![]() |
|
Plagegeister aller Art und deren Bekämpfung: Win7 64 bit – Bundespolizei TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() | ![]() Win7 64 bit – Bundespolizei Trojaner Hallo zusammen, auch mich hat es erwischt ![]() Danke schon mal im Voraus. OTL logfile Code:
ATTFilter OTL logfile created on: 8/11/2012 8:11:36 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE 64bit-Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): c:\pagefile.sys 0 0f:\pagefile.sys 0 0 [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86) Drive C: | 88.55 Gb Total Space | 88.45 Gb Free Space | 99.88% Space Free | Partition Type: NTFS Drive D: | 229.57 Gb Total Space | 9.98 Gb Free Space | 4.35% Space Free | Partition Type: NTFS Drive E: | 145.20 Gb Total Space | 145.11 Gb Free Space | 99.94% Space Free | Partition Type: NTFS Drive F: | 701.94 Gb Total Space | 104.85 Gb Free Space | 14.94% Space Free | Partition Type: NTFS Drive G: | 488.84 Mb Total Space | 216.72 Mb Free Space | 44.33% Space Free | Partition Type: FAT Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV:64bit: - (TurboBoost) Intel(R) -- D:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV:64bit: - (MSCamSvc) -- D:\Program Files\Microsoft LifeCam\MSCamS64.exe (Microsoft Corporation) SRV:64bit: - (nHancer) -- D:\Program Files\nHancer\nHancerService.exe (KSE - Korndörfer Software Engineering) SRV:64bit: - (IGDCTRL) -- D:\Program Files\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin) SRV:64bit: - (AppMgmt) -- D:\Windows\System32\appmgmts.dll (Microsoft Corporation) SRV - (Steam Client Service) -- D:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (MozillaMaintenance) -- D:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeARMservice) -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (KMService) -- D:\Windows\SysWOW64\srvany.exe () SRV - (PnkBstrA) -- D:\Windows\SysWOW64\PnkBstrA.exe () SRV - (NAUpdate) @C:\Program Files (x86) -- D:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (NIS) -- D:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation) SRV - (nlsX86cc) -- D:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.) SRV - (Stereo Service) -- D:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AVM WLAN Connection Service) -- D:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin) SRV - (AsSysCtrlService) -- D:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe () SRV - (clr_optimization_v4.0.30319_32) -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (SwitchBoard) -- D:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (BCUService) -- D:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (DeviceVM, Inc.) SRV - (clr_optimization_v2.0.50727_32) -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (SymEvent) -- D:\Windows\System32\drivers\SYMEVENT64x86.SYS (Symantec Corporation) DRV:64bit: - (hamachi) -- D:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (USBAAPL64) -- D:\Windows\System32\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (SRTSP) -- D:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS (Symantec Corporation) DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- D:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS (Symantec Corporation) DRV:64bit: - (SymNetS) -- D:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS (Symantec Corporation) DRV:64bit: - (SymEFA) -- D:\Windows\System32\drivers\NISx64\1206000.01D\symefa64.sys (Symantec Corporation) DRV:64bit: - (SymDS) -- D:\Windows\System32\drivers\NISx64\1206000.01D\symds64.sys (Symantec Corporation) DRV:64bit: - (SymIRON) -- D:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS (Symantec Corporation) DRV:64bit: - (TurboB) -- D:\Windows\System32\drivers\TurboB.sys (Intel(R) Corporation) DRV:64bit: - (TsUsbFlt) -- D:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (FWLANUSB) -- D:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) DRV:64bit: - (fwlanusb4) -- D:\Windows\System32\drivers\fwlanusb4.sys (AVM GmbH) DRV:64bit: - (avmeject) -- D:\Windows\System32\drivers\avmeject.sys (AVM Berlin) DRV:64bit: - (VX6000) -- D:\Windows\System32\drivers\VX6000Xp.sys (Microsoft Corporation ) DRV:64bit: - (JRAID) -- D:\Windows\System32\drivers\jraid.sys (JMicron Technology Corp.) DRV:64bit: - (VIAHdAudAddService) -- D:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.) DRV:64bit: - (MTsensor) -- D:\Windows\System32\drivers\ASACPI.sys () DRV:64bit: - (Ntfs) -- D:\Windows\System32\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- D:\Windows\system32\DRIVERS\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- D:\Windows\system32\DRIVERS\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- D:\Windows\System32\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (RTL8167) -- D:\Windows\System32\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (ATITool) -- D:\Windows\System32\drivers\ATITool64.sys () DRV - (NAVEX15) -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20111006.032\ex64.sys (Symantec Corporation) DRV - (eeCtrl) -- D:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- D:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (NAVENG) -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20111006.032\eng64.sys (Symantec Corporation) DRV - (IDSVia64) -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20111006.030\IDSviA64.sys (Symantec Corporation) DRV - (BHDrvx64) -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110929.001\BHDrvx64.sys (Symantec Corporation) DRV - (GEARAspiWDM) -- D:\Windows\SysWOW64\drivers\GEARAspiWDM.sys (GEAR Software Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Michal_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://badoo.com/startpage/ IE - HKU\Michal_ON_D\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - D:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.) IE - HKU\Michal_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Michal_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0 FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6 FF - prefs.js..extensions.enabledItems: {df4e4df5-5cb7-46b0-9aef-6c784c3249f8}:1.2.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..keyword.URL: "hxxp://badoo.com/startpage/?source=bsb&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_3_300_270.dll () FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: D:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: D:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011/10/08 04:02:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2011/10/07 14:53:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/08 13:43:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/09 04:57:07 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/08/08 13:43:27 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/09 04:57:07 | 000,000,000 | ---D | M] [2011/08/11 03:42:07 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Michal\AppData\Roaming\Mozilla\Extensions [2011/08/11 03:42:07 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Michal\AppData\Roaming\Mozilla\Extensions\songbird@songbirdnest.com [2012/07/06 16:02:08 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\86t6vlmv.default\extensions [2011/02/25 06:52:32 | 000,000,000 | ---D | M] (Fox!Box) -- D:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\86t6vlmv.default\extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8} [2012/05/18 10:30:30 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- D:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\86t6vlmv.default\extensions\ich@maltegoetz.de [2011/07/19 10:03:28 | 000,002,023 | ---- | M] () -- D:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\86t6vlmv.default\searchplugins\badoo.xml [2012/03/18 05:36:54 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files (x86)\Mozilla Firefox\extensions File not found (No name found) -- [2012/08/08 13:43:27 | 000,136,672 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/03/03 20:31:56 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011/12/09 13:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012/06/19 18:11:19 | 000,001,392 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/06/19 18:11:19 | 000,002,252 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/06/19 18:11:19 | 000,001,153 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012/06/19 18:11:19 | 000,006,805 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012/06/19 18:11:19 | 000,001,178 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012/06/19 18:11:19 | 000,001,105 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011/10/12 05:13:35 | 000,001,151 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 www.mynortonaccount.com.gtm.symantec.com O1 - Hosts: 127.0.0.1 gosredirector.ea.com O1 - Hosts: 127.0.0.1 blazeserver.blazeemu.org O1 - Hosts: 127.0.0.1 gosgvaprod-qos01.ea.com O1 - Hosts: 127.0.0.1 gosiadprod-qos01.ea.com O1 - Hosts: 127.0.0.1 gossjcprod-qos01.ea.com O1 - Hosts: 127.0.0.1 demangler.ea.com O1 - Hosts: 127.0.0.1 vmp.tools.gos.ea.com O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - D:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - D:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation) O3 - HKU\Michal_ON_D\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] D:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [VX6000] D:\Windows\vVX6000.exe (Microsoft Corporation ) O4 - HKLM..\Run: [ACPW05EN] D:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [AdobeCS5ServiceManager] D:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] D:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVMWlanClient] D:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) O4 - HKLM..\Run: [BCU] D:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.) O4 - HKLM..\Run: [HDAudDeck] D:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [JMB36X IDE Setup] D:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [LifeCam] D:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [QFan Help] D:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [SwitchBoard] D:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [T Probe] D:\Program Files (x86)\ASUS\T Probe\TProbe.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [TurboV EVO] D:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [WinampAgent] D:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\Michal_ON_D..\Run: [AdobeBridge] File not found O4 - HKU\Michal_ON_D..\Run: [enajjtxutwhygui] D:\ProgramData\enajjtxu.exe () O4 - HKU\Michal_ON_D..\Run: [Steam] D:\Program Files (x86)\Steam\steam.exe (Valve Corporation) O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found O4 - Startup: D:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found O13:64bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/03/06 17:40:01 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{46d69c7e-7b05-11e1-8aab-bcaec50e1b3e}\Shell - "" = AutoRun O33 - MountPoints2\{46d69c7e-7b05-11e1-8aab-bcaec50e1b3e}\Shell\AutoRun\command - "" = D:\pushinst.exe O33 - MountPoints2\{847d3c2e-3fe4-11e0-820e-bcaec50e1b3e}\Shell - "" = AutoRun O33 - MountPoints2\{847d3c2e-3fe4-11e0-820e-bcaec50e1b3e}\Shell\AutoRun\command - "" = H:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/08/10 17:18:25 | 000,000,000 | ---D | C] -- D:\Users\Michal\AppData\Local\{8389D2EE-190D-49B9-97F7-DBAB5755ECB0} [2012/08/10 17:18:14 | 000,000,000 | ---D | C] -- D:\Users\Michal\AppData\Local\{F1D4473B-310F-47D5-976F-093D0B6BC2C8} [2012/08/10 16:15:19 | 000,000,000 | ---D | C] -- D:\Kaspersky Rescue Disk 10.0 [2012/08/10 12:00:57 | 000,000,000 | ---D | C] -- D:\ProgramData\hamprcfcthmzpmt [2012/08/03 11:38:02 | 000,000,000 | -HSD | C] -- D:\Windows\SysWow64\%APPDATA% [2 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ] [2 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/08/11 08:18:21 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat [2012/08/11 08:16:30 | 3219,693,568 | -HS- | M] () -- D:\hiberfil.sys [2012/08/10 17:19:35 | 000,013,248 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/08/10 17:19:35 | 000,013,248 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/08/10 12:00:58 | 000,000,051 | ---- | M] () -- D:\ProgramData\gucwkhdhvylmmzh [2012/08/10 12:00:52 | 000,057,344 | ---- | M] () -- D:\ProgramData\enajjtxu.exe [2012/08/04 07:01:57 | 000,707,822 | ---- | M] () -- D:\Windows\System32\perfh007.dat [2012/08/04 07:01:57 | 000,661,418 | ---- | M] () -- D:\Windows\System32\perfh009.dat [2012/08/04 07:01:57 | 000,153,308 | ---- | M] () -- D:\Windows\System32\perfc007.dat [2012/08/04 07:01:57 | 000,125,504 | ---- | M] () -- D:\Windows\System32\perfc009.dat [2012/08/03 12:34:04 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe [2012/08/03 12:34:04 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012/07/31 08:07:41 | 004,999,424 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT [2 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ] [2 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/08/10 12:00:58 | 000,057,344 | ---- | C] () -- D:\ProgramData\enajjtxu.exe [2012/08/10 12:00:53 | 000,000,051 | ---- | C] () -- D:\ProgramData\gucwkhdhvylmmzh [2012/06/12 05:59:05 | 000,001,456 | ---- | C] () -- D:\Users\Michal\AppData\Local\Adobe Save for Web 12.0 Prefs [2012/03/31 18:26:08 | 000,010,752 | ---- | C] () -- D:\Windows\SysWow64\BASSMOD.dll [2011/12/16 14:58:30 | 000,000,003 | ---- | C] () -- D:\Users\Michal\AppData\Roaming\.ptbt0 [2011/12/08 11:57:39 | 000,151,552 | ---- | C] () -- D:\Windows\KMService.exe [2011/12/08 11:57:39 | 000,008,192 | ---- | C] () -- D:\Windows\SysWow64\srvany.exe [2011/12/07 11:42:44 | 000,189,248 | ---- | C] () -- D:\Windows\SysWow64\PnkBstrB.exe [2011/12/07 11:42:41 | 000,075,136 | ---- | C] () -- D:\Windows\SysWow64\PnkBstrA.exe [2011/10/14 19:54:52 | 000,321,856 | ---- | C] () -- D:\Windows\SysWow64\nvStreaming.exe [2011/04/09 12:55:28 | 000,179,261 | ---- | C] () -- D:\Windows\SysWow64\xlive.dll.cat [2011/03/01 14:19:32 | 000,252,928 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll [2011/02/25 17:10:13 | 000,007,610 | ---- | C] () -- D:\Users\Michal\AppData\Local\Resmon.ResmonCfg [2011/02/25 09:20:22 | 000,000,061 | -HS- | C] () -- D:\Windows\cnerolf.dat [2011/02/25 07:56:16 | 000,000,094 | ---- | C] () -- D:\Users\Michal\AppData\Local\fusioncache.dat [2011/02/25 07:23:40 | 001,620,984 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI [2011/02/25 06:34:06 | 000,003,584 | ---- | C] () -- D:\Users\Michal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011/02/25 06:26:12 | 000,011,832 | ---- | C] () -- D:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011/02/25 06:26:12 | 000,010,216 | ---- | C] () -- D:\Windows\SysWow64\drivers\AsInsHelp32.sys [2011/02/24 18:12:14 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat [2011/02/24 06:33:58 | 000,024,576 | R--- | C] () -- D:\Windows\SysWow64\AsIO.dll [2011/02/24 06:33:58 | 000,013,440 | R--- | C] () -- D:\Windows\SysWow64\drivers\AsIO.sys [2011/02/24 06:28:43 | 000,035,835 | ---- | C] () -- D:\Windows\Ascd_log.ini [2011/02/24 06:23:22 | 000,001,769 | ---- | C] () -- D:\Windows\Language_trs.ini [2011/02/24 06:23:20 | 000,029,079 | ---- | C] () -- D:\Windows\Ascd_tmp.ini [2011/02/21 17:17:34 | 000,316,928 | ---- | C] () -- D:\Windows\SysWow64\SilverEfexPro2FC32.dll [2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat [2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT [2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat [2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin [2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll [2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll [2009/07/05 22:48:34 | 000,013,368 | R--- | C] () -- D:\Windows\SysWow64\drivers\AsUpIO.sys [2009/06/26 12:24:18 | 000,015,497 | ---- | C] () -- D:\Windows\VX6KStd.ini [2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat [2009/04/02 08:30:14 | 000,010,296 | ---- | C] () -- D:\Windows\SysWow64\drivers\ASUSHWIO.SYS ========== LOP Check ========== [2012/06/13 04:56:31 | 000,000,000 | ---D | M] -- D:\ProgramData\ACD Systems [2011/05/15 14:10:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Age of Empires 3 [2011/02/23 20:20:02 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data [2011/03/19 09:12:50 | 000,000,000 | ---D | M] -- D:\ProgramData\ashampoo [2011/02/24 06:44:18 | 000,000,000 | ---D | M] -- D:\ProgramData\ASUS OC Profiles [2011/06/10 13:27:12 | 000,000,000 | ---D | M] -- D:\ProgramData\Badoo [2012/01/13 13:19:45 | 000,000,000 | ---D | M] -- D:\ProgramData\Caphyon [2011/02/26 08:11:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Codemasters [2011/02/26 07:53:33 | 000,000,000 | ---D | M] -- D:\ProgramData\DAEMON Tools Pro [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents [2011/02/23 20:20:02 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente [2011/04/24 09:28:50 | 000,000,000 | -HSD | M] -- D:\ProgramData\DSS [2011/12/09 12:05:32 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core [2011/12/09 12:21:49 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Logs [2011/12/09 12:05:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts [2011/02/24 06:48:04 | 000,000,000 | ---D | M] -- D:\ProgramData\EPU [2011/02/23 20:20:02 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites [2011/03/03 10:35:22 | 000,000,000 | ---D | M] -- D:\ProgramData\Futuremark [2011/02/24 10:11:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Gadu-Gadu 10 [2012/08/10 12:00:57 | 000,000,000 | ---D | M] -- D:\ProgramData\hamprcfcthmzpmt [2011/12/20 09:21:27 | 000,000,000 | ---D | M] -- D:\ProgramData\KONAMI [2012/01/13 13:19:35 | 000,000,000 | ---D | M] -- D:\ProgramData\nHancer [2012/04/22 09:41:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Nik Software [2011/12/09 12:11:54 | 000,000,000 | ---D | M] -- D:\ProgramData\Origin [2012/06/06 05:55:24 | 000,000,000 | ---D | M] -- D:\ProgramData\PassMark [2011/03/02 16:15:54 | 000,000,000 | ---D | M] -- D:\ProgramData\regid.1986-12.com.adobe [2012/02/09 12:19:01 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu [2011/02/23 20:20:02 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates [2011/12/07 11:45:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Ubisoft [2011/10/31 11:09:49 | 000,000,000 | ---D | M] -- D:\ProgramData\Uniblue [2011/02/23 20:20:02 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen [2011/03/15 12:31:44 | 000,000,000 | ---D | M] -- D:\ProgramData\WinZip [2011/03/30 14:13:50 | 000,000,000 | ---D | M] -- D:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} [2012/04/03 17:00:35 | 000,032,640 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
Themen zu Win7 64 bit – Bundespolizei Trojaner |
abgesicherter modus funktioniert nicht, asus, autorun, bho, bonjour, browser, dsl, error, explorer, firefox, format, google, helper, kaspersky, logfile, microsoft, nvidia, plug-in, realtek, registry, scan, security, software, stick, symantec, trojaner, vdeck.exe, win7 64, win7 64 bit, wlan |