Hallo,

Mein Virenprogramm (Antivir) hat mich heute plötzlich auf einige Malware aufmerksam gemacht! (Report im Anhang)

Und zwar auf einen Trojaner (TR/Spy.Banker.Gen5) und auf zwei andere Virenmeldungen (EXP/CVE-2012-1723.BU) und (JS/Dldr.Expack.BA.3).

Entsprechend habe ich mich bei google auf die Suche gemacht und bin auf dieses Forum gestoßen. Nach Recherche habe ich Posts zum Thema: "TR/Spy.Banker.Gen5" gefunden und habe entsprechend der Anweisung "Vorgehen beim Verschlüsselungs-Trojaner" auf dieser Homepage das Malewarebytes Anti-Maleware heruntergeladen und drüberlaufen lassen.(Reports im Anhang - einmal direkt nach dem Fund und einmal nach dem Entfernen der Maleware)

Mittelerweile wird nichts mehr gefunden, da ich jedoch in diesem Forum immer wieder gelesen habe, dass man nicht sicher sein kann, dass alles gekillt ist, hätte ich gerne von euch einen Check meiner Reports! (ich benutze Internetbanking und möchte Gewissheit, dass kein Trojaner spioniert!)

Ich habe mich an die Anweisungen zum Vorgehen beim ersten Thread gehalten und auch diese Programme laufen lassen:

- Defogger is durchgeführt!

- Extras (im Anhnag)

- OTL Logfile:

OTL logfile created on: 04.08.2012 14:39:17 - Run 2
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Yeahhh\Desktop\Trojaner Vernichten
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,61 Gb Total Physical Memory | 2,19 Gb Available Physical Memory | 60,75% Memory free
7,21 Gb Paging File | 5,30 Gb Available in Paging File | 73,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 100,00 Gb Total Space | 54,47 Gb Free Space | 54,47% Space Free | Partition Type: NTFS
Drive D: | 350,75 Gb Total Space | 303,90 Gb Free Space | 86,64% Space Free | Partition Type: NTFS

Computer Name: YEAHHH-PC | User Name: Yeahhh | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Yeahhh\Desktop\Trojaner Vernichten\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe (Microsoft Corporation.)
PRC - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe (Juniper Networks, Inc.)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\TNC Client Plugin\HostCheckerPluginHost.exe (Juniper Networks, Inc.)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\Endpoint Defense\dsEES.exe (Juniper Networks)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe (Juniper Networks, Inc.)
PRC - C:\Program Files (x86)\Common Files\Juniper Networks\WX Client\WXConnectionMethod.exe (Juniper Networks)
PRC - C:\Program Files (x86)\ASUS\USBChargeSetting\iSeriesCharge.exe (AsusTek Computer Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\ASUS\SHE\SuperHybridEngine.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\HotkeyService\HotKeyMon.exe (ASUSTeK Computer Inc.)
PRC - C:\Windows\SysWOW64\AsusService.exe ()
PRC - C:\Program Files (x86)\ASUS\HotkeyService\HotkeyService.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\Asus\LiveUpdate\LiveUpdate.exe (AsusTek Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\CapsHook\CapsHook.exe (ASUS)
PRC - C:\Program Files (x86)\syncables\syncables desktop\syncables.exe (syncables, LLC)
PRC - C:\Program Files (x86)\syncables\syncables desktop\jre\bin\javaw.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
PRC - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
PRC - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\CitaviPickerCommunication.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Acronis\TrueImageHome\fox.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe (Microsoft Corporation.)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BBSvc.exe (Microsoft Corporation.)
SRV - (JuniperAccessService) -- C:\Program Files (x86)\Common Files\Juniper Networks\JUNS\dsAccessService.exe (Juniper Networks, Inc.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AsusService) -- C:\Windows\SysWOW64\AsusService.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (AcrSch2Svc) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (jnprna) -- C:\Windows\SysNative\drivers\jnprna6.sys (Juniper Networks, Inc.)
DRV:64bit: - (JnprVaMgr) -- C:\Windows\SysNative\drivers\jnprvamgr.sys (Juniper Networks, Inc.)
DRV:64bit: - (jnprva) -- C:\Windows\SysNative\drivers\jnprva.sys (Juniper Networks, Inc.)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (tifsfilter) -- C:\Windows\SysNative\drivers\tifsfilt.sys (Acronis)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (tdrpman) -- C:\Windows\SysNative\drivers\tdrpman.sys (Acronis)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (dsNcAdpt) -- C:\Windows\SysNative\drivers\dsNcAdpt.sys (Juniper Networks)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc)
DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (AiDriver) -- C:\Windows\SysNative\drivers\AiDriver.sys (ASUSTek Computer Inc.)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data]
IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com [binary data]
IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.04.23 16:50:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.12 00:54:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Yeahhh\AppData\Roaming\12001.054 [2012.08.01 14:07:21 | 000,000,000 | ---D | M]

[2011.09.03 14:35:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yeahhh\AppData\Roaming\mozilla\Extensions
[2012.06.29 16:31:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Yeahhh\AppData\Roaming\mozilla\Firefox\Profiles\0p0y5ia5.default\extensions
[2012.06.18 15:24:02 | 000,003,915 | ---- | M] () -- C:\Users\Yeahhh\AppData\Roaming\Mozilla\Firefox\Profiles\0p0y5ia5.default\searchplugins\sweetim.xml
[2011.12.19 17:41:17 | 000,005,508 | ---- | M] () -- C:\Users\Yeahhh\AppData\Roaming\Mozilla\Firefox\Profiles\0p0y5ia5.default\searchplugins\webde-suche.xml
[2012.04.09 21:55:46 | 000,002,057 | ---- | M] () -- C:\Users\Yeahhh\AppData\Roaming\Mozilla\Firefox\Profiles\0p0y5ia5.default\searchplugins\youtube-videosuche.xml
[2012.05.12 00:54:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.01.05 16:32:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions
[2012.01.05 16:32:46 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions\toolbar@web.de
[2012.04.23 16:50:17 | 000,000,000 | ---D | M] (Citavi Picker) -- C:\PROGRAMDATA\SWISS ACADEMIC SOFTWARE\CITAVI PICKER\FIREFOX
[2012.08.01 14:07:21 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\YEAHHH\APPDATA\ROAMING\12001.054
[2012.05.12 00:54:47 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.15 22:44:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.15 22:44:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.15 22:44:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.15 22:44:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.15 22:44:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.15 22:44:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2012.07.12 08:13:34 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4:64bit: - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4:64bit: - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe (ASUSTek Computer Inc.)
O4:64bit: - HKLM..\Run: [LiveUpdate] C:\windows\SysNative\AsusSender.exe (ASUSTek Computer Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\VizorHtmlDialog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CapsHook] C:\windows\SysWow64\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyMon] C:\windows\SysWow64\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\SysWow64\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [iSeriesCharge] C:\windows\SysWow64\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [JunosPulse] C:\Program Files (x86)\Common Files\Juniper Networks\JamUI\Pulse.exe (Juniper Networks, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\SysWow64\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000..\Run: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe (syncables, LLC)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-1036447865-4054723026-1065884507-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.20.30.10 172.20.30.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35D74E14-107B-4E87-9B8C-432C1F195967}: Domain = uni-karlsruhe.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35D74E14-107B-4E87-9B8C-432C1F195967}: NameServer = 129.13.64.5 129.13.96.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{446164D0-26E6-444A-AEC7-10996F03483E}: DhcpNameServer = 172.20.30.10 172.20.30.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{51DF421E-3A94-4333-BBCE-9FFFCF048E17}: Domain = uni-karlsruhe.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{51DF421E-3A94-4333-BBCE-9FFFCF048E17}: NameServer = 129.13.64.5 129.13.96.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6DCEE70-AD69-48DF-83E6-458626BDD6DD}: Domain = uni-karlsruhe.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6DCEE70-AD69-48DF-83E6-458626BDD6DD}: NameServer = 129.13.64.5 129.13.96.2
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Aibelive\Voice Command\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30:64bit: - LSA: Authentication Packages - (relog_ap) - C:\windows\SysNative\relog_ap.dll (Acronis)
O30 - LSA: Authentication Packages - (relog_ap) - C:\windows\SysWow64\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.08.04 12:28:06 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\Desktop\Trojaner Vernichten
[2012.08.04 12:25:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.08.04 12:25:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2012.08.04 11:19:16 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\Malwarebytes
[2012.08.04 11:18:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.04 11:18:34 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.08.04 11:18:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.02 18:32:28 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\UAs
[2012.08.01 14:07:21 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\12001.054
[2012.07.31 10:40:48 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\12001.053
[2012.07.30 10:13:55 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\12001.052
[2012.07.30 10:13:33 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\xmldm
[2012.07.30 10:13:28 | 000,000,000 | ---D | C] -- C:\Users\Yeahhh\AppData\Roaming\kock
[2012.07.12 19:23:56 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\msxml3r.dll
[2012.07.12 19:23:56 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msxml3r.dll
[2012.07.12 19:10:16 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ncrypt.dll
[2012.07.12 19:09:54 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\cdosys.dll
[2012.07.12 19:09:50 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cdosys.dll
[2012.07.10 12:06:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.07.10 12:06:12 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSCOMCT2.OCX
[2012.07.10 12:06:12 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSMAPI32.OCX
[2012.07.10 12:06:12 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\windows\SysNative\pdfcmon.dll
[2012.07.10 12:06:10 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSCMCDE.DLL
[2012.07.10 12:06:10 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\VB6DE.DLL
[2012.07.10 12:06:09 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSCC2DE.DLL
[2012.07.10 12:06:09 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSMPIDE.DLL
[2012.07.10 12:06:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[1 C:\Users\Yeahhh\AppData\Roaming\*.tmp files -> C:\Users\Yeahhh\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.08.04 14:27:10 | 000,009,920 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 14:27:10 | 000,009,920 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 14:17:42 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.08.04 14:17:34 | 2903,814,144 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.04 12:19:45 | 000,000,168 | ---- | M] () -- C:\Users\Yeahhh\defogger_reenable
[2012.08.04 11:18:42 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.04 10:15:34 | 000,000,017 | ---- | M] () -- C:\Users\Yeahhh\AppData\Roaming\blckdom.res
[2012.08.01 09:57:43 | 001,498,742 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.08.01 09:57:43 | 000,654,400 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.08.01 09:57:43 | 000,616,242 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.08.01 09:57:43 | 000,130,240 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.08.01 09:57:43 | 000,106,622 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.07.13 20:57:02 | 000,305,344 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.07.10 12:06:18 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[1 C:\Users\Yeahhh\AppData\Roaming\*.tmp files -> C:\Users\Yeahhh\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.08.04 12:19:45 | 000,000,168 | ---- | C] () -- C:\Users\Yeahhh\defogger_reenable
[2012.08.04 11:18:42 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.30 10:13:44 | 000,000,017 | ---- | C] () -- C:\Users\Yeahhh\AppData\Roaming\blckdom.res
[2012.07.10 12:06:18 | 000,001,035 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk
[2012.03.26 15:17:36 | 000,103,082 | ---- | C] () -- C:\Program Files (x86)\winrar.lng
[2012.03.26 15:17:36 | 000,008,028 | ---- | C] () -- C:\Program Files (x86)\uninstall.lng
[2012.03.26 15:17:36 | 000,003,584 | ---- | C] () -- C:\Program Files (x86)\rarext.lng
[2012.03.26 15:17:35 | 001,219,072 | ---- | C] () -- C:\Program Files (x86)\WinRAR.exe
[2012.03.26 15:17:35 | 000,323,129 | ---- | C] () -- C:\Program Files (x86)\WinRAR.chm
[2012.03.26 15:17:35 | 000,282,624 | ---- | C] () -- C:\Program Files (x86)\UnRAR.exe
[2012.03.26 15:17:35 | 000,193,536 | ---- | C] () -- C:\Program Files (x86)\RarExt.dll
[2012.03.26 15:17:35 | 000,166,912 | ---- | C] () -- C:\Program Files (x86)\RarExt32.dll
[2012.03.26 15:17:35 | 000,136,960 | ---- | C] () -- C:\Program Files (x86)\Default64.SFX
[2012.03.26 15:17:35 | 000,135,168 | ---- | C] () -- C:\Program Files (x86)\Uninstall.exe
[2012.03.26 15:17:35 | 000,107,776 | ---- | C] () -- C:\Program Files (x86)\Zip64.SFX
[2012.03.26 15:17:35 | 000,103,888 | ---- | C] () -- C:\Program Files (x86)\WinCon64.SFX
[2012.03.26 15:17:35 | 000,100,864 | ---- | C] () -- C:\Program Files (x86)\Default.SFX
[2012.03.26 15:17:35 | 000,080,896 | ---- | C] () -- C:\Program Files (x86)\Zip.SFX
[2012.03.26 15:17:35 | 000,074,752 | ---- | C] () -- C:\Program Files (x86)\WinCon.SFX
[2012.03.26 15:17:35 | 000,038,386 | ---- | C] () -- C:\Program Files (x86)\rar.lng
[2012.03.26 15:17:34 | 000,424,448 | ---- | C] () -- C:\Program Files (x86)\Rar.exe
[2012.03.26 15:17:34 | 000,003,973 | ---- | C] () -- C:\Program Files (x86)\Order.htm
[2012.03.26 15:17:34 | 000,001,420 | ---- | C] () -- C:\Program Files (x86)\Descript.ion
[2012.03.26 15:17:34 | 000,001,400 | ---- | C] () -- C:\Program Files (x86)\RarFiles.lst
[2012.03.26 15:17:34 | 000,000,686 | ---- | C] () -- C:\Program Files (x86)\Uninstall.lst
[2012.03.26 15:17:34 | 000,000,616 | ---- | C] () -- C:\Program Files (x86)\File_Id.diz
[2011.09.03 00:36:27 | 000,005,576 | ---- | C] () -- C:\windows\Language.ini
[2011.02.10 17:39:23 | 000,224,680 | ---- | C] () -- C:\windows\SysWow64\AsusService.exe
[2011.02.10 17:39:23 | 000,025,616 | ---- | C] () -- C:\windows\AsAcpiSvrLang.ini
[2011.02.10 17:37:39 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2011.02.10 17:36:06 | 000,014,464 | ---- | C] () -- C:\windows\SysWow64\drivers\AsUpIO.sys
[2011.02.10 17:36:05 | 000,013,440 | ---- | C] () -- C:\windows\SysWow64\drivers\AsIO.sys
[2011.02.10 17:35:27 | 000,000,405 | ---- | C] () -- C:\windows\Reboot.ini
[2011.02.10 17:34:23 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2011.02.10 17:32:23 | 000,014,051 | ---- | C] () -- C:\windows\SysWow64\RaCoInst.dat
[2011.01.26 04:25:23 | 000,002,888 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat

========== LOP Check ==========

[2011.02.10 21:35:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\ASUS WebStorage
[2011.02.10 21:24:16 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\E-Cam
[2011.02.10 21:35:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\ASUS WebStorage
[2011.02.10 21:24:16 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\E-Cam
[2012.07.30 10:13:56 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\12001.052
[2012.07.31 10:40:49 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\12001.053
[2012.08.01 14:07:21 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\12001.054
[2011.10.19 10:25:22 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\ASUS WebStorage
[2011.09.03 15:13:35 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\DAEMON Tools Lite
[2012.07.31 13:57:45 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\Dropbox
[2011.02.10 21:24:16 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\E-Cam
[2012.06.18 15:25:55 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\ICQ
[2012.04.23 16:20:27 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\Juniper Networks
[2012.07.30 10:13:28 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\kock
[2012.07.10 12:06:18 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\pdfforge
[2012.06.05 14:43:03 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\Swiss Academic Software
[2012.08.02 18:34:52 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\UAs
[2011.09.03 00:46:44 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\VoiceCommand
[2011.09.07 17:13:31 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\Windows Live Writer
[2012.08.02 18:35:38 | 000,000,000 | ---D | M] -- C:\Users\Yeahhh\AppData\Roaming\xmldm
[2012.07.06 12:37:08 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:AB689DEA

< End of report >





Schonmal vielen Dank im Voraus!!!


Grüße
MeisterProp

hi,
1.
für eine weitere analyse benötige ich mal folgendes.
c:\Users\name\AppData\LocalLow\Sun\Java\Deployment\cache
dort rechtsklick auf den ordner cache, diesen mit winrar oder einem anderen programm packen, und im upload channel hochladen bitte
Trojaner-Board Upload Channel
wenn dies erledigt ist, bittemelden.

2. nutzt du den pc für onlinebanking, zum einkaufen, für sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie berufliches?

Hallo Markus,

Danke für die Hilfe! Die Cache Datei ist hochgeladen. Ich befürchte nur, es wird dir nichts mehr nützen. Das erste, was ich nämlich nach meiner Virenmeldung getan habe bevor ich dieses Forum gefunden habe, war meine Temporary Online Files zu löschen...

Und ja! Ich habe onlinebanking genutzt, deshalb möchte ich ja sicher sein, dass alles trojanische nun fort ist. So lange bis ich mir da sicher bin, nutze ich es nicht mehr...

Grüße

ok, morgen bank anrufen, onlinebanking sperren lassen.
da du onlinebanking machst, müssen wir sicher gehen:
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:

• deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
• dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
  Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

• nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
• recovery cd oder recovery partition.
• falls dies ein fertig pc ist, nenne hersteller + typ.
• Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.