| |
| |||||||
Log-Analyse und Auswertung: PC durch "Zeus" befallen. Malwarebytes erfolgreich? Ergebnisse vom Scan mit OTLWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.07.2012, 10:38
| #1 |
 |  PC durch "Zeus" befallen. Malwarebytes erfolgreich? Ergebnisse vom Scan mit OTL Hallo, seit dem Öffnen einer Spam Mail der "deutschen Post", fand Antivir den Wurm Zeus auf dem Rechner. Browser stürzte öfter ab. Habe mit Antimalwarebytes gescannt, in Quarantäne verschoben und gelöscht. Jetzt störungsfreier Betrieb. Ist der Rechner wieder unbedenklich zu nutzen? Defogger hat nichts gefunden/angezeigt. (Bei Antivir habe ich die Funde bisher nicht gelöscht, sondern nur unter Quarantäne gestellt.) Ergebnisse vom OTL Scan:OTL Logfile: Code:
ATTFilter OTL logfile created on: 29.07.2012 11:05:42 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Axel Albert\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,75 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 69,76% Memory free 4,59 Gb Paging File | 3,86 Gb Available in Paging File | 84,13% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 48,83 Gb Total Space | 34,31 Gb Free Space | 70,27% Space Free | Partition Type: NTFS Drive D: | 48,83 Gb Total Space | 48,76 Gb Free Space | 99,87% Space Free | Partition Type: NTFS Drive E: | 200,43 Gb Total Space | 13,82 Gb Free Space | 6,89% Space Free | Partition Type: NTFS Computer Name: LAPTOP | User Name: Axel Albert | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.29 11:05:05 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Axel Albert\Eigene Dateien\Downloads\OTL.exe PRC - [2012.07.29 11:03:00 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Axel Albert\Eigene Dateien\Downloads\Defogger.exe PRC - [2012.07.20 09:43:20 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.08.01 10:28:16 | 000,124,480 | ---- | M] (ICQ, LLC.) -- C:\Programme\ICQ7.5\ICQ.exe PRC - [2011.06.28 20:16:17 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.08 18:44:58 | 000,604,488 | ---- | M] (TuneUp Software) -- C:\WINDOWS\system32\TUProgSt.exe PRC - [2011.06.08 08:13:03 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.06.07 12:35:35 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe PRC - [2010.04.12 13:33:02 | 000,636,256 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2010.03.17 05:48:42 | 000,229,458 | ---- | M] (IDT, Inc.) -- c:\Programme\IDT\WDM\stacsv.exe PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.04.21 22:01:56 | 000,737,280 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe PRC - [2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.07.29 11:03:00 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Axel Albert\Eigene Dateien\Downloads\Defogger.exe MOD - [2012.07.27 21:51:15 | 009,465,032 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll MOD - [2012.07.20 09:43:18 | 002,003,424 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2010.06.17 15:27:02 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2010.06.07 12:35:35 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe MOD - [2010.04.12 13:33:12 | 002,860,384 | ---- | M] () -- C:\WINDOWS\system32\btwicons.dll MOD - [2010.04.12 13:33:10 | 000,075,112 | ---- | M] () -- C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll MOD - [2009.08.10 09:07:46 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\ssp7ml3.dll MOD - [2004.08.04 00:57:26 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll ========== Win32 Services (SafeList) ========== SRV - [2012.07.27 21:51:16 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.20 09:43:18 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.06.28 20:16:17 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.08 18:44:58 | 000,604,488 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc) SRV - [2011.06.08 18:44:56 | 000,361,288 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag) SRV - [2011.06.08 08:13:03 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.03.17 05:48:42 | 000,229,458 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Programme\IDT\WDM\stacsv.exe -- (STacSV) SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.11.16 12:25:48 | 000,029,000 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.06.28 20:16:18 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.06.28 20:16:18 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.03.16 02:09:26 | 004,833,792 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.06.17 15:26:52 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2010.05.03 15:49:18 | 000,225,232 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2010.04.01 01:20:20 | 000,911,400 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2010.03.17 05:48:42 | 001,659,283 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) DRV - [2009.04.21 23:13:34 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/ IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} IE - HKCU\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/" FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632 FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Programme\Veetle\plugins\npVeetle.dll File not found FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Programme\Veetle\Player\npvlc.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.20 09:43:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.10 19:52:47 | 000,000,000 | ---D | M] [2012.02.22 19:18:54 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Extensions [2012.02.25 14:25:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\d6n1k880.default\extensions [2011.06.23 16:26:20 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\d6n1k880.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.04.13 00:12:55 | 000,000,000 | ---D | M] (AdblockPro) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\d6n1k880.default\extensions\adblock@adblockpro.com [2011.04.13 00:12:56 | 000,000,000 | ---D | M] (AdobeReader) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\d6n1k880.default\extensions\pdfreader@adobe.com [2012.02.25 14:25:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\gymwx26b.default\extensions [2011.02.10 18:23:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\gymwx26b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2) [2011.06.23 16:26:21 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\gymwx26b.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.02.25 14:25:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions [2011.06.08 00:34:29 | 000,000,000 | ---D | M] (JonDoFox) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593} [2011.06.08 00:34:29 | 000,000,000 | ---D | M] (Cookie Monster) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{45d8ff86-d909-11db-9705-005056c00008} [2011.06.08 00:34:29 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2011.06.23 16:26:24 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2011.06.08 00:34:29 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.06.08 00:34:29 | 000,000,000 | ---D | M] (ProfileSwitcher) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{fa8476cf-a98c-4e08-99b4-65a69cb4b7d4} [2011.06.08 00:34:29 | 000,000,000 | ---D | M] ("UnPlug") -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\unplug@compunach [2012.07.26 21:01:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions [2012.07.26 21:01:47 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.06.28 00:20:30 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012.07.20 23:19:05 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012.06.28 00:20:32 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012.03.28 18:16:45 | 000,000,000 | ---D | M] (vShare) -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\zk0b6ju8.default\extensions\vshare@toolbar [2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Mozilla\Firefox\Profiles\d6n1k880.default\searchplugins\icqplugin.xml [2012.04.19 18:54:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.07.20 09:43:20 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.06.19 19:55:38 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.19 19:55:38 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.06.19 19:55:38 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.06.19 19:55:38 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.30 14:32:23 | 000,002,520 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\SearchResults.xml [2012.06.19 19:55:38 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.19 19:55:38 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.18 15:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (no name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [ICQ] C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB407BC5-2567-44EE-A0BF-6A502230D850}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Axel Albert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Axel Albert\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.01.27 18:34:31 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.07.21 09:18:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Malwarebytes [2012.07.21 09:18:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.07.21 09:18:24 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.07.21 09:18:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.07.21 09:18:23 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.07.18 23:37:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe [2012.07.15 01:26:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Ifdfdf [2012.07.08 16:53:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Axel Albert\Startmenü\Programme\WinRAR [2012.07.08 16:53:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WinRAR [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [158 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] [156 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.29 11:04:00 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Axel Albert\defogger_reenable [2012.07.29 11:00:02 | 000,000,504 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job [2012.07.29 10:51:15 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.07.29 10:04:15 | 000,722,268 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.07.29 10:04:15 | 000,682,680 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.07.29 10:04:15 | 000,149,626 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.07.29 10:04:15 | 000,127,524 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012.07.29 10:00:17 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2012.07.29 10:00:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.07.29 10:00:09 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.07.28 20:44:04 | 000,077,824 | ---- | M] () -- C:\Dokumente und Einstellungen\Axel Albert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.07.21 09:18:26 | 000,000,766 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [158 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] [156 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.29 11:04:00 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Axel Albert\defogger_reenable [2012.07.21 09:18:26 | 000,000,766 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2011.08.07 23:37:38 | 021,073,936 | ---- | C] () -- C:\Programme\vlc-1.1.11-win32.exe [2011.06.21 21:22:23 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2011.03.18 20:44:10 | 000,482,408 | ---- | C] () -- C:\WINDOWS\ssndii.exe [2011.03.18 20:40:36 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssp7ml3.dll [2011.03.13 20:33:57 | 000,077,824 | ---- | C] () -- C:\Dokumente und Einstellungen\Axel Albert\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.02.10 19:24:30 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll [2011.02.03 18:18:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2011.02.01 19:53:48 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssp7ml3(2).dll [2011.01.30 02:48:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.01.27 18:53:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2011.01.27 18:53:22 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2011.01.27 18:53:22 | 000,203,336 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2011.01.27 18:53:22 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2011.01.27 18:36:30 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2011.01.27 18:31:15 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2011.01.27 18:24:13 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2011.01.27 18:23:01 | 000,093,480 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT ========== LOP Check ========== [2011.10.31 18:23:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess [2011.06.07 21:40:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FileCure [2011.06.23 16:26:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2012.02.25 14:25:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tarma Installer [2011.04.06 12:14:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software [2011.10.04 15:39:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VistaCodecs [2011.04.06 12:13:37 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} [2011.06.08 17:30:16 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357} [2012.04.17 22:36:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\DVDVideoSoft [2011.04.06 12:00:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\DVDVideoSoftIEHelpers [2011.10.04 15:34:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\GetRightToGo [2012.05.30 18:56:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\ICQ [2012.07.18 23:53:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Ifdfdf [2012.04.17 22:39:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\OpenCandy [2012.07.20 21:49:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\QuickScan [2011.02.10 18:29:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\Spyware Terminator [2011.04.06 12:14:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\TuneUp Software [2011.02.10 19:27:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Axel Albert\Anwendungsdaten\WinBatch [2012.07.29 11:00:02 | 000,000,504 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job [2012.07.29 10:00:17 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job ========== Purity Check ========== < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 29.07.2012 11:05:42 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Axel Albert\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,75 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 69,76% Memory free
4,59 Gb Paging File | 3,86 Gb Available in Paging File | 84,13% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 34,31 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 48,76 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
Drive E: | 200,43 Gb Total Space | 13,82 Gb Free Space | 6,89% Space Free | Partition Type: NTFS
Computer Name: LAPTOP | User Name: Axel Albert | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Disabled:ICQ7.5 -- (ICQ, LLC.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{19BE540F-2A2E-CF4C-F601-5AC5FF9FEB90}" = CCC Help Japanese
"{1DD56C9F-E323-8D7C-EAA4-09EC1085464F}" = CCC Help Swedish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24385EE9-2701-721B-EB46-27D59DED2297}" = Skins
"{2AD994D1-8C1F-E468-175C-785635E658BC}" = CCC Help Norwegian
"{2D50752B-F9D7-81FC-D030-4F06156C8133}" = CCC Help English
"{2F632C07-3A47-E11F-06F8-E2AF237AF4EE}" = CCC Help Polish
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{42358881-F906-264B-CE0D-11E597781C0D}" = ATI Catalyst Install Manager
"{5183F49F-B76D-D44E-904D-1713B978F1F7}" = Catalyst Control Center Localization All
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{56203A94-9AA5-5AA6-2F12-D73DC8CFED21}" = CCC Help Czech
"{6048DAB7-39F5-10A9-D07F-578CA95ACB51}" = CCC Help Hungarian
"{641C323C-EB78-F52F-3A50-C6203F97EAE0}" = CCC Help Korean
"{692986FB-5943-E25B-1C48-EEF3132042D4}" = ccc-utility
"{707EA61C-4294-39AE-630C-2140C98EFB17}" = CCC Help Spanish
"{71754905-3493-CE5E-5BCA-46AE6B07EF02}" = CCC Help German
"{71C5EA91-C62B-03F3-070D-3E430360327C}" = CCC Help Italian
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{797FCA5B-246E-4DE3-D1BB-7CC5B94A8EAF}" = CCC Help Chinese Traditional
"{89F0475A-A906-5925-17D7-DD35728FB6F0}" = CCC Help Dutch
"{A1EB743B-6F98-27E0-0FEF-7989687169A1}" = CCC Help Greek
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3D4DEE3-2CFA-F53A-E9E8-73EDFEA3D382}" = CCC Help Turkish
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B320AEBD-B296-A177-1B98-B622F60BAC3E}" = CCC Help Danish
"{B8B19BC5-7288-20EE-1EE0-204C7270B6E5}" = Catalyst Control Center InstallProxy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BCEA752C-EA6A-880A-855B-135B3B3ECE85}" = CCC Help Chinese Standard
"{BE4BC445-85F1-46FE-80DE-6E6906952C5E}" = HP ESU for Microsoft Windows XP
"{BFF7D162-0705-B71D-2AF7-17D602BD6588}" = CCC Help Finnish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA9660B6-F1DD-41D3-BA3C-E7F7BF9921B2}" = Catalyst Control Center - Branding
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E4D217D2-8C82-B39A-06B6-5DAACF67BA5B}" = ccc-core-static
"{E74286A4-764A-3063-A471-9EFA8DC2F9AD}" = CCC Help Thai
"{EC4BBC09-D38F-01A7-33E3-472C599E66E4}" = CCC Help Portuguese
"{ECB6004B-190C-40AB-6B12-DF6DE7C77608}" = CCC Help Russian
"{ECC27E62-C2E4-3A7A-87CA-4D8B4B3753CC}" = CCC Help French
"{F48BE301-EC78-4686-B580-EE4934558798}" = Broadcom 2070 Bluetooth 3.0
"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = Realtek Ethernet Controller All-In-One Windows Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Samsung ML-1660 Series" = Wartung Samsung ML-1660 Series
"VLC media player" = VLC media player 2.0.1
"WIC" = Windows Imaging Component
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 31.05.2012 11:23:00 | Computer Name = LAPTOP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 08.07.2012 13:18:00 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung vlc.exe, Version 2.0.1.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 11.07.2012 17:18:54 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 13.0.1.4548, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 11.07.2012 17:19:52 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 13.0.1.4548, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 11.07.2012 17:24:17 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 13.0.1.4548, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 11.07.2012 17:25:14 | Computer Name = LAPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 13.0.1.4548, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 18.07.2012 18:51:05 | Computer Name = LAPTOP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung FlashPlayerUpdateService.exe, Version 11.3.300.265,
fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.3520, Fehleradresse 0x000113b5.
Error - 23.07.2012 03:51:21 | Computer Name = LAPTOP | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung FlashPlayerUpdateService.exe, Version 11.3.300.265,
fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.3520, Fehleradresse 0x000113b5.
Error - 23.07.2012 05:30:15 | Computer Name = LAPTOP | Source = Application Error | ID = 1001
Description = Fehlerhafter Speicherbereich -1232882279.
Error - 26.07.2012 14:30:03 | Computer Name = LAPTOP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
[ System Events ]
Error - 23.07.2012 14:02:45 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 23.07.2012 14:02:45 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 26.07.2012 14:29:24 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 26.07.2012 14:29:24 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 27.07.2012 03:09:50 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 27.07.2012 03:09:50 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 27.07.2012 09:47:44 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 27.07.2012 09:47:44 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 29.07.2012 04:00:13 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 29.07.2012 04:00:13 | Computer Name = LAPTOP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
[ TuneUp Events ]
Error - 26.07.2012 14:29:29 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-26 20:29:29', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','844',0)
Error - 26.07.2012 15:53:29 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-26 21:53:29', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3820',0)
Error - 26.07.2012 15:58:34 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-26 21:58:34', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','536',0)
Error - 27.07.2012 03:09:56 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-27 09:09:56', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1084',0)
Error - 27.07.2012 03:09:56 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-27 09:09:56', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','424',0)
Error - 27.07.2012 09:47:49 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-27 15:47:49', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','1216',0)
Error - 27.07.2012 09:47:49 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-27 15:47:49', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','492',0)
Error - 27.07.2012 15:21:34 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-27 21:21:34', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbam.exe','3684',0)
Error - 29.07.2012 04:00:16 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-29 10:00:14', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamservice.exe','876',0)
Error - 29.07.2012 04:00:16 | Computer Name = LAPTOP | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2012-07-29 10:00:16', '\device\harddiskvolume1\programme\malwarebytes'
anti-malware\mbamgui.exe','328',0)
< End of report >
Danke für eine Analyse! Noch die Ergebnisse vom GMER Scan GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-29 12:35:34
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS545032B9A300 rev.PB3OCA1G
Running: kovsryfp.exe; Driver: C:\DOKUME~1\AXELAL~1\LOKALE~1\Temp\fgtdapow.sys
---- System - GMER 1.0.15 ----
SSDT BA6FB114 ZwClose
SSDT BA6FB0CE ZwCreateKey
SSDT BA6FB11E ZwCreateSection
SSDT BA6FB0C4 ZwCreateThread
SSDT BA6FB0D3 ZwDeleteKey
SSDT BA6FB0DD ZwDeleteValueKey
SSDT BA6FB10F ZwDuplicateObject
SSDT BA6FB0E2 ZwLoadKey
SSDT BA6FB0B0 ZwOpenProcess
SSDT BA6FB0B5 ZwOpenThread
SSDT BA6FB0EC ZwReplaceKey
SSDT BA6FB0E7 ZwRestoreKey
SSDT BA6FB123 ZwSetContextThread
SSDT BA6FB0D8 ZwSetValueKey
SSDT BA6FB0BF ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xA938D000, 0x238717, 0xE8000020]
---- EOF - GMER 1.0.15 ----
|
| Themen zu PC durch "Zeus" befallen. Malwarebytes erfolgreich? Ergebnisse vom Scan mit OTL |
| antimalwarebytes, antivir, avira, bho, browser, defender, desktop, einstellungen, error, fehler, firefox, flash player, format, helper, logfile, mozilla, ntdll.dll, realtek, registry, rundll, scan, searchscopes, security, senden, software, spam, spyware, tarma, wurm |
Baum-Darstellung