Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Cyber Crime Investigation Department Trojaner

Cyber Crime Investigation Department Trojaner


Log-Analyse und Auswertung: Cyber Crime Investigation Department Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 27.08.2012, 22:09   #1
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Guten Abend liebe Community,

ich habe mich dummerweise letzte Woche mit dem Cyber Crime Investigation Department Trojaner infiziert, wie wohl mehrere andere User hier auch.

In meiner Panik habe ich letzten Donnerstag erst einmal Malewarebytes Anti-Maleware scannen lassen und das Programm hat auch gleich 4 Trojaner gefunden. (Ich habe auch noch Google Talk Plugin gelöscht, weil es laut CCleaner an dem Tag installiert wurde, ohne dass ich das gemacht hätte.)

Heute habe ich mir dann die Empfehlungen des Trojaner Boards durchgelesen und gelernt, dass keine Funde nicht gleich sauberer Computer bedeutet. Dann habe ich noch einmal Anti-Maleware durchlaufen lassen (ohne Funde) und dann mit OTL gescannt.

Ich wäre euch für jeglich Hilfe sehr dankbar,
Dumberer

Zitat:
OTL logfile created on: 27.08.2012 22:54:46 - Run 2
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\***\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 1,56 Gb Available Physical Memory | 52,05% Memory free
6,00 Gb Paging File | 4,72 Gb Available in Paging File | 78,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 27,50 Gb Free Space | 18,45% Space Free | Partition Type: NTFS
Drive D: | 139,28 Gb Total Space | 34,42 Gb Free Space | 24,72% Space Free | Partition Type: NTFS

Computer Name: NOTENBUCH | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation)
PRC - C:\Programme\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe ()
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\ASUS\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Programme\Schomaecker\XPrint-Client\XPrint-Client-GUI\XPrint-Client-GUI.exe (Schomäcker GmbH)
PRC - C:\Programme\Schomaecker\XPrint-Client\XPrint-Client-Service\XPrint-Client-Service.exe (Schomäcker GmbH)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\TouchFreeze\TouchFreeze.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Users\***\AppData\Local\Temp\99cab429-f99d-4f69-9d04-113ad532bd0f\CliSecureRT.dll ()
MOD - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Programme\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XAWT6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XXML6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XKRN6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XXXL6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XMIS6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XMNG6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XSEC6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XSWN6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XSQL6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XSSE6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XSND6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XPKC6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XJCE6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\jetrt\XRMI6407.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\bin\java.dll ()
MOD - C:\Programme\Schomaecker\XPrint-Client\Common\rt\bin\jetvm\jvm.dll ()
MOD - C:\Programme\TouchFreeze\TouchFreeze.exe ()
MOD - C:\Programme\TouchFreeze\TouchFreeze.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (NMSAccess) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (XPrint-Client-Service) -- C:\Programme\Schomaecker\XPrint-Client\XPrint-Client-Service\XPrint-Client-Service.exe (Schomäcker GmbH)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)


========== Driver Services (SafeList) ==========

DRV - (dgderdrv) -- System32\drivers\dgderdrv.sys File not found
DRV - (azg221i0) -- File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (taphss) -- C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (acsock) -- C:\Windows\System32\drivers\acsock.sys (Cisco Systems, Inc.)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssadmdm) -- C:\Windows\System32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) -- C:\Windows\System32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadserd) -- C:\Windows\System32\drivers\ssadserd.sys (MCCI Corporation)
DRV - (ssadmdfl) -- C:\Windows\System32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (androidusb) -- C:\Windows\System32\drivers\ssadadb.sys (Google Inc)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (NETw5s32) -- C:\Windows\System32\drivers\NETw5s32.sys (Intel Corporation)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (netw5v32) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ASUS)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (AmdLLD) -- C:\Windows\System32\drivers\AmdLLD.sys (AMD, Inc.)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (sfvfs02) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (sfdrv01) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfhlp02) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=8.0.0.34&sap=hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 84 9D BF A8 BB 0F CB 01 [binary data]
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=8.0.0.34&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}: "URL" = hxxp://search.hotspotshield.com/g/results.php?c=s&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.23 16:11:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.19 13:41:26 | 000,000,000 | ---D | M]

[2010.01.16 16:44:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.05.03 23:42:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\rsrc38vt.default\extensions
[2012.04.01 23:46:10 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\rsrc38vt.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.12.21 23:29:31 | 000,002,342 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\rsrc38vt.default\searchplugins\icq-search.xml
[2011.01.10 00:20:39 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\rsrc38vt.default\searchplugins\icqplugin.xml
[2012.06.14 14:50:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.07.23 16:11:40 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.09 10:35:41 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.07.23 16:11:38 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 18:37:45 | 000,003,768 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.07.23 16:11:38 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.23 16:11:38 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.23 16:11:38 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.23 16:11:38 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.23 16:11:38 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2012.06.20 13:04:15 | 000,429,963 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 nwmaster.bioware.com
O1 - Hosts: 127.0.0.1 nwnauth.kr.infogrames.com
O1 - Hosts: 0.0.0.0 nw2master.bioware.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 14801 more lines...
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATKOSD2] C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HControlUser] C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Philips Device Listener] C:\Program Files\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe ()
O4 - HKCU..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [TouchFreeze] C:\Programme\TouchFreeze\TouchFreeze.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} vpnweb.cab (Cisco AnyConnect Secure Mobility Client Web Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{82FC7010-B5B2-441D-B22B-F973A004FD28}: NameServer = 141.30.66.135
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1FA74BF-B063-4815-AD92-3328A2C03665}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.08.24 01:33:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.08.24 01:32:55 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.24 01:32:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.24 01:32:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.24 01:32:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.24 01:23:07 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.02 11:10:55 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\MAXQDA10Reader
[2012.08.02 11:10:55 | 000,000,000 | ---D | C] -- C:\ProgramData\MAXQDA10Reader
[2012.08.02 11:10:44 | 000,000,000 | ---D | C] -- C:\Program Files\MAXQDA10Reader
[2012.08.02 08:23:07 | 000,027,248 | ---- | C] (Connectify) -- C:\Windows\System32\drivers\cnnctfy2.sys
[2010.01.17 15:40:33 | 009,311,688 | ---- | C] (Foxit Software) -- C:\Program Files\Foxit Reader.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\*.tmp files -> C:\Users\***\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.08.27 22:33:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.27 22:16:15 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.27 22:06:00 | 000,001,148 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-464287513-3956234789-2982991868-1004UA.job
[2012.08.27 17:50:22 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.08.27 17:49:17 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.27 17:44:50 | 000,013,792 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 17:44:50 | 000,013,792 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.27 17:37:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.27 17:37:18 | 2415,218,688 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.26 23:34:48 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2012.08.26 23:29:33 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.26 23:29:33 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.26 23:29:33 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.26 23:29:33 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.24 01:16:24 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.24 00:49:08 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.08.21 23:35:04 | 000,521,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.07 16:06:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-464287513-3956234789-2982991868-1004Core.job
[2012.08.02 08:23:07 | 000,027,248 | ---- | M] (Connectify) -- C:\Windows\System32\drivers\cnnctfy2.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\*.tmp files -> C:\Users\***\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.08.27 17:50:22 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.08.27 00:09:16 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2012.08.24 00:43:11 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.06.08 15:27:44 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2012.05.29 13:56:59 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2012.05.29 13:54:41 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2012.02.16 14:22:14 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2012.02.16 14:22:14 | 000,042,112 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2011.12.31 13:46:49 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2011.11.30 22:16:28 | 000,006,144 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.09.19 11:54:03 | 000,007,610 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.06.10 16:26:18 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.06.10 07:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2011.03.10 05:00:39 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.01.04 22:10:56 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.01.04 22:10:56 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.01.04 22:10:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.01.04 22:10:56 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011.01.04 17:10:58 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2010.12.11 19:10:42 | 000,017,408 | ---- | C] () -- C:\Users\***\AppData\Local\WebpageIcons.db
[2010.11.16 05:22:00 | 000,003,975 | ---- | C] () -- C:\Users\***\AppData\Local\springsettings.cfg
[2010.10.24 23:57:54 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.10.24 23:57:54 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.10.03 22:30:05 | 001,766,592 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2010.10.03 22:30:05 | 000,035,264 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2010.09.02 21:01:21 | 000,000,464 | ---- | C] () -- C:\Users\***\AppData\Roaming\AutoGK.ini
[2010.09.02 20:40:40 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010.01.17 20:42:28 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

========== LOP Check ==========

[2010.01.22 19:26:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ascaron Entertainment
[2010.09.02 20:40:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited
[2010.05.13 20:13:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2011.03.23 01:20:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2012.05.30 23:37:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2010.06.02 12:17:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Foxit Software
[2010.11.17 05:21:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FreeOrion
[2011.04.17 22:54:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2011.04.21 01:35:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2010.02.20 11:10:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MAXQDA2007
[2010.07.11 13:08:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MyPhoneExplorer
[2010.03.24 15:29:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\NCH Swift Sound
[2010.01.22 18:51:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.05.19 14:16:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2010.07.31 12:01:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PDF Writer
[2010.10.24 22:12:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PPLive
[2012.03.04 16:48:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung
[2010.04.05 22:03:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ScummVM
[2010.11.16 05:23:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SpringLobby
[2010.11.16 05:23:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\springlobby_updater
[2010.11.16 05:22:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\springsettings
[2012.01.10 23:06:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Unity
[2011.04.04 22:52:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\VidCoder
[2011.07.08 23:22:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\VoipCheapCom
[2012.08.02 13:52:41 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2012.04.17 12:11:15 | 000,000,000 | ---D | M](C:\Windows\System32\???^??) -- C:\Windows\System32\Ƶ﷍^硎盈
[2012.04.17 12:11:15 | 000,000,000 | ---D | C](C:\Windows\System32\???^??) -- C:\Windows\System32\Ƶ﷍^硎盈
[2012.04.11 18:16:58 | 000,000,000 | ---D | M](C:\Windows\System32\???3??) -- C:\Windows\System32\ƣ쪍3硎癩
[2012.04.11 18:16:58 | 000,000,000 | ---D | C](C:\Windows\System32\???3??) -- C:\Windows\System32\ƣ쪍3硎癩
[2012.04.11 09:26:27 | 000,000,000 | ---D | M](C:\Windows\System32\???R??) -- C:\Windows\System32\Ɛ훽R硎皒
[2012.04.11 09:26:27 | 000,000,000 | ---D | C](C:\Windows\System32\???R??) -- C:\Windows\System32\Ɛ훽R硎皒
[2012.03.22 12:35:21 | 000,000,000 | ---D | M](C:\Windows\System32\???i??) -- C:\Windows\System32\Ɲ῅į硎痿
[2012.03.22 12:35:21 | 000,000,000 | ---D | C](C:\Windows\System32\???i??) -- C:\Windows\System32\Ɲ῅į硎痿
[2012.02.20 12:47:57 | 000,000,000 | ---D | M](C:\Windows\System32\???.??) -- C:\Windows\System32\Ɠ쉥.硎畽
[2012.02.20 12:47:57 | 000,000,000 | ---D | C](C:\Windows\System32\???.??) -- C:\Windows\System32\Ɠ쉥.硎畽
[2012.02.07 14:20:55 | 000,000,000 | ---D | M](C:\Windows\System32\?T?;??) -- C:\Windows\System32\Ʈힵ;确痻
[2012.02.07 14:20:55 | 000,000,000 | ---D | C](C:\Windows\System32\?T?;??) -- C:\Windows\System32\Ʈힵ;确痻
[2012.02.07 12:24:41 | 000,000,000 | ---D | M](C:\Windows\System32\?u?K??) -- C:\Windows\System32\ư㲽K确疝
[2012.02.07 12:24:41 | 000,000,000 | ---D | C](C:\Windows\System32\?u?K??) -- C:\Windows\System32\ư㲽K确疝
[2012.02.06 19:38:39 | 000,000,000 | ---D | M](C:\Windows\System32\???0??) -- C:\Windows\System32\Ɠ㷵0确瘻
[2012.02.06 19:38:39 | 000,000,000 | ---D | C](C:\Windows\System32\???0??) -- C:\Windows\System32\Ɠ㷵0确瘻
[2012.02.03 17:27:05 | 000,000,000 | ---D | M](C:\Windows\System32\???o??) -- C:\Windows\System32\ƞ欵ơ确瘅
[2012.02.03 17:27:05 | 000,000,000 | ---D | C](C:\Windows\System32\???o??) -- C:\Windows\System32\ƞ欵ơ确瘅

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Alt 28.08.2012, 14:04   #2
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner




Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Ersetze die *** Sternchen wieder in den Benutzernamen zurück!
Code:
ATTFilter
:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=8.0.0.34&sap=hp 
IE - HKCU\..\URLSearchHook: - No CLSID value found 
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found 
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=8.0.0.34&sap=dsp&q={searchTerms} 
IE - HKCU\..\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}: "URL" = http://search.hotspotshield.com/g/results.php?c=s&q={searchTerms} 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://start.icq.com/" 
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=" 
FF - user.js - File not found 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) 
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\E\Shell - "" = AutoRun 
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\SETUP.EXE 

[2012.08.24 00:49:08 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad 
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:A8ADE5D8 
@Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:DFC5A2B2 

[2010.01.17 20:42:28 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat 
:Files
C:\Users\***\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\***\AppData\Local\Temp\*.exe
C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________
Alt 28.08.2012, 18:40   #3
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Vielen Dank t'john für die Hilfe und die freundliche Begrüßung!

Ich habe die Schritte ausgeführt und hier nun der Logfile:


Code:
ATTFilter
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://start.icq.com/" removed from browser.startup.homepage
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-464287513-3956234789-2982991868-1005\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-464287513-3956234789-2982991868-1005\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-464287513-3956234789-2982991868-1005\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\SETUP.EXE not found.
C:\ProgramData\ism_0_llatsni.pad moved successfully.
ADS C:\ProgramData\Temp:A8ADE5D8 deleted successfully.
ADS C:\ProgramData\Temp:DFC5A2B2 deleted successfully.
C:\ProgramData\ezsidmv.dat moved successfully.
========== FILES ==========
File\Folder C:\Users\Helge Klapper\AppData\Local\{*} not found.
File\Folder C:\ProgramData\*.exe not found.
C:\ProgramData\TEMP folder moved successfully.
C:\Users\Helge Klapper\AppData\Local\Temp\GoogleUpdateSetup.exe4bd36 moved successfully.
C:\Users\Helge Klapper\AppData\Local\Temp\GoogleUpdate.exe4d0648 moved successfully.
C:\Users\Helge Klapper\AppData\Local\Temp\jre-7u6-windows-i586-iftw.exe moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Helge Klapper\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Helge Klapper\Desktop\cmd.bat deleted successfully.
C:\Users\Helge Klapper\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Helge Arbeit
->Temp folder emptied: 965136 bytes
->Temporary Internet Files folder emptied: 2413209 bytes
->Java cache emptied: 7548548 bytes
->FireFox cache emptied: 64660011 bytes
->Opera cache emptied: 882523 bytes
->Flash cache emptied: 56981 bytes
 
User: Helge Klapper
->Temp folder emptied: 7523680 bytes
->Temporary Internet Files folder emptied: 10836261 bytes
->FireFox cache emptied: 60363300 bytes
->Opera cache emptied: 21430151 bytes
->Flash cache emptied: 43988 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2065669 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 171,00 mb
 
 
OTL by OldTimer - Version 3.2.58.1 log created on 08282012_193220

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
__________________
Alt 29.08.2012, 01:33   #4
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Sehr gut!

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.08.2012, 21:48   #5
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Der Rechner läuft gut.
Malewarebyte hat keine Malware gefunden (siehe Anhang).

Und hier das Ergebnis von AdwCleaner:
Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/29/2012 at 22:39:40
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : *** - NOTENBUCH
# Boot Mode : Normal
# Running from : C:\Users\***\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\***\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\***\AppData\LocalLow\pdfforge
Folder Found : C:\Users\***\AppData\LocalLow\Search Settings
Folder Found : C:\Users\QQQ\AppData\Roaming\pdfforge
File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\AskToolbarInfo
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\pdfforge
Key Found : HKCU\Software\AppDataLow\Software\Search Settings
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Conduit

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=9.0.0.22&sap=nt

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\rsrc38vt.default\prefs.js

Found : user_pref("extensions.asktb.cbid", "IY");
Found : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Found : user_pref("extensions.asktb.first-restart-after-config-update", true);
Found : user_pref("extensions.asktb.fresh-install", false);
Found : user_pref("extensions.asktb.l", "dis");
Found : user_pref("extensions.asktb.last-config-req", "1304459363888");
Found : user_pref("extensions.asktb.locale", "en_US");
Found : user_pref("extensions.asktb.o", "15589");
Found : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Found : user_pref("extensions.asktb.qsrc", "2871");
Found : user_pref("extensions.asktb.r", "2");
Found : user_pref("extensions.asktb.search-suggestions-enabled", true);

Profile name : default 
File : C:\Users\QQQ\AppData\Roaming\Mozilla\Firefox\Profiles\pgis7f1d.default\prefs.js

[OK] File is clean.

-\\ Opera v12.1.1532.0

File : C:\Users\***\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\QQQ\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3415 octets] - [29/08/2012 22:39:40]

########## EOF - C:\AdwCleaner[R1].txt - [3543 octets] ##########
Viele Grüße und weiterhin vielen vielen Dank!


Alt 29.08.2012, 23:21   #6
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> Cyber Crime Investigation Department Trojaner

Alt 30.08.2012, 20:01   #7
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Hier die Ergebnisse des AdwCleaner (Delete):

Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/30/2012 at 00:37:26
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : *** - NOTENBUCH
# Boot Mode : Normal
# Running from : C:\Users\***\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\***\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\***\AppData\LocalLow\pdfforge
Folder Deleted : C:\Users\***\AppData\LocalLow\Search Settings
Folder Deleted : C:\Users\QQQ\AppData\Roaming\pdfforge
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\AskToolbarInfo
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\pdfforge
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Conduit

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={9642F7AC-2CEE-453C-9231-7BEBD948AAED}&mid=832a7cf177f047d1b54d20587c67e072-fff1cd6326eb546978802b7624acf765c0ec9693&lang=de&ds=ts024&pr=sa&d=2012-01-18 17:27:52&v=9.0.0.22&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\rsrc38vt.default\prefs.js

Deleted : user_pref("extensions.asktb.cbid", "IY");
Deleted : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Deleted : user_pref("extensions.asktb.first-restart-after-config-update", true);
Deleted : user_pref("extensions.asktb.fresh-install", false);
Deleted : user_pref("extensions.asktb.l", "dis");
Deleted : user_pref("extensions.asktb.last-config-req", "1304459363888");
Deleted : user_pref("extensions.asktb.locale", "en_US");
Deleted : user_pref("extensions.asktb.o", "15589");
Deleted : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Deleted : user_pref("extensions.asktb.qsrc", "2871");
Deleted : user_pref("extensions.asktb.r", "2");
Deleted : user_pref("extensions.asktb.search-suggestions-enabled", true);

Profile name : default 
File : C:\Users\QQQ\AppData\Roaming\Mozilla\Firefox\Profiles\pgis7f1d.default\prefs.js

[OK] File is clean.

-\\ Opera v12.1.1532.0

File : C:\Users\***\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\QQQ\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3544 octets] - [29/08/2012 22:39:40]
AdwCleaner[S1].txt - [307 octets] - [29/08/2012 22:41:43]
AdwCleaner[S2].txt - [3633 octets] - [30/08/2012 00:37:26]

########## EOF - C:\AdwCleaner[S2].txt - [3761 octets] ##########
Und die Ergebnisse von Emsisoft Anti-Malware:

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 30.08.2012 18:15:41

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	30.08.2012 18:15:51

C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3lb.class 	gefunden: Exploit.Java.Blacole!E2
C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3ld.class 	gefunden: Exploit.Java.Blacole!E2
C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3le.class 	gefunden: Exploit.Java.Blacole!E2
C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3lc.class 	gefunden: Exploit.Java.CVE-2012!E2
C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3la.class 	gefunden: Exploit.Java.Blacole!E2
C:\Windows.old\Program Files\PPMate\ppamnet.exe 	gefunden: AdWare.Win32.SuspectCRC!E2
C:\Windows.old\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll 	gefunden: Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Windows.old\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll 	gefunden: Adware.Win32.Toolbar.Dealio!E1
C:\Windows.old\Program Files\DAEMON Tools Lite\Pr0t.St0p v1.1.exe 	gefunden: Trojan-Ransom.Win32.Gimemo!E2
C:\Windows.old\Program Files\Application Updater\ApplicationUpdater.exe 	gefunden: Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe 	gefunden: Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Program Files\MiKTeX 2.5\miktex\bin\arctrl.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\amstex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bdftops.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\authorindex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\autoinst.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5+pdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5+latex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\afm2afm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5ppdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5pdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bibhtml.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5latex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bplain.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5platex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\birm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bib2xhtml.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cef5latex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cef5pdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ceflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cjklatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefslatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefspdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefpdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cmap2enc.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\config.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-de.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-nl.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-en.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-uk.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cslatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dblatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ctxtools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\csplain.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dumphint.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\eps2eps.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\escontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\eslatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\esmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\estex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\estexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\exatools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\etex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\findtexmf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\fixmswrd.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\font2afm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\font2c.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gbklatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gbkpdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftodvi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftype.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftopk.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsbj.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gslp.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsdj500.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gslj.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsdj.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsnd.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsndt.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gssetgs.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gst.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ht.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\httex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gstt.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\initex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jadetex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\inimf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ibyhyph.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\httexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1tex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1texi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1mex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1context.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1latex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jsmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jslatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\kpsewhich.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jscontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jstexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jstex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff-so.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexrevise.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lp386r2.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff-vc.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lp386.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexmk.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lpgs.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lpr2.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makefmt.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makebase.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makemem.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makemf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makepk.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makempy.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\maketfm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\merge.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mft.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mllatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mltex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mkfntmap.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mpstools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mptopdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mthelp.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mztex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mztexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\nts.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oocontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oomex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\orderrefs.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ot2kpx.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdf2dsc.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oolatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ootex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ootexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfatfi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfclose.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfcrop.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdf2ps.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfdde.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfetex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfjadetex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfopen.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfplatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfopt.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\perltex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftrimwhite.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfxmltex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pfbtopfa.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pf2afm.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pfm2kpx.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pftogsf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\platex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\plind.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pn2pdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2epsi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ascii.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf12.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf13.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf14.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdfxx.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ps.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ps2.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2write.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps4pdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pstopdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runperl2.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\rlxtools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runbat.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\rcsinfo.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\sjispdflatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\showglyphs.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\sjislatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runtools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teicontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teilatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texdoc.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teitexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\tex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teitex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texexec.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texfind.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texfont.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texify.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\textools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texshow.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texutil.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\thumbpdf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\tmftools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\updmap.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\urlbst.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\vftovp.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\virmf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\vptovf.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\virtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wmakebat.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wrfiles.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmcontext.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmlatex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmmex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xmltools.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhtexi.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhtex.exe 	gefunden: Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xmltex.exe 	gefunden: Trojan.Crypt!E2
D:\Spiele\Colonization\Pr0t.St0p v1.1.exe 	gefunden: Trojan-Ransom.Win32.Gimemo!E2
D:\Downloads\Stream\ppmate-2.3.1.74_by_Myp2p.eu.exe -> $INSTDIR\ppamnet.exe 	gefunden: AdWare.Win32.SuspectCRC!E2
D:\Downloads\System\PDFCreator-1_2_3_setup.exe 	gefunden: Riskware.Win32.Toolbar.Widgi.AMN!E1
D:\Downloads\Spiele\PrOtStOp_v1.1.rar -> Pr0t.St0p v1.1.exe 	gefunden: Trojan-Ransom.Win32.Gimemo!E2

Gescannt	922554
Gefunden	248

Scan Ende:	30.08.2012 20:51:06
Scan Zeit:	2:35:15

D:\Downloads\System\PDFCreator-1_2_3_setup.exe	Quarantäne Riskware.Win32.Toolbar.Widgi.AMN!E1
C:\Program Files\MiKTeX 2.5\miktex\bin\arctrl.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\amstex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bdftops.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\authorindex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\autoinst.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5+pdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5+latex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\afm2afm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5ppdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5pdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bibhtml.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5latex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bplain.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bg5platex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\birm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\bib2xhtml.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cef5latex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cef5pdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ceflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cjklatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefslatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefspdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cefpdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cmap2enc.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\config.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-de.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-nl.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-en.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cont-uk.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\cslatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dblatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ctxtools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\csplain.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbmtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dbtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\dumphint.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\eps2eps.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\escontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\eslatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\esmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\estex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\estexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\exatools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\etex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\findtexmf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\fixmswrd.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\font2afm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\font2c.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gbklatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gbkpdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftodvi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftype.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gftopk.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsbj.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gslp.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsdj500.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gslj.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsdj.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsnd.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gsndt.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gssetgs.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gst.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ht.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\httex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\gstt.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\htcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\initex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jadetex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\inimf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ibyhyph.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\httexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1tex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1texi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1mex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1context.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jh1latex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jhtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jsmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jslatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\kpsewhich.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jscontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jstexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\jstex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff-so.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexrevise.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lp386r2.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexdiff-vc.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lp386.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\latexmk.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lpgs.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\lpr2.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makefmt.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makebase.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makemem.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makemf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makepk.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\makempy.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\maketfm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\merge.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mft.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mllatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mltex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mkfntmap.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mpstools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mptopdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mthelp.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mztex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mztexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\mzmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\nts.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oocontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oomex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\orderrefs.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ot2kpx.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdf2dsc.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\oolatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ootex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ootexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfatfi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfclose.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfcrop.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdf2ps.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfdde.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfetex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfjadetex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfopen.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfplatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfopt.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\perltex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftrimwhite.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdfxmltex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pdftools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pfbtopfa.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pf2afm.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pfm2kpx.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pftogsf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\platex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\plind.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pn2pdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2epsi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ascii.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf12.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf13.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdf14.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2pdfxx.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ps.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2ps2.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps2write.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\ps4pdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\pstopdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runperl2.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\rlxtools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runbat.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\rcsinfo.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\sjispdflatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\showglyphs.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\sjislatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\runtools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teicontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teilatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teimlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texdoc.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teitexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\tex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\teitex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texexec.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texfind.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texfont.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texify.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\textools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texshow.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\texutil.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\thumbpdf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\tmftools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\updmap.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\urlbst.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\uxhtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\vftovp.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\virmf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\vptovf.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\virtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wmakebat.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wrfiles.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\wtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmcontext.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmlatex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmmex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xmltools.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhmtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhtexi.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xhtex.exe	Quarantäne Trojan.Crypt!E2
C:\Program Files\MiKTeX 2.5\miktex\bin\xmltex.exe	Quarantäne Trojan.Crypt!E2
C:\Windows.old\Program Files\DAEMON Tools Lite\Pr0t.St0p v1.1.exe	Quarantäne Trojan-Ransom.Win32.Gimemo!E2
D:\Spiele\Colonization\Pr0t.St0p v1.1.exe	Quarantäne Trojan-Ransom.Win32.Gimemo!E2
D:\Downloads\Spiele\PrOtStOp_v1.1.rar -> Pr0t.St0p v1.1.exe	Quarantäne Trojan-Ransom.Win32.Gimemo!E2
C:\Windows.old\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll	Quarantäne Adware.Win32.Toolbar.Dealio!E1
C:\Windows.old\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll	Quarantäne Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Windows.old\Program Files\Application Updater\ApplicationUpdater.exe	Quarantäne Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe	Quarantäne Adware.Win32.Toolbar.Dealio.AMN!E1
C:\Windows.old\Program Files\PPMate\ppamnet.exe	Quarantäne AdWare.Win32.SuspectCRC!E2
D:\Downloads\Stream\ppmate-2.3.1.74_by_Myp2p.eu.exe -> $INSTDIR\ppamnet.exe	Quarantäne AdWare.Win32.SuspectCRC!E2
C:\_OTL\MovedFiles\08282012_193220\C_Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\6e15cd83-19680e59 -> hk3la\hk3lc.class	Quarantäne Exploit.Java.CVE-2012!E2

Quarantäne	244

Alt 31.08.2012, 08:39   #8
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 04.09.2012, 17:17   #9
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Danke, t'john!
Hier die Ergebnisse vom ESET Online Scanner:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dc7c55a49c5e384f8a01b2e7e4ea302f
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-31 02:50:44
# local_time=2012-08-31 04:50:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 27404935 27404935 0 0
# compatibility_mode=5893 16776574 100 94 521 98047652 0 0
# compatibility_mode=8192 67108863 100 0 268 268 0 0
# scanned=281625
# found=6
# cleaned=6
# scan_time=8183
C:\Windows.old\Documents and Settings\ZZZ\AppData\Local\Anwendungsdaten\Microsoft\Windows\Temporary Internet Files\Content.IE5\MN4QJXC2\Dealio%20Toolbar[1].msi	probably a variant of Win32/Toolbar.Widgi application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Documents and Settings\ZZZ\AppData\Local\Anwendungsdaten\Microsoft\Windows\Temporary Internet Files\Content.IE5\NWSU2X2H\pdfforgeToolbar[1].msi	probably a variant of Win32/Toolbar.Widgi application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Program Files\Dealio Toolbar\WidgiHelper.exe	Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Program Files\Dealio Toolbar\FF\components\dealioToolbarFF.dll	probably a variant of Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll	probably a variant of Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Program Files\Hotspot Shield\bin\openvpnas.exe	a variant of Win32/HotSpotShield application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dc7c55a49c5e384f8a01b2e7e4ea302f
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-04 12:39:18
# local_time=2012-09-04 02:39:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 27728608 27728608 0 0
# compatibility_mode=5893 16776574 100 94 324194 98371325 0 0
# compatibility_mode=8192 67108863 100 0 323941 323941 0 0
# scanned=657570
# found=7
# cleaned=7
# scan_time=22224
C:\Windows.old\Program Files\Search Settings\SearchSettingsRes409.dll	Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows.old\Windows\Temp\hss_update.exe	a variant of Win32/HotSpotShield application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Downloads\Setup_FreeFlvConverterN.exe	Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
D:\Downloads\Kleine Porgramme\HSS-1.18-install-anchorfree-76-conduit.zip	a variant of Win32/HotSpotShield application (deleted - quarantined)	00000000000000000000000000000000	C
I:\NOTENBUCH\Backup Set 2010-01-16 141455\Backup Files 2010-09-03 102547\Backup files 5.zip	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
I:\NOTENBUCH\Backup Set 2011-04-25 235750\Backup Files 2011-04-25 235750\Backup files 6.zip	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
I:\NOTENBUCH\Backup Set 2011-06-26 193547\Backup Files 2011-06-26 193547\Backup files 7.zip	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C

Alt 04.09.2012, 20:08   #10
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck


Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 05.09.2012, 16:55   #11
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Hi t'john, hier der erste Plugin-Check nach Aktualisierung:

Code:
ATTFilter
Opera 12.01 ist aktuell
Flash 11,2,202,228 ist veraltet! 
Aktualisieren Sie bitte auf die neueste Version!

Java (1,7,0,7) ist aktuell.
Adobe Reader 10,1,2,0 ist veraltet! 
Aktualisieren Sie bitte auf die neueste Version: 10,1,3
Und nach der Deaktivierung:
Code:
ATTFilter
Java ist nicht Installiert oder nicht aktiviert.

Alt 06.09.2012, 02:13   #12
t'john
/// Helfer-Team
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Uninstall.
  • Bestätige mit Ja.




Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?
__________________
Mfg, t'john
Das TB unterstützen

Alt 06.09.2012, 17:49   #13
dumberer
 
Cyber Crime Investigation Department Trojaner - Standard

Cyber Crime Investigation Department Trojaner


Alles erledigt.
Vielen vielen Dank t'john!

Antwort

Themen zu Cyber Crime Investigation Department Trojaner
adobe, antivir, autorun, avg, avira, bho, bonjour, cdburnerxp, cid, computer, crime, cyber crime, defender, document, explorer, firefox, flash player, format, google, google earth, langs, logfile, object, plug-in, programm, registry, scan, senden, taskhost.exe, temp, trojaner, windows


« GEZ Trojaner | GVU Trojaner 2.07 komplett entfernen »


Ähnliche Themen: Cyber Crime Investigation Department Trojaner


  1. Cyber Crime Investigation Department Cyber Crime Investigation Department
    Plagegeister aller Art und deren Bekämpfung - 02.11.2014 (3)
  2. Cyber Crime Investigation Department trojaner
    Mülltonne - 01.11.2014 (1)
  3. Cyber crime investigation department - Trojaner
    Log-Analyse und Auswertung - 13.01.2013 (13)
  4. polizei cyber crime investigation department trojaner
    Log-Analyse und Auswertung - 23.12.2012 (14)
  5. Cyber Crime Investigation Department
    Plagegeister aller Art und deren Bekämpfung - 16.12.2012 (2)
  6. Cyber Crime Investigation Department
    Log-Analyse und Auswertung - 13.11.2012 (11)
  7. Cyber Crime Investigation Department - OTL-txt
    Log-Analyse und Auswertung - 24.10.2012 (13)
  8. Cyber Crime Investigation Department-Trojaner
    Log-Analyse und Auswertung - 24.10.2012 (19)
  9. Cyber Crime Investigation Department Trojaner
    Plagegeister aller Art und deren Bekämpfung - 07.10.2012 (13)
  10. cyber crime investigation department
    Plagegeister aller Art und deren Bekämpfung - 04.10.2012 (16)
  11. Trojaner - Cyber Crime Investigation Department
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (12)
  12. Trojaner: Cyber crime investigation department
    Plagegeister aller Art und deren Bekämpfung - 24.09.2012 (7)
  13. Trojaner: cyber crime investigation department
    Log-Analyse und Auswertung - 19.09.2012 (10)
  14. Trojaner - Cyber Crime Investigation Department Österreich
    Log-Analyse und Auswertung - 17.09.2012 (12)
  15. Cyber Crime Investigation Department Österreich - Trojaner
    Log-Analyse und Auswertung - 15.09.2012 (34)
  16. Cyber Crime Investigation Department Trojaner
    Log-Analyse und Auswertung - 02.09.2012 (11)
  17. Cyber Crime Investigation Department
    Plagegeister aller Art und deren Bekämpfung - 31.08.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Cyber Crime Investigation Department Trojaner - Guten Abend liebe Community, ich habe mich dummerweise letzte Woche mit dem Cyber Crime Investigation Department Trojaner infiziert, wie wohl mehrere andere User hier auch. In meiner Panik habe ich - Cyber Crime Investigation Department Trojaner...
Archiv
Du betrachtest: Cyber Crime Investigation Department Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131