| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe mir den Polizei-Virus eingefangen, bitte um Hilfe beim BeseitigenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
16.08.2012, 22:23
| #1 |
| |  Habe mir den Polizei-Virus eingefangen, bitte um Hilfe beim Beseitigen Hallo zusammen, habe mir auch gestern den Polizei-Mist eingefangen und Bitte nun um eure Hilfe. Habe Malwarebytes durchlaufen lassen: Hier das Log ( Hoffe ist richtig gepostet) Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.16.10 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 testkonto :: MARTIN-PC [Administrator] Schutz: Aktiviert 16.08.2012 20:55:43 mbam-log-2012-08-16 (20-55-43).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 442159 Laufzeit: 1 Stunde(n), 42 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 D:\Martin\CryptLoad\router\FRITZ!Box\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter OTL logfile created on: 16.08.2012 23:07:34 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Users\testkonto\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 1,90 Gb Available Physical Memory | 58,54% Memory free 6,73 Gb Paging File | 5,34 Gb Available in Paging File | 79,38% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 229,49 Gb Total Space | 84,06 Gb Free Space | 36,63% Space Free | Partition Type: NTFS Drive D: | 236,27 Gb Total Space | 104,63 Gb Free Space | 44,29% Space Free | Partition Type: NTFS Drive H: | 931,51 Gb Total Space | 673,33 Gb Free Space | 72,28% Space Free | Partition Type: NTFS Computer Name: MARTIN-PC | User Name: testkonto | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.16 18:53:21 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\testkonto\Desktop\OTL.exe PRC - [2012.08.14 23:00:05 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe PRC - [2012.08.08 18:19:40 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.07.02 17:25:14 | 002,232,504 | ---- | M] (Giraffic) -- C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe PRC - [2012.07.02 17:24:54 | 003,790,504 | ---- | M] (Giraffic) -- C:\Program Files\Giraffic\Veoh_Giraffic.exe PRC - [2012.06.27 12:29:26 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2012.06.27 12:29:22 | 001,385,896 | ---- | M] (LogMeIn Inc.) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe PRC - [2012.05.08 21:57:16 | 000,086,992 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\ipmgui.exe PRC - [2012.05.08 21:57:16 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.08 21:57:15 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 21:57:15 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.04.21 03:16:21 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.04.07 22:43:20 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe PRC - [2011.04.07 22:43:04 | 000,841,832 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe PRC - [2011.04.07 21:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2010.09.16 22:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe PRC - [2009.07.27 11:13:28 | 000,061,440 | ---- | M] () -- C:\Windows\System32\ASDR.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.11 08:27:20 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe PRC - [2009.04.02 12:47:04 | 000,234,888 | ---- | M] () -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe PRC - [2009.04.02 12:47:02 | 000,464,264 | ---- | M] () -- C:\Program Files\AskBarDis\bar\bin\AskService.exe PRC - [2009.03.31 10:39:36 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe PRC - [2008.11.18 00:53:37 | 000,091,440 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe PRC - [2008.09.16 16:26:40 | 016,982,016 | R--- | M] (VIA) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe ========== Modules (No Company Name) ========== MOD - [2012.08.14 23:00:05 | 009,465,032 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_271.dll MOD - [2012.04.21 03:16:53 | 001,952,696 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2011.04.07 21:54:38 | 000,239,720 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll MOD - [2010.09.16 22:04:50 | 000,095,528 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2010.09.16 22:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe MOD - [2008.11.18 00:53:34 | 000,064,664 | ---- | M] () -- C:\Programme\Logitech\Desktop Messenger\8876480\8.1.1.87-8876480SL\Program\clntutil.dll MOD - [2008.09.16 21:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll MOD - [2008.05.30 04:38:22 | 000,069,632 | R--- | M] () -- C:\Program Files\VIA\VIAudioi\VDeck\Dts2ApoApi.dll MOD - [2008.03.17 11:50:00 | 000,069,632 | R--- | M] () -- C:\Program Files\VIA\VIAudioi\VDeck\QsApoApi.dll MOD - [2008.02.14 07:57:00 | 000,094,208 | R--- | M] () -- C:\Program Files\VIA\VIAudioi\VDeck\VMicApi.dll ========== Win32 Services (SafeList) ========== SRV - [2012.08.14 23:00:05 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.07.02 17:25:14 | 002,232,504 | ---- | M] (Giraffic) [Auto | Running] -- C:\Program Files\Giraffic\Veoh_GirafficWatchdog.exe -- (Giraffic) SRV - [2012.06.27 12:29:22 | 001,385,896 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.05.08 21:57:16 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.08 21:57:15 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.04.07 21:54:52 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2009.07.27 11:13:28 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Windows\System32\ASDR.exe -- (ASDR) SRV - [2009.04.02 12:47:04 | 000,234,888 | ---- | M] () [Auto | Running] -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe -- (ASKUpgrade) SRV - [2009.04.02 12:47:02 | 000,464,264 | ---- | M] () [Auto | Running] -- C:\Program Files\AskBarDis\bar\bin\AskService.exe -- (ASKService) SRV - [2009.03.31 10:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2008.04.07 10:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) ========== Driver Services (SafeList) ========== DRV - File not found [File_System | On_Demand | Stopped] -- -- (StarOpen) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\ATKDispLowFilter.sys -- (atkdisplf) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\asusgsb.sys -- (asusgsb) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (ancklnxi) DRV - [2012.08.16 23:07:58 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2012.08.16 23:00:09 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\sxppwthn.sys -- (dyccj) DRV - [2012.07.03 17:27:07 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2012.07.03 17:27:06 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.05.08 21:57:16 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.08 21:57:16 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.10.08 16:50:51 | 000,029,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Users\Martin\AppData\Local\Temp\jfdcd.sys -- (jfdcd) DRV - [2011.04.08 07:14:00 | 010,690,024 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2010.09.19 00:31:08 | 000,050,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm) DRV - [2010.08.12 14:15:20 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.04.03 13:12:06 | 000,014,336 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\EIO.sys -- (EIO) DRV - [2009.03.31 10:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009.03.20 11:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009.03.20 11:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) DRV - [2009.03.20 11:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2008.11.17 23:08:37 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2008.11.12 14:42:00 | 000,046,592 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\l160x86.sys -- (AtcL001) DRV - [2008.09.08 05:10:14 | 000,901,120 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2008.08.06 10:26:08 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008.03.29 17:36:28 | 000,125,328 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2007.09.17 16:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2007.09.04 19:08:24 | 000,286,208 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B) DRV - [2007.08.08 08:03:52 | 000,476,288 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA) DRV - [2007.08.08 08:03:52 | 000,038,656 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM) DRV - [2007.03.24 13:20:24 | 000,046,208 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID) DRV - [2007.02.17 18:37:34 | 000,088,448 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nwlnkipx.sys -- (NwlnkIpx) DRV - [2007.01.18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.10.18 23:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) DRV - [2006.02.07 21:52:58 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\JGOGO.sys -- (JGOGO) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.609: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.04.30 16:00:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.26 16:59:56 | 000,000,000 | ---D | M] [2012.08.16 18:45:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\testkonto\AppData\Roaming\mozilla\Extensions [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (PC-WELT-Edition) -- C:\Program Files\mozilla firefox\extensions\pcwelt-cck@extensions.pcwelt.de [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\pcwelt-cck@extensions.pcwelt.de\chrome [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\pcwelt-cck@extensions.pcwelt.de\components [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\pcwelt-cck@extensions.pcwelt.de\defaults [2008.11.16 23:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\pcwelt-cck@extensions.pcwelt.de\searchplugins [2008.03.15 15:56:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2008.10.13 20:34:40 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.05.30 15:56:28 | 000,002,048 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml [2008.02.19 16:40:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2006.12.03 17:59:22 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2006.11.17 13:19:24 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe Reader) - {147FEC3F-6DE9-437C-8FC1-6B8A20AA0A72} - C:\Users\Martin\AppData\Roaming\AdobeReader\IE\AdobeReader.dll (Adobe Systems, Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll (facemoods.com BHO) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll (facemoods.com) O4 - HKLM..\Run: [avgnt] C:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe (facemoods.com) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" File not found O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\nwprovau.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{68216D78-60A8-4267-86B9-3F8E4A4A2E9A}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79B34D9E-AE1B-477B-B246-06EDB1A683AD}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A372E941-4742-4319-BF50-481C30A071F0}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CA910583-221D-4B11-A7FC-2E988A5C1D05}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.07.14 11:21:52 | 000,000,000 | RH-D | M] - H:\autorun -- [ NTFS ] O32 - AutoRun File - [2002.10.16 19:56:50 | 000,000,036 | RH-- | M] () - H:\autorun.inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== File not found -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neue Funktion 1 [2012.08.16 23:07:58 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.08.16 20:01:36 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\TS3Client [2012.08.16 18:53:19 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\testkonto\Desktop\OTL.exe [2012.08.16 18:52:50 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Malwarebytes [2012.08.16 18:52:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.16 18:52:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.16 18:52:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.16 18:52:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.16 18:49:39 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\testkonto\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.16 18:47:54 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Avira [2012.08.16 18:47:17 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\Macromedia [2012.08.16 18:47:17 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Adobe [2012.08.16 18:45:11 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Mozilla [2012.08.16 18:45:11 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\Mozilla [2012.08.16 18:42:02 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\LogMeIn Hamachi [2012.08.16 18:42:00 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Real [2012.08.16 18:41:48 | 000,000,000 | R--D | C] -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.16 18:41:48 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Searches [2012.08.16 18:41:48 | 000,000,000 | R--D | C] -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.16 18:41:37 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Identities [2012.08.16 18:41:33 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Contacts [2012.08.16 18:41:30 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\VirtualStore [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Vorlagen [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\AppData\Local\Verlauf [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\AppData\Local\Temporary Internet Files [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Startmenü [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\SendTo [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Recent [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Netzwerkumgebung [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Lokale Einstellungen [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Documents\Eigene Videos [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Documents\Eigene Musik [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Eigene Dateien [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Documents\Eigene Bilder [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Druckumgebung [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Cookies [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\AppData\Local\Anwendungsdaten [2012.08.16 18:41:26 | 000,000,000 | -HSD | C] -- C:\Users\testkonto\Anwendungsdaten [2012.08.16 18:41:25 | 000,000,000 | --SD | C] -- C:\Users\testkonto\AppData\Roaming\Microsoft [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Videos [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Saved Games [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Pictures [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Music [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Links [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Favorites [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Downloads [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Documents [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\Desktop [2012.08.16 18:41:25 | 000,000,000 | R--D | C] -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.08.16 18:41:25 | 000,000,000 | -H-D | C] -- C:\Users\testkonto\AppData [2012.08.16 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\Temp [2012.08.16 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Local\Microsoft [2012.08.16 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Media Center Programs [2012.08.16 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\testkonto\AppData\Roaming\Macromedia [2012.07.22 17:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Beta [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.16 23:07:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.08.16 23:00:09 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\sxppwthn.sys [2012.08.16 23:00:09 | 000,000,130 | ---- | M] () -- C:\Windows\System32\cfkeik [2012.08.16 23:00:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.16 22:53:38 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.16 22:53:38 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.16 21:01:17 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.16 21:01:17 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.16 21:01:17 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.16 21:01:17 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.16 20:53:45 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.08.16 20:53:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.16 20:53:31 | 3486,593,024 | -HS- | M] () -- C:\hiberfil.sys [2012.08.16 18:54:45 | 000,618,227 | ---- | M] () -- C:\Users\testkonto\Desktop\adwcleaner.exe [2012.08.16 18:53:21 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\testkonto\Desktop\OTL.exe [2012.08.16 18:52:48 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.16 18:52:17 | 000,000,711 | ---- | M] () -- C:\Users\testkonto\Desktop\Download - Verknüpfung.lnk [2012.08.16 18:49:42 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\testkonto\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.16 18:27:12 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad [2012.08.15 18:02:15 | 000,000,671 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk [2012.08.14 23:00:05 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.08.14 23:00:05 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.08.05 01:31:32 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI [2012.07.22 17:29:58 | 000,000,922 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft Beta.lnk [2012.07.21 15:34:32 | 000,000,819 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.16 23:00:09 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\sxppwthn.sys [2012.08.16 23:00:09 | 000,000,130 | ---- | C] () -- C:\Windows\System32\cfkeik [2012.08.16 18:54:44 | 000,618,227 | ---- | C] () -- C:\Users\testkonto\Desktop\adwcleaner.exe [2012.08.16 18:52:48 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.16 18:52:17 | 000,000,711 | ---- | C] () -- C:\Users\testkonto\Desktop\Download - Verknüpfung.lnk [2012.08.16 18:41:49 | 000,000,949 | ---- | C] () -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.08.16 18:41:47 | 000,000,944 | ---- | C] () -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2012.08.16 18:41:32 | 000,000,915 | ---- | C] () -- C:\Users\testkonto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2012.08.16 18:40:59 | 3486,593,024 | -HS- | C] () -- C:\hiberfil.sys [2012.08.15 23:07:16 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad [2012.07.22 17:28:47 | 000,000,922 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft Beta.lnk [2012.07.21 15:34:32 | 000,000,819 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2012.07.03 17:27:07 | 000,271,360 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2012.07.03 17:27:06 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2012.05.29 17:05:47 | 000,013,312 | ---- | C] () -- C:\Windows\Installer\{a4bdeb4e-22b2-b2cc-e246-2b930e43eb30}\U\80000000.@ [2012.01.02 15:11:23 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat [2012.01.02 15:11:23 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat [2011.02.09 17:18:57 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{a4bdeb4e-22b2-b2cc-e246-2b930e43eb30}\@ [2011.02.09 17:18:57 | 000,002,048 | -HS- | C] () -- C:\Users\Martin\AppData\Local\{a4bdeb4e-22b2-b2cc-e246-2b930e43eb30}\@ [2010.09.08 20:11:20 | 000,000,346 | ---- | C] () -- C:\Windows\WinInit.Ini ========== Alternate Data Streams ========== @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > Vielen Dank im Voraus. |
| Themen zu Habe mir den Polizei-Virus eingefangen, bitte um Hilfe beim Beseitigen |
| administrator, adobe, antivir, autorun, avg, avira, bho, browser, explorer, firefox, flash player, format, google earth, helper, home, league of legends, logfile, mozilla, nvidia, object, plug-in, polizei, polizei-virus, realtek, registry, scan, software, spielen, temp, virus, vista |
Baum-Darstellung