplore.exe, install.exe, installation, ip-adresse, langs, logfile, netzwerk, object, origin, plug-in, programm, registry, richtlinie, searchscopes, security, software, svchost.exe, tr/reveton.zt, warnung, windows |
Linear-Darstellung
