Trojan.Banker

Rudolf1967 · 31.07.2012, 13:20

Hallo,

habe mit AntiVir gescannt und in Quarantäne geschickt. Dann mit CC-Cleaner bereinigt. Anschließend noch mit Malwarebytes geprüft.

Hier das Ergebnis:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.31.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
***** :: MEDION [Administrator]

31.07.2012 13:25:37
mbam-log-2012-07-31 (13-25-37).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 206606
Laufzeit: 6 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCR\CLSID\{DD31495E-290C-41CF-8C66-7415383F82DE} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DD31495E-290C-41CF-8C66-7415383F82DE} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Spyware.Zbot) -> Daten: C:\Users\*****\AppData\Roaming\appconf32.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\*****\AppData\Roaming\appconf32.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\*****\AppData\Roaming\AcroIEHelpe178.dll (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Was ist jetzt noch zu tun? Kann ich mit dem PC Onlinebanking und Onlinebroking wagen?

Danke für die Hilfe im Voraus!

Gruß aus Bayern

Chris4You · 31.07.2012, 13:40

Hi,

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe

Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output

Unter Extra Registry, wähle bitte Use SafeList

Klicke nun auf Run Scan links oben

Wenn der Scan beendet wurde werden 2 Logfiles erstellt (OTL.TXT und EXTRAS.TXT)

Poste die Logfiles hier in den Thread

MAM updaten und FULLSCAN, Log posten...

Gleich vorneweg: Nach einem Banker sollte Neuaufgesetzt werden, da nicht klar ist was alles an der Kiste gedreht wurde... die Entscheidung liegt bei Dir ;o)

chris

Rudolf1967 · 31.07.2012, 14:03

Hi Chris4me!

Danke für die schnelle Hilfe!

Hier das Ergebnis:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 31.07.2012 14:53:11 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\*****\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,44 Gb Available Physical Memory | 75,17% Memory free
6,50 Gb Paging File | 5,14 Gb Available in Paging File | 79,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 910,41 Gb Total Space | 774,85 Gb Free Space | 85,11% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 10,38 Gb Free Space | 51,92% Space Free | Partition Type: NTFS
Drive G: | 148,98 Gb Total Space | 3,10 Gb Free Space | 2,08% Space Free | Partition Type: FAT32
 
Computer Name: MEDION | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\msi\OSD hot keys\WMI_Hook_Service.exe (MICRO-STAR INT'L,.LTD.)
PRC - C:\Programme\Common Files\microsoft shared\ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
PRC - C:\Programme\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\*****\AppData\Roaming\14001.007\components\AcroFF007.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - C:\Programme\CyberLink\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Programme\CyberLink\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Programme\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (WMI_Hook_Service) -- C:\Programme\msi\OSD hot keys\WMI_Hook_Service.exe (MICRO-STAR INT'L,.LTD.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (Profos) -- C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RMCAST) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (rtl8192se) -- C:\Windows\System32\drivers\rtl8192se.sys (Realtek Semiconductor Corporation                           )
DRV - (NxpCap) -- C:\Windows\System32\drivers\NxpCap.sys (NXP Semiconductors Germany GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (hidkmdf) -- C:\Windows\System32\drivers\hidkmdf.sys (Windows (R) Win 7 DDK provider)
DRV - (NW1950) -- C:\Windows\System32\drivers\NW1950.sys ()
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (nvamacpi) -- C:\Windows\System32\drivers\nvamacpi.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://medion.msn.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{D7BB6A0A-584F-4951-B772-C0F1B3E181EB}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.godmode-trader.de/"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files\Virtual Earth 3D\ [2010.02.04 10:23:46 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.26 07:47:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.13 08:23:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\*****\AppData\Roaming\14001.007 [2012.07.30 14:29:57 | 000,000,000 | ---D | M]
 
[2010.11.11 11:12:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2011.04.04 14:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\ffrqnbfw.default\extensions
[2012.03.29 20:32:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.30 14:29:57 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\******\APPDATA\ROAMING\14001.007
[2012.07.26 07:47:27 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.06 08:17:38 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.19 09:40:11 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.19 09:40:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.19 09:40:11 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.19 09:40:11 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.19 09:40:11 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.19 09:40:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab (Microsoft Genuine Advantage Self Support Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3752C415-0AD3-4D70-88DD-5C627777D71D}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E1DE7C4-B8C6-4228-BF83-840DE6E0F25C}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\System32\acaptuser32.dll (Adobe Systems Incorporated)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.31 14:49:49 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2012.07.31 13:22:57 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes
[2012.07.31 13:22:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.31 13:22:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.31 13:22:17 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.31 13:22:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.30 14:29:56 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\14001.007
[2012.07.29 14:14:04 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\14001.006
[2012.07.29 14:13:41 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\xmldm
[2012.07.29 14:13:40 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\kock
[2012.07.26 12:19:08 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Elementarschaden 07.2012
[2012.07.25 16:06:41 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Neuer Ordner
[2012.07.18 14:45:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\svnet
[2012.07.18 14:45:04 | 000,790,528 | ---- | C] (Polar          sales@polarsoftware.com        www.polarsoftware.com) -- C:\Windows\System32\polarcrypto.dll
[2012.07.18 14:45:04 | 000,266,307 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartWebASP.dll
[2012.07.18 14:45:04 | 000,221,184 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartSock.dll
[2012.07.18 14:45:04 | 000,163,840 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartSecure2.dll
[2012.07.18 14:45:04 | 000,155,648 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartCertificate.dll
[2012.07.18 14:45:04 | 000,147,456 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartWeb.dll
[2012.07.18 14:45:04 | 000,122,880 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartWebUtil.dll
[2012.07.18 14:45:03 | 001,114,112 | ---- | C] (ComponentOne LLC) -- C:\Windows\System32\tdbl8.ocx
[2012.07.18 14:45:03 | 001,060,864 | ---- | C] (ComponentOne LLC) -- C:\Windows\System32\tdbg8.ocx
[2012.07.18 14:45:03 | 000,794,304 | ---- | C] (Data Dynamics) -- C:\Windows\System32\Actbar2.ocx
[2012.07.18 14:45:03 | 000,311,296 | ---- | C] (ComponenetOne) -- C:\Windows\System32\c1sizer.ocx
[2012.07.18 14:45:02 | 000,507,904 | ---- | C] (ComponentOne LLC) -- C:\Windows\System32\vsrpt8.ocx
[2012.07.18 14:45:02 | 000,417,792 | ---- | C] (ComponentOne) -- C:\Windows\System32\vsprint8.ocx
[2012.07.18 14:45:02 | 000,192,512 | ---- | C] (ComponentOne) -- C:\Windows\System32\vsvport8.ocx
[2012.07.18 14:45:02 | 000,152,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\COMDLG32.OCX
[2012.07.18 14:45:01 | 000,089,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Vb5db.dll
[2012.07.18 14:45:00 | 000,000,000 | ---D | C] -- C:\Program Files\svnet
[2012.07.16 17:51:23 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\BMW.Navigation.DVD.Road.Map.Europe.PROFESSIONAL.2012.Blitzer.Edition.DVD2
[2012.07.12 07:24:52 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.12 07:24:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.12 07:24:49 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.12 07:24:49 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.12 07:24:48 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.12 07:24:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.12 07:24:46 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.12 07:24:32 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.12 07:20:40 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.11 07:18:09 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.11 07:18:06 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012.07.11 07:18:04 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012.07.04 21:14:13 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Garmin City Navigator Western-Europa NT 2012.30 - 2GB Version - IMG Unlocked
[2012.07.04 21:13:53 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Garmin City Navigator Europa NT 2012.30 - MapSource UnLocked
[2012.07.04 21:13:07 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Garmin City Navigator D-A-CH NT 2012.30 - IMG Unlocked
[2012.02.20 15:57:32 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\*****\AppData\Roaming\pcouffin.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*****\AppData\Roaming\*.tmp files -> C:\Users\*****\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.31 14:49:50 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2012.07.31 14:48:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.31 14:15:39 | 000,009,888 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 14:15:39 | 000,009,888 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.31 14:12:16 | 000,654,150 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.31 14:12:16 | 000,616,032 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.31 14:12:16 | 000,130,022 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.31 14:12:16 | 000,106,412 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.31 14:07:45 | 2616,643,584 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.31 13:22:21 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.31 09:32:15 | 000,079,578 | ---- | M] () -- C:\Users\*****\Desktop\Sammelmappe1.pdf
[2012.07.31 06:44:55 | 000,000,034 | ---- | M] () -- C:\Users\*****\AppData\Roaming\blckdom.res
[2012.07.30 10:05:57 | 002,054,550 | ---- | M] () -- C:\Users\*****\Desktop\AG602-02_Darlehensanfrage-DVAG.pdf
[2012.07.27 12:24:46 | 001,310,739 | ---- | M] () -- C:\Users\*****\Desktop\Vermögensplan-AusdruckH.pdf
[2012.07.25 14:27:41 | 000,062,284 | ---- | M] () -- C:\Users\*****\Desktop\BMW 118d.pdf
[2012.07.25 10:49:59 | 001,557,892 | ---- | M] () -- C:\Users\*****\Desktop\BMW Selbstauskunft.pdf
[2012.07.25 10:17:15 | 000,024,804 | ---- | M] () -- C:\Users\*****\Desktop\meineSchufa25072012.pdf
[2012.07.24 18:25:40 | 000,071,336 | ---- | M] () -- C:\Users\*****\Desktop\gute-rate-angebot-3177946.pdf
[2012.07.23 11:36:43 | 000,922,933 | ---- | M] () -- C:\Users\*****\Desktop\3.pdf
[2012.07.23 11:36:17 | 002,323,446 | ---- | M] () -- C:\Users\*****\Desktop\2.pdf
[2012.07.23 11:35:45 | 002,383,169 | ---- | M] () -- C:\Users\*****\Desktop\1.pdf
[2012.07.23 11:34:44 | 000,862,441 | ---- | M] () -- C:\Users\*****\Desktop\ScanImage003.jpg
[2012.07.23 11:33:33 | 002,170,169 | ---- | M] () -- C:\Users\*****\Desktop\ScanImage002.jpg
[2012.07.23 11:32:35 | 002,228,688 | ---- | M] () -- C:\Users\*****\Desktop\ScanImage001.jpg
[2012.07.20 22:39:04 | 001,347,819 | ---- | M] () -- C:\Users\*****\Desktop\IMG_1778.jpg
[2012.07.20 14:32:04 | 002,766,041 | ---- | M] () -- C:\Users\*****\Desktop\IMG_1815.JPG
[2012.07.19 22:12:19 | 734,017,536 | ---- | M] () -- C:\Users\*****\Desktop\Bezaubernde L_gen (2010).avi
[2012.07.19 14:06:38 | 000,537,047 | ---- | M] () -- C:\Users\*****\Desktop\2.9 562 904.00 Frau Lienerth.pdf
[2012.07.17 16:32:42 | 001,434,061 | ---- | M] () -- C:\Users\*****\Desktop\Kopie Leasingvertrag 2009.pdf
[2012.07.17 14:29:36 | 000,733,140 | ---- | M] () -- C:\Users\*****\Desktop\C-Jugend-Bild3.jpg
[2012.07.17 14:23:20 | 000,958,369 | ---- | M] () -- C:\Users\*****\Desktop\C-Jugend-Bild2.jpg
[2012.07.17 14:11:31 | 001,084,692 | ---- | M] () -- C:\Users\*****\Desktop\C-Jugend-Bild.jpg
[2012.07.17 07:45:12 | 000,024,332 | ---- | M] () -- C:\Users\*****\Desktop\meineSchufa.pdf
[2012.07.16 10:31:56 | 000,013,086 | ---- | M] () -- C:\Users\*****\Desktop\Selbstauskunft.pdf
[2012.07.13 10:34:23 | 000,287,874 | ---- | M] () -- C:\Users\*****\Desktop\AG42K1342168052606.pdf
[2012.07.12 07:54:10 | 000,486,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.11 14:02:57 | 000,012,038 | ---- | M] () -- C:\Users\*****\Desktop\gleitzonenrechner.pdf
[2012.07.11 13:48:56 | 000,017,115 | ---- | M] () -- C:\Users\*****\Desktop\Callback-Service - SEB Asset Management.pdf
[2012.07.09 14:14:31 | 000,012,181 | ---- | M] () -- C:\Users\*****\Desktop\Kurzübersicht.pdf
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*****\AppData\Roaming\*.tmp files -> C:\Users\*****\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.31 13:22:21 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.31 09:32:15 | 000,079,578 | ---- | C] () -- C:\Users\*****\Desktop\Sammelmappe1.pdf
[2012.07.30 10:05:57 | 002,054,550 | ---- | C] () -- C:\Users\*****\Desktop\AG602-02_Darlehensanfrage-DVAG.pdf
[2012.07.29 14:13:54 | 000,000,034 | ---- | C] () -- C:\Users\*****\AppData\Roaming\blckdom.res
[2012.07.27 12:24:46 | 001,310,739 | ---- | C] () -- C:\Users\*****\Desktop\Vermögensplan-AusdruckH.pdf
[2012.07.25 14:27:41 | 000,062,284 | ---- | C] () -- C:\Users\*****\Desktop\BMW 118d.pdf
[2012.07.25 10:49:59 | 001,557,892 | ---- | C] () -- C:\Users\*****\Desktop\BMW Selbstauskunft.pdf
[2012.07.25 10:17:15 | 000,024,804 | ---- | C] () -- C:\Users\*****\Desktop\meineSchufa25072012.pdf
[2012.07.24 18:25:37 | 000,071,336 | ---- | C] () -- C:\Users\*****\Desktop\gute-rate-angebot-3177946.pdf
[2012.07.23 11:36:43 | 000,922,933 | ---- | C] () -- C:\Users\*****\Desktop\3.pdf
[2012.07.23 11:36:17 | 002,323,446 | ---- | C] () -- C:\Users\*****\Desktop\2.pdf
[2012.07.23 11:35:44 | 002,383,169 | ---- | C] () -- C:\Users\*****\Desktop\1.pdf
[2012.07.23 11:34:43 | 000,862,441 | ---- | C] () -- C:\Users\*****\Desktop\ScanImage003.jpg
[2012.07.23 11:33:31 | 002,170,169 | ---- | C] () -- C:\Users\*****\Desktop\ScanImage002.jpg
[2012.07.23 11:32:33 | 002,228,688 | ---- | C] () -- C:\Users\*****\Desktop\ScanImage001.jpg
[2012.07.20 22:39:02 | 001,347,819 | ---- | C] () -- C:\Users\*****\Desktop\IMG_1778.jpg
[2012.07.20 22:28:29 | 002,766,041 | ---- | C] () -- C:\Users\*****\Desktop\IMG_1815.JPG
[2012.07.19 22:04:15 | 734,017,536 | ---- | C] () -- C:\Users\*****\Desktop\Bezaubernde L_gen (2010).avi
[2012.07.19 14:06:38 | 000,537,047 | ---- | C] () -- C:\Users\*****\Desktop\2.9 562 904.00 Frau Lienerth.pdf
[2012.07.17 16:32:42 | 001,434,061 | ---- | C] () -- C:\Users\*****\Desktop\Kopie Leasingvertrag 2009.pdf
[2012.07.17 14:29:34 | 000,733,140 | ---- | C] () -- C:\Users\*****\Desktop\C-Jugend-Bild3.jpg
[2012.07.17 14:23:18 | 000,958,369 | ---- | C] () -- C:\Users\*****\Desktop\C-Jugend-Bild2.jpg
[2012.07.17 14:11:31 | 001,084,692 | ---- | C] () -- C:\Users\*****\Desktop\C-Jugend-Bild.jpg
[2012.07.17 07:45:12 | 000,024,332 | ---- | C] () -- C:\Users\*****\Desktop\meineSchufa.pdf
[2012.07.16 10:31:55 | 000,013,086 | ---- | C] () -- C:\Users\*****\Desktop\Selbstauskunft.pdf
[2012.07.13 10:34:23 | 000,287,874 | ---- | C] () -- C:\Users\*****\Desktop\AG42K1342168052606.pdf
[2012.07.11 14:02:57 | 000,012,038 | ---- | C] () -- C:\Users\*****\Desktop\gleitzonenrechner.pdf
[2012.07.11 13:48:56 | 000,017,115 | ---- | C] () -- C:\Users\*****\Desktop\Callback-Service - SEB Asset Management.pdf
[2012.07.09 14:14:31 | 000,012,181 | ---- | C] () -- C:\Users\*****\Desktop\Kurzübersicht.pdf
[2012.06.09 23:48:46 | 000,000,114 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat
[2012.02.20 15:57:32 | 000,087,608 | ---- | C] () -- C:\Users\*****\AppData\Roaming\inst.exe
[2012.02.20 15:57:32 | 000,007,887 | ---- | C] () -- C:\Users\*****\AppData\Roaming\pcouffin.cat
[2012.02.20 15:57:32 | 000,001,144 | ---- | C] () -- C:\Users\*****\AppData\Roaming\pcouffin.inf
[2011.12.05 11:40:43 | 000,006,712 | ---- | C] () -- C:\Users\*****\AppData\Roaming\mdbu.bin
[2011.08.10 13:38:41 | 000,078,593 | ---- | C] () -- C:\Users\*****\Putzplan.pdf
[2011.07.28 14:00:23 | 000,000,120 | ---- | C] () -- C:\Users\*****\GO-Conference.ini
[2011.04.28 13:51:34 | 000,072,423 | -H-- | C] () -- C:\Users\*****\Cache.mxc3
[2011.01.25 13:21:16 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.01.25 13:21:16 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.01.13 14:58:20 | 000,016,384 | ---- | C] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.13 20:17:22 | 000,202,753 | ---- | C] () -- C:\Users\*****\9.jpg
 
< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 31.07.2012 14:53:11 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\*****\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,44 Gb Available Physical Memory | 75,17% Memory free
6,50 Gb Paging File | 5,14 Gb Available in Paging File | 79,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 910,41 Gb Total Space | 774,85 Gb Free Space | 85,11% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 10,38 Gb Free Space | 51,92% Space Free | Partition Type: NTFS
Drive G: | 148,98 Gb Total Space | 3,10 Gb Free Space | 2,08% Space Free | Partition Type: FAT32
 
Computer Name: MEDION | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Program Files\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MIF5BA~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Pixum Fotobuch] -- "C:\Program Files\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1355CF28-9EE8-4C4A-B92D-09FF9AEECB68}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{147A3845-495F-4893-90C3-AE8EF8D50883}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{1496A042-6C8F-42DE-B5E1-92FAB4E2FCCB}" = rport=139 | protocol=6 | dir=out | app=system | 
"{1EC50E67-BDD8-4DDF-B5DD-E0CDA61A0D97}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{259CCB4C-DBDE-49ED-86D7-CC33E5F4A40A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2911A4F8-F1FD-40E9-BAE5-47C7E2E3B6CE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{35FA3A0A-A9A7-4B30-AF94-04C625509501}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3C568C31-D841-4A18-8704-FFA91257C88B}" = lport=139 | protocol=6 | dir=in | app=system | 
"{3EBEDE5F-F6C4-4C52-8BB8-960BAAC09A0E}" = rport=137 | protocol=17 | dir=out | app=system | 
"{4CA565D8-5E51-42ED-BA0C-BEF3E8B3E20A}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{4DF0A03F-E673-450D-9DEC-D35D8123D893}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{504B6525-6730-4672-91C8-BBD662503844}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=%systemroot%\system32\snmptrap.exe | 
"{539B6668-33CF-4F6F-8171-AF33CF5EEE68}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5CF6EC44-37FA-4536-B38D-311AEFC3D801}" = rport=138 | protocol=17 | dir=out | app=system | 
"{60E8FE9A-EB97-4EB0-AB6E-E527E9845B75}" = lport=137 | protocol=17 | dir=in | app=system | 
"{6B5E9139-2FAB-4F14-A66D-F616EDEB9657}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6FEACC58-4163-4A03-A79C-F0793363742E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{7979363A-87B3-43A6-8283-6F6D9D5E8D12}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{88A97DDE-A0B9-461A-A7F5-F0A5F8063784}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{8BD846F9-617E-49EF-8B66-CFD6D17CF601}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{9CD526E7-A0C2-42CE-BE3A-CB9EAEE4C6C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{9D21CD84-3F3F-4E87-8295-1E85AE3390A5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{9EA456E1-EF14-4511-85D5-B2CBBB23155F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{A39878E6-2378-41B7-B454-10E08FD77460}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{A9DB4F4D-3A64-4B2A-9FD5-820A12805B4A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{ADEEE506-A9DB-452A-8509-9D1FBC60F132}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{AE6FC94E-0F6D-4AF6-B1ED-6944601CC8A8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{AEA81723-D0EA-4535-937F-4FEAD3FC3A61}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C01ED6C7-7032-406A-A13F-985AB44A12AC}" = lport=138 | protocol=17 | dir=in | app=system | 
"{C872BFEE-37DB-4AB3-A173-00B7B66ABEEB}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D2598AD8-2FD2-47BA-AD43-BE9847306DAC}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{D3C5C588-A0E8-4D59-96BD-ADDC761E126E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D8D46289-A469-4397-8F10-6D3FFC43869A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DC860EB5-17D7-43F2-ABC4-7FFE9F58D2D0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E231E7D6-9451-4AD7-87FA-379E3B4EC24F}" = lport=445 | protocol=6 | dir=in | app=system | 
"{E340F8D3-8E3A-405E-967E-AA2F470E70AD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F4945DBF-BA70-4686-B6CF-2CAC35611FEC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05A00F36-982A-4FCF-98F9-07AB46B5A27D}" = dir=in | app=c:\program files\cyberlink\youmemo\kernel\dmp\clbrowserengine.exe | 
"{07B78EA8-79B2-4D13-B47A-2D52F4E75774}" = dir=in | app=c:\program files\cyberlink\powercinema movie\powercinemamovie.exe | 
"{090AF306-AB92-4519-8D53-726A3618AF38}" = dir=in | app=c:\program files\cyberlink\powercinema\kernel\dms\clmsservice.exe | 
"{0C7DD1B5-43F2-435B-8182-A2D93E54E7A0}" = dir=in | app=c:\program files\cyberlink\youmemo\youmemo.exe | 
"{0F392924-9C41-470E-88B8-18AD04BDD189}" = dir=in | app=c:\program files\cyberlink\youmemo\kernel\dms\clmsservice.exe | 
"{18638D94-DFCD-4F34-880A-34DEE891BB32}" = dir=in | app=c:\program files\cyberlink\powerdvd9\powerdvd cinema\powerdvdcinema.exe | 
"{1D10DD8F-52DD-4ADB-9644-B70909EC0720}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{1F734751-B697-4B45-BEEB-304AFCA6BE9C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{22F2367F-45F7-4FA6-AF96-B7BC7F85BE34}" = protocol=6 | dir=out | app=%systemroot%\system32\wudfhost.exe | 
"{25DBB59F-4793-4AE6-BEAB-734DE1390702}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{31C43B37-2BDC-47C5-8C70-F111C395F4CC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{325FF6D5-12A6-415A-A0EF-1D3523D9503E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3266F8C0-F91D-4C64-883B-D7F10359472D}" = dir=in | app=c:\program files\cyberlink\powerdvd9\powerdvd9.exe | 
"{34FA07EC-61A4-44D2-A064-67AB5132F173}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{358FAB34-0985-4392-903E-CBFF766E3BF7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{55EC84E8-EC2A-4DFB-BEBF-752AF5E6F92F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{5B45A655-9727-4D05-8AF3-A5D6D01FF53A}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{602CD244-7453-4F78-B9C5-EE3327030177}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{61619242-8DC2-492A-9179-ECF2D40F2903}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{7D2F0718-3DC2-4365-B9C8-3452DBABF8A1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8A70F991-E965-4E6A-8441-69BC8664EACB}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{8C4D9EE4-E2C8-4E36-BC16-3E7D5B8C5984}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{907E5DF1-814B-436E-B3F7-7670A4FA3356}" = dir=in | app=c:\program files\cyberlink\powercinema\kernel\dmp\clbrowserengine.exe | 
"{94EE57A7-B6DC-48CE-BAAA-3373D98DAD1B}" = dir=in | app=c:\program files\cyberlink\powercinema\powercinema.exe | 
"{9E1CBACC-B162-4A67-A8E7-8D838EA4EEE2}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{9E464F21-77EE-4B85-BD5C-952FE70CF4C9}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{A455B6B7-E9EF-4C8E-88DB-D2CA2269F228}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ACA53195-20BD-4A3F-95C5-E95B05B3FA5E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C3BEFAB3-A7E0-44D1-915F-608D99C9C1D3}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{C4D5EA2A-2557-48D2-A786-68BF61C12A3D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{CBE9A46E-8C71-4F4C-BF9A-45339667FEFC}" = protocol=6 | dir=out | app=system | 
"{CD073175-34F2-4EB1-8A20-6BCD0BDF8B1C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{D0BA4B68-D95D-4513-A0A5-7173E1913CDC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D7A01BE4-3D03-453F-9CD4-CA515959D09D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{D9B5C942-066C-4505-B6CE-358FB4DC16BE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DA451386-4FA8-4BA0-913B-F5A36F6C6A40}" = dir=in | app=c:\program files\cyberlink\powercinema\pcmservice.exe | 
"{E24B4645-1CBE-4E4D-94B1-994A2ED11C11}" = dir=in | app=c:\program files\cyberlink\youmemo\pcmservice.exe | 
"{E4AB10A9-ED2D-46FB-A658-0EBD3BB797DB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{E9F712D9-B184-4E63-B0E9-E12C139C47B9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F8D57D21-BD3C-478D-960F-910A2228B637}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{FF162D1A-45C2-42B2-8787-5F5F88620AB8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{108EE87E-5FBE-449B-BF7A-482D3A98F064}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{4E5168D9-68AA-4A2F-99B6-24AEB3BB8F5F}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{A2AC4FBA-49CE-4C72-9CCF-2432E96C7936}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{F3C73299-F753-4B0E-8F72-2F70A2AECCAB}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{003A158D-5968-4463-83AC-FC4CED024A43}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{7653F08A-4F9D-4ABF-AFE2-9CA0AC70A125}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{C838B37C-AF51-4688-AA69-CB0B1C36443B}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{E791CA99-196F-493C-A60D-8726E757D298}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID-Anmelde-Assistent
"{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service
"{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Medion Touch Center
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}" = Microsoft XNA Framework Redistributable 3.0
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E6F0CAD-EE38-42A5-9EEA-AE17A55BF2D4}" = Firebird SQL Server - MAGIX Edition
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{406A89D6-09E6-4550-B370-8D376DDB56BE}" = Adobe Flash Player 10 ActiveX
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{41357C72-23AD-440C-9538-3350AF076253}" = calibre
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4785CED6-73B3-45FA-AFE6-EDEDFDE67842}" = Steuer 2011
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B526075-AF27-47A2-860D-3DA92928A051}" = Steuer 2010
"{5176C4D8-E6C1-422A-8D6F-E13EB996DCEA}" = CyberLink YouMemo
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70CC0095-AA68-45BE-AE98-D8170182E9EB}" = PowerCinema Movie
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72BF1DA0-2B00-4794-9173-159722019B74}" = CyberLink YouPaint
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8FF90DB8-6DED-44A3-B182-244FEC09012F}" = Microsoft Touch Pack for Windows 7
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{A081C347-F821-434F-B75B-3C175163C0D7}" = OSD hot keys
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{AB770FDE-8087-4C98-9A85-BD64262C104C}" = Medion Home Cinema
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_950" = Adobe Acrobat 9.5.0 - CPSID_83708
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU]
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}" = NVIDIA PhysX
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.9
"ALDI Süd Foto Manager Free D" = ALDI Süd Foto Manager Free
"ALDI Süd Foto Service D" = ALDI Süd Foto Service
"ALDI SÜD Mah Jong" = ALDI SÜD Mah Jong
"ALDI Süd Online Druck Service D" = ALDI Süd Online Druck Service
"AllDup_is1" = AllDup 3.4.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DVAG Online System" = DVAG Online-System
"DWS_Power_Inside_5_is1" = DWS Power Inside Version 7/2011 Update 6.5.6
"FEXtraderPro" = FEXtrader Pro
"FreeFileSync" = FreeFileSync v3.19
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Medion Touch Center
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{5176C4D8-E6C1-422A-8D6F-E13EB996DCEA}" = CyberLink YouMemo
"InstallShield_{72BF1DA0-2B00-4794-9173-159722019B74}" = CyberLink YouPaint
"InstallShield_{A081C347-F821-434F-B75B-3C175163C0D7}" = OSD hot keys
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{AB770FDE-8087-4C98-9A85-BD64262C104C}" = Medion Home Cinema
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"Kyocera Product Library" = Kyocera Product Library
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MEDION Fotos auf CD & DVD SE Sued D" = MEDION Fotos auf CD & DVD SE Sued
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Pixum Fotobuch" = Pixum Fotobuch
"sv.net" = sv.net
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 beta 5 (32-bit)
"Xvid_is1" = Xvid 1.2.2 final uninstall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Advanced PDF Password Recovery" = Advanced PDF Password Recovery
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.07.2012 03:51:35 | Computer Name = Medion | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\freefilesync\Bin\RealtimeSync_x64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 18.07.2012 05:00:18 | Computer Name = Medion | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\freefilesync\Bin\FreeFileSync_x64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 18.07.2012 05:00:18 | Computer Name = Medion | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\freefilesync\Bin\RealtimeSync_x64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 18.07.2012 11:16:11 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 6320 ,Logged: Fehler 28 beim Entpacken
 
Error - 18.07.2012 11:18:40 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 6320 ,Logged: Fehler 28 beim Entpacken
 
Error - 18.07.2012 12:23:42 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 6320 ,Logged: Fehler 28 beim Entpacken
 
Error - 18.07.2012 12:24:53 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 6320 ,Logged: Fehler 28 beim Entpacken
 
Error - 18.07.2012 12:26:33 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 7888 ,Logged: Fehler 28 beim Entpacken
 
Error - 19.07.2012 05:56:29 | Computer Name = Medion | Source = VBRuntime | ID = 1
Description = The VB Application identified by the event source logged this Application
 svnet: Thread ID: 7656 ,Logged: Fehler 28 beim Entpacken
 
Error - 23.07.2012 06:00:03 | Computer Name = Medion | Source = Windows Backup | ID = 4103
Description = 
 
Error - 30.07.2012 06:00:23 | Computer Name = Medion | Source = Windows Backup | ID = 4103
Description = 
 
[ Media Center Events ]
Error - 13.02.2011 14:22:51 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 19:22:51 - Fehler beim Herstellen der Internetverbindung.  19:22:51 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 13.02.2011 14:23:02 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 19:22:56 - Fehler beim Herstellen der Internetverbindung.  19:22:56 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 07.03.2011 02:54:26 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 07:54:25 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 zugrunde liegende Verbindung wurde geschlossen: Unerwarteter Fehler beim Senden..)
 
 
Error - 07.03.2011 02:57:31 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 07:56:06 - MCEClientUX konnte nicht abgerufen werden (Fehler: Timeout
 für Vorgang überschritten)  
 
Error - 07.03.2011 02:57:31 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 07:57:31 - Broadband konnte nicht abgerufen werden (Fehler: Der Remotename
 konnte nicht aufgelöst werden: 'data.tvdownload.microsoft.com')  
 
Error - 07.03.2011 02:57:43 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 07:57:31 - EpgListings konnte nicht abgerufen werden (Fehler: Der 
Remotename konnte nicht aufgelöst werden: 'data.tvdownload.microsoft.com')  
 
Error - 08.03.2011 00:56:03 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 05:56:03 - Fehler beim Herstellen der Internetverbindung.  05:56:03 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 08.03.2011 00:56:20 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 05:56:08 - Fehler beim Herstellen der Internetverbindung.  05:56:08 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 08.03.2011 01:59:25 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 06:59:25 - Fehler beim Herstellen der Internetverbindung.  06:59:25 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 08.03.2011 01:59:36 | Computer Name = Medion | Source = MCUpdate | ID = 0
Description = 06:59:30 - Fehler beim Herstellen der Internetverbindung.  06:59:30 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ OSession Events ]
Error - 13.06.2011 17:18:11 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 40379
 seconds with 2160 seconds of active time.  This session ended with a crash.
 
Error - 30.08.2011 05:28:24 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 30.08.2011 05:28:43 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 29.09.2011 02:10:57 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6565.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 3
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 10.10.2011 11:01:51 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4403
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 30.01.2012 08:40:46 | Computer Name = Medion | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6654.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 31.07.2012 00:44:56 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 01:15:23 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 03:14:31 | Computer Name = Medion | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Netman erreicht.
 
Error - 31.07.2012 03:14:34 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 04:13:21 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 05:30:44 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 07:41:54 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 08:06:31 | Computer Name = Medion | Source = DCOM | ID = 10010
Description = 
 
Error - 31.07.2012 08:48:24 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
Error - 31.07.2012 08:48:26 | Computer Name = Medion | Source = ipnathlp | ID = 31004
Description = 
 
 
< End of report >

--- --- ---

Spende mit PayPal... schnell und sicher! Finde ich gut

Spende:

Geht das dann richtig an gregor@all.... oder eine andere Adresse besser?

Chris4You · 31.07.2012, 15:12

Hi,

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Users\*****\AppData\Roaming\14001.007\components\AcroFF007.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Falls die Datei nicht erkannt wird, den Eintrag aus dem OTL-Script rausnehmen:
[2012.07.30 14:29:56 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\14001.007

Fix für OTL:

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:

ATTFilter

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
[2012.07.30 14:29:56 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\14001.007
[2012.07.29 14:14:04 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\14001.006
[2012.07.29 14:13:41 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\xmldm
[2012.07.29 14:13:40 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\kock

:Commands
[emptytemp]
[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Superantispyware (SASW):
http://www.trojaner-board.de/51871-a...tispyware.html

chris
Ps.: Mit PayPal bin ich überfragt, ich kann Dir ja meinen geben ;o)

Rudolf1967 · 31.07.2012, 15:41

Wow Chris,

jetzt wird es immer komplizierter für mich. Kenne mich ja nicht so gut aus:

Reicht das hier:

Compilation timedatestamp.....: 2012-07-30 10:33:25
Target machine................: 0x14C (Intel 386 or later processors and compatible processors)
Entry point address...........: 0x0000C598

PE Sections...................:

Name Virtual Address Virtual Size Raw Size Entropy MD5
.text 4096 88312 88576 6.54 7aa4ec7774b8e4869e6defdbd5502bc1
.rdata 94208 27005 27136 5.45 82e4e0fedb8d8b4f8243d0f864662027
.data 122880 20736 4608 3.07 976271a30337fe4e2f6ac8e5ff885bbe
.reloc 147456 9308 9728 4.83 4163907f97e387b9dc71102f6e4cefb0

PE Imports....................:

[[KERNEL32.dll]]
MultiByteToWideChar, GlobalAlloc, GlobalFree, GetProcAddress, LoadLibraryW, VirtualQuery, lstrlenA, lstrlenW, lstrcmpW, lstrcmpA, WideCharToMultiByte, InterlockedExchangeAdd, GetLastError, lstrcatW, lstrcpyW, GetModuleFileNameW, lstrcmpiW, CloseHandle, WriteFile, CreateFileW, lstrcpyA, FindNextFileW, SetEndOfFile, SetFilePointer, ReadFile, GetFileTime, GetFileAttributesW, GetCurrentProcessId, GlobalUnlock, GlobalLock, GetCurrentThreadId, LocalAlloc, FreeLibrary, InterlockedExchange, LoadLibraryA, RaiseException, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, DecodePointer, EncodePointer, RtlUnwind, GetCommandLineA, GetCurrentProcess, GetStdHandle, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, SetLastError, LCMapStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, IsProcessorFeaturePresent, Sleep, ExitProcess, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, GetStartupInfoW, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, EnterCriticalSection, LeaveCriticalSection, SetStdHandle, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, WriteConsoleW

PE Exports....................:

DllRegisterServer, DllUnregisterServer, NSModule

First seen by VirusTotal
2012-07-31 14:32:25 UTC ( 1 Minute ago )
Last seen by VirusTotal
2012-07-31 14:32:25 UTC ( 1 Minute ago )
File names (max. 25)

AcroFF007.dll

B

Kopiere jetzt einfach mal alle Fenster und mache dann weiter:

Merci

SHA256: fc8eefb7c8205be792a616ccdab2f429e6c5705f14bc227f0a24359dc0f59587
SHA1: 536f35b850ebdd2c2b45e72f9f9b2ef6801c0696
MD5: 5fb9d49646acad1d4d369677ad8e1173
File size: 131.1 KB ( 134200 bytes )
File name: AcroFF007.dll
File type: Win32 DLL
Detection ratio: 4 / 41
Analysis date: 2012-07-31 14:32:25 UTC ( 0 Minuten ago )

ssdeep
3072:zc82u3LX5AsMV1jQFYo4s7nbq+qfoPm4QrpuJWPDMzcu/Lkk:zJ2WLX5AsU1jQFYo4MwfB4QlcEUFjkk
TrID
Win32 Executable MS Visual C++ (generic) (75.0%)
Win32 Executable Generic (16.9%)
Generic Win/DOS Executable (3.9%)
DOS Executable Generic (3.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ExifTool

MIMEType.................: application/octet-stream
Subsystem................: Windows GUI
MachineType..............: Intel 386 or later, and compatibles
TimeStamp................: 2012:07:30 12:33:25+02:00
FileType.................: Win32 DLL
PEType...................: PE32
CodeSize.................: 88576
LinkerVersion............: 10.0
EntryPoint...............: 0xc598
InitializedDataSize......: 57856
SubsystemVersion.........: 5.1
ImageVersion.............: 0.0
OSVersion................: 5.1
UninitializedDataSize....: 0

First seen by VirusTotal
2012-07-31 14:32:25 UTC ( 1 Minute ago )
Last seen by VirusTotal
2012-07-31 14:32:25 UTC ( 1 Minute ago )
File names (max. 25)

AcroFF007.dll

GUT SO?

Hier das Ergebnis von Malware:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.31.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
***** :: MEDION [Administrator]

31.07.2012 15:05:08
mbam-log-2012-07-31 (15-05-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 410444
Laufzeit: 1 Stunde(n), 33 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
G:\Downloads\3112\Microsoft.Office.Professional.Plus.2010.x64.German.VL.Edition-Bart\Dox\mini-KMS_Activator_v1.052.exe (Riskware.Keygen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Brauchst Du das hier?

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Users\*****\AppData\Roaming\14001.007\components folder moved successfully.
C:\Users\*****\AppData\Roaming\14001.007 folder moved successfully.
C:\Users\*****\AppData\Roaming\14001.006\components folder moved successfully.
C:\Users\*****\AppData\Roaming\14001.006 folder moved successfully.
C:\Users\*****\AppData\Roaming\xmldm folder moved successfully.
C:\Users\*****\AppData\Roaming\kock folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Gast
->Temp folder emptied: 110266833 bytes
->Temporary Internet Files folder emptied: 147634170 bytes
->Java cache emptied: 300009 bytes
->FireFox cache emptied: 510757630 bytes
->Flash cache emptied: 10813 bytes

User: Public

User: *****
->Temp folder emptied: 398428 bytes
->Temporary Internet Files folder emptied: 134752 bytes
->Java cache emptied: 4384537 bytes
->FireFox cache emptied: 54809975 bytes
->Flash cache emptied: 493 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3112918 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 741 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 794,00 mb

OTL by OldTimer - Version 3.2.55.0 log created on 07312012_165340

Files\Folders moved on Reboot...
C:\Users\*****\AppData\Local\Temp\A3DOfc_26fc3c1e-4066-4a27-b45e-e06088541dff.u3d moved successfully.
C:\Users\*****\AppData\Local\Temp\A3DOfc_d2e001e5-b874-49da-9211-4e12aa43ed5c.u3d moved successfully.
File\Folder C:\Users\*****\AppData\Local\Temp\~DF7DDC27061800BE44.TMP not found!
C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRC0000.tmp moved successfully.
C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4D5241E7-BDB2-4197-B4B5-771AC2A6FFD6}.tmp moved successfully.
File\Folder C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{6F973EF9-E1C0-494C-AF58-06A83AAAB3CC}.tmp not found!
File\Folder C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1FDF9E2C-405A-4474-B8BD-5B70D3F67140}.tmp not found!
C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5000E8A2-91F7-42B9-9701-2CA8DB3998CA}.tmp moved successfully.
C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EFC4AAB1-A0EB-4E60-BC99-1ECF6775BFA9}.tmp moved successfully.
File\Folder C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FC6116BC-96DA-46EC-8021-67558E7B4607}.tmp not found!

PendingFileRenameOperations files...
File C:\Users\*****\AppData\Local\Temp\A3DOfc_26fc3c1e-4066-4a27-b45e-e06088541dff.u3d not found!
File C:\Users\*****\AppData\Local\Temp\A3DOfc_d2e001e5-b874-49da-9211-4e12aa43ed5c.u3d not found!
File C:\Users\*****\AppData\Local\Temp\~DF7DDC27061800BE44.TMP not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRC0000.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{4D5241E7-BDB2-4197-B4B5-771AC2A6FFD6}.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{6F973EF9-E1C0-494C-AF58-06A83AAAB3CC}.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1FDF9E2C-405A-4474-B8BD-5B70D3F67140}.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5000E8A2-91F7-42B9-9701-2CA8DB3998CA}.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EFC4AAB1-A0EB-4E60-BC99-1ECF6775BFA9}.tmp not found!
File C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FC6116BC-96DA-46EC-8021-67558E7B4607}.tmp not found!

Registry entries deleted on Reboot...

Chris4You · 01.08.2012, 06:25

Hi,

da hast Du Dir das Teil wohl selber auf den Rechner geholt:
mini-KMS_Activator_v1.052.exe (Riskware.Keygen).

Leider ist an dieser Stelle jetzt Schluß, da http://www.trojaner-board.de/95394-c...-software.html

Der Rechner sollte eingermaßen bereinigt sein...

chris

Rudolf1967 · 01.08.2012, 06:45

Servus Chris,

vielen Dank für Deine Mühe.

Werde jetzt doch mal die restliche Familie von meinem Computer verweisen.

Meinst Du ich kann mit diesem PC online meine Bankgeschäfte erledigen kann?

Kannst Du mir einen - ggf. gebührenpflichtigen, aber leistungsstarken -Virenschutz empfehlen? Avira AntiVir ist wohl nicht optimal.

Vielen Dank nochmals für Deine Hilfe und sonnige Grüße aus Bayern,

Rudolf

P.S: Bei Dir steht doch auch etwas von Spenden. Würde mich gerne via PayPal erkenntlich zeigen. Wie geht das?

Chris4You · 01.08.2012, 07:27

Hi,

momentan ist der Rechner wohl sauber, allerdings empfehlen wir nach so einer Infektion und in Verbindung mit Banking Neuaufsetzen...

Auf jeden Fall würde ich das Konto beobachten..

Für Spenden an das Board http://www.trojaner-board.de/payments.php ...

Ich pers. nutze KIS 2012...

Rechner absichern:
Zusätzlich zu Avira und der Windows-Firewall noch Threadfire-free Herunterladen Kostenlos).
Zum Surfen Firefox mit den PlugIns "WOT" (http://filepony.de/?q=WOT) und
"NoScript" (http://filepony.de/download-noscript//)) verwenden,
einen "Guest"-Account (keine Adminrechte! XP: (Schritt 6: Eingeschränkte Rechte für Viren - Schritt für Schritt: Windows XP absichern - CHIP Online,
Vista/Win7: Windows-7-Anleitung: Benutzerkonten anlegen und verwalten - NETZWELT) anlegen.

chris

Trojan.Banker

Plagegeister aller Art und deren Bekämpfung: Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Trojan.Banker

Ähnliche Themen: Trojan.Banker

01.08.2012, 06:25	#6
Chris4You	Trojan.Banker Hi, da hast Du Dir das Teil wohl selber auf den Rechner geholt: mini-KMS_Activator_v1.052.exe (Riskware.Keygen). Leider ist an dieser Stelle jetzt Schluß, da http://www.trojaner-board.de/95394-c...-software.html Der Rechner sollte eingermaßen bereinigt sein... chris __________________ --> Trojan.Banker