| |
| |||||||
Log-Analyse und Auswertung: Ihavenet.com VirusWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
30.08.2012, 17:26
| #1 |
| |  Ihavenet.com Virus Hallo und danke erstma für die folgenden Antworten. Ich habe seit paar Tagen das Problem, dass ich bei Google.de etwas Suche, dann auf den Link klicke und über Ihavenet.com auf eine andere Seite komme. Jetzt hab ich weng drüber nachgegoogelt und herausgefunden dass man es nur individuel auf jedem Rechner durch OTL Fixen kann. Ich bitte um schnelle Hilfe da ich nicht weis wie weit sich der Virus verbreitet. Hier ist der Report:OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.08.2012 18:17:12 - Run 1 OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\Chucky\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,98 Gb Total Physical Memory | 6,12 Gb Available Physical Memory | 76,70% Memory free 15,96 Gb Paging File | 13,80 Gb Available in Paging File | 86,43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 287,72 Gb Total Space | 197,95 Gb Free Space | 68,80% Space Free | Partition Type: NTFS Drive D: | 287,84 Gb Total Space | 286,91 Gb Free Space | 99,68% Space Free | Partition Type: NTFS Computer Name: CHUCKY-PC | User Name: Chucky | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.30 18:15:44 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Chucky\Downloads\OTL.exe PRC - [2012.08.29 19:21:24 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2012.08.21 20:56:48 | 000,127,040 | ---- | M] (ICQ, LLC.) -- C:\Program Files (x86)\ICQ7M\ICQ.exe PRC - [2012.08.21 20:42:00 | 001,807,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe PRC - [2012.08.17 22:39:45 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.08.10 18:59:52 | 004,440,896 | ---- | M] (Akamai Technologies, Inc.) -- C:\Users\Chucky\AppData\Local\Akamai\netsession_win.exe PRC - [2012.07.26 10:29:46 | 000,244,656 | ---- | M] (Facebook) -- C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Chucky\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2012.05.09 17:19:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.09 17:19:27 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe PRC - [2011.12.27 12:19:25 | 001,693,112 | ---- | M] (MusicLab, LLC) -- C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.07.29 22:05:42 | 000,887,976 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe PRC - [2011.07.01 04:51:14 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe PRC - [2011.07.01 04:51:14 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe PRC - [2011.07.01 04:51:12 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe PRC - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe PRC - [2011.03.30 00:33:08 | 000,598,312 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe PRC - [2011.02.01 23:24:42 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.02.01 23:24:40 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2011.01.12 19:00:42 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010.05.14 12:44:46 | 000,501,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe ========== Modules (No Company Name) ========== MOD - [2012.08.29 19:21:24 | 002,242,528 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012.08.21 20:42:00 | 009,813,704 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll MOD - [2012.07.26 10:30:04 | 021,014,960 | ---- | M] () -- C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\libcef.dll MOD - [2012.07.26 10:29:40 | 000,283,568 | ---- | M] () -- C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\CefSharp.WinForms.dll MOD - [2012.07.26 10:29:36 | 000,455,600 | ---- | M] () -- C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\CefSharp.dll MOD - [2012.06.13 06:35:51 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll MOD - [2012.06.13 06:35:28 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012.06.13 06:35:22 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012.05.10 15:57:01 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll MOD - [2012.05.10 15:56:22 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012.05.10 15:56:19 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012.05.10 15:56:18 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012.05.10 15:56:09 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2012.03.13 17:57:55 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll MOD - [2010.11.21 05:24:08 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ========== Services (SafeList) ========== SRV:64bit: - [2011.02.08 16:00:20 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.08.29 19:21:24 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.08.21 21:29:18 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.11 03:06:41 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai) SRV - [2012.05.09 17:19:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.09 17:19:27 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe -- (NIS) SRV - [2011.12.16 11:37:38 | 005,827,072 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.08.02 12:59:46 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc) SRV - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService) SRV - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Live Updater Service) SRV - [2011.03.30 00:33:08 | 000,598,312 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2011.03.29 06:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.02.01 23:24:42 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.02.01 23:24:40 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2011.01.12 19:00:42 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.11.29 16:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.06.02 00:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU) SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.05.09 17:19:28 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.09 17:19:28 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.29 08:28:38 | 000,405,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\symnets.sys -- (SymNetS) DRV:64bit: - [2012.03.29 08:28:30 | 001,092,728 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\symefa64.sys -- (SymEFA) DRV:64bit: - [2012.03.29 08:06:25 | 000,190,072 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\ironx64.sys -- (SymIRON) DRV:64bit: - [2012.03.29 08:03:27 | 000,737,912 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\srtsp64.sys -- (SRTSP) DRV:64bit: - [2012.03.29 08:03:27 | 000,037,496 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\srtspx64.sys -- (SRTSPX) DRV:64bit: - [2012.03.27 21:25:58 | 000,175,736 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 12:23:14 | 000,358,480 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2avs.sys -- (ks2avs) DRV:64bit: - [2012.02.22 12:23:14 | 000,080,464 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2usb.sys -- (ks2usb_svc) DRV:64bit: - [2011.11.30 00:44:29 | 000,167,048 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\ccsetx64.sys -- (ccSet_NIS) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.09.16 17:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.06.02 05:37:32 | 002,750,464 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2011.05.16 22:03:26 | 000,451,192 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1307010.005\symds64.sys -- (SymDS) DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.02.08 16:52:26 | 009,078,272 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.02.08 15:23:04 | 000,299,520 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.01.12 18:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.11.29 16:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.11.17 01:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2010.11.12 08:23:40 | 000,138,024 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.09.27 09:24:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.07.20 11:43:22 | 000,247,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV - [2012.07.02 19:19:21 | 002,068,600 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20120702.002\ex64.sys -- (NAVEX15) DRV - [2012.07.02 19:19:21 | 000,120,440 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20120702.002\eng64.sys -- (NAVENG) DRV - [2012.06.19 12:57:03 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl) DRV - [2012.06.19 02:01:13 | 001,161,376 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20120619.001\BHDrvx64.sys -- (BHDrvx64) DRV - [2012.06.14 20:39:24 | 000,509,088 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20120702.001\IDSviA64.sys -- (IDSVia64) DRV - [2012.05.31 11:24:31 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=177&systemid=2&sr=0&q={searchTerms} IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=177&systemid=2&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=1586&gct=hp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms} IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=177&systemid=2&sr=0&q={searchTerms} IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} IE - HKCU\..\SearchScopes\{B41A4CC7-70A7-4987-878E-AB3150F2A0C5}: "URL" = hxxp://start.funmoods.com/results.php?f=4&a=make&q={searchTerms} IE - HKCU\..\SearchScopes\{F05A836F-B05A-45E3-90DE-A5C50FDCBA32}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=ECB13B39-2B19-4E53-B5FD-9576BEA1E9B4&apn_sauid=2E1218DE-CF46-424F-BC67-BA477E9A6B1B IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://search.bearshare.com" FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=177&systemid=2&sr=0&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll () FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn\ [2012.03.17 17:55:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn\ [2012.08.17 05:10:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.29 19:21:24 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.17 22:31:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chucky\AppData\Roaming\mozilla\Extensions [2012.08.23 15:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions [2012.08.21 19:38:26 | 000,000,000 | ---D | M] (FileConverter 1.3) -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee} [2012.07.28 11:15:06 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.04.17 22:31:20 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} [2012.04.05 07:59:18 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com [2012.08.23 15:22:54 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Chucky\AppData\Roaming\mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\toolbar@ask.com [2011.07.29 22:02:18 | 000,002,333 | ---- | M] () -- C:\Users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\searchplugins\askcom.xml [2012.08.16 03:23:54 | 000,000,927 | ---- | M] () -- C:\Users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\searchplugins\conduit.xml [2012.04.05 07:59:17 | 000,001,798 | ---- | M] () -- C:\Users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\searchplugins\funmoods.xml [2012.04.17 22:31:17 | 000,002,515 | ---- | M] () -- C:\Users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\searchplugins\Search_Results.xml [2012.08.22 17:28:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.08.29 19:21:24 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.25 06:24:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.16 02:15:32 | 000,003,770 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2012.08.29 19:21:24 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.25 06:24:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.25 06:24:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.04.17 22:31:17 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2012.06.25 06:24:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.25 06:24:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\BROWSE~1.DLL (MusicLab, LLC) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\BROWSE~1.DLL (MusicLab, LLC) O2 - BHO: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll (Symantec Corporation) O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE (MusicLab, LLC) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Chucky\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKCU..\Run: [Facebook Update] C:\Users\Chucky\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [LicenseValidator] C:\Users\Chucky\AppData\Roaming\WinRAR\{C710F336-CDDA-48CF-838D-5E828FC0A699}\LicenseValidator.exe File not found O4 - Startup: C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Chucky\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook) O4 - Startup: C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Chucky\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Chucky\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DBE5638D-ECF5-4249-BC7C-8AFAA7E1FEC5}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll (MusicLab, LLC) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== File not found -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neue Funktion 1 [2012.08.30 16:05:35 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Desktop\traktor [2012.08.30 15:52:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012.08.30 15:52:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2012.08.29 18:19:14 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Desktop\willi [2012.08.28 23:13:55 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\Audacity [2012.08.28 23:12:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity [2012.08.28 23:02:19 | 000,000,000 | -H-D | C] -- C:\ProgramData\{45A5DECC-D6B1-4364-8030-F693CF272758} [2012.08.28 22:09:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.08.28 22:09:47 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR [2012.08.28 22:09:46 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR [2012.08.28 21:50:00 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Documents\Native Instruments [2012.08.28 21:03:36 | 000,000,000 | -H-D | C] -- C:\ProgramData\{BDB6EDEE-42BB-412F-AD4C-3C03928601E5} [2012.08.28 21:02:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments [2012.08.28 21:02:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133} [2012.08.28 21:02:41 | 000,000,000 | -H-D | C] -- C:\ProgramData\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14} [2012.08.28 21:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments [2012.08.28 21:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments [2012.08.28 21:02:40 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments [2012.08.28 21:02:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments [2012.08.23 16:24:43 | 000,000,000 | ---D | C] -- C:\Riot Games [2012.08.23 15:56:32 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Desktop\League of Legends [2012.08.23 15:22:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com [2012.08.22 23:22:59 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\ATI [2012.08.22 23:22:59 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Local\ATI [2012.08.22 23:22:59 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.08.22 16:45:54 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Desktop\schwompf [2012.08.22 00:02:52 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II [2012.08.21 23:43:30 | 000,102,400 | ---- | C] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2012.08.21 23:43:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II [2012.08.21 23:19:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo II [2012.08.21 23:07:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RegCleaner [2012.08.21 21:00:19 | 000,000,000 | ---D | C] -- C:\Users\Chucky\D2-1.12A-deDE [2012.08.21 21:00:13 | 000,000,000 | ---D | C] -- C:\Users\Chucky\Documents\ICQ [2012.08.21 20:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7M [2012.08.21 20:56:52 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\ICQ [2012.08.21 20:56:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7M [2012.08.21 20:55:30 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Local\Macromedia [2012.08.21 20:42:00 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.21 20:08:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment [2012.08.21 19:37:24 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games [2012.08.21 18:09:14 | 000,033,856 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\SysNative\hamachi.sys [2012.08.21 18:08:47 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Local\LogMeIn Hamachi [2012.08.21 17:48:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.08.17 07:48:31 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.08.17 07:48:31 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.08.17 07:48:30 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.08.17 07:48:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.08.17 07:48:30 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.08.17 07:48:29 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.08.17 07:48:29 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.08.17 07:48:29 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.08.17 07:48:28 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.08.17 07:48:28 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.08.17 07:48:28 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.08.17 07:48:27 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.08.17 07:48:26 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.08.17 05:40:31 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll [2012.08.17 05:40:29 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2012.08.17 05:40:29 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2012.08.17 05:40:29 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe [2012.08.17 05:40:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll [2012.08.17 05:40:28 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll [2012.08.17 05:40:28 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll [2012.08.17 05:38:40 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll [2012.08.16 04:04:30 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Roaming\Malwarebytes [2012.08.16 04:04:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.16 04:04:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.16 04:04:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.16 02:15:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG Secure Search [2012.08.16 02:10:44 | 000,000,000 | ---D | C] -- C:\Users\Chucky\AppData\Local\AVG Secure Search [2012.08.16 02:10:42 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search [2012.08.16 02:10:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVG Secure Search [2012.08.16 02:10:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files ========== Files - Modified Within 30 Days ========== [2012.08.30 17:58:50 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 17:58:50 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 17:35:36 | 000,000,320 | ---- | M] () -- C:\Windows\tasks\NPRA.job [2012.08.30 17:35:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.30 17:35:26 | 2133,217,279 | -HS- | M] () -- C:\hiberfil.sys [2012.08.30 17:29:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.30 16:53:58 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.08.30 16:53:58 | 000,654,610 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.08.30 16:53:58 | 000,616,452 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.08.30 16:53:58 | 000,130,192 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.08.30 16:53:58 | 000,106,574 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.08.30 15:52:25 | 000,000,938 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk [2012.08.30 00:42:00 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1023281595-233733860-1608270950-1000UA.job [2012.08.30 00:42:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1023281595-233733860-1608270950-1000Core.job [2012.08.29 02:00:09 | 929,676,396 | ---- | M] () -- C:\Users\Chucky\Desktop\Dont mess with me.wav [2012.08.28 23:02:23 | 001,676,399 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1307010.005\Cat.DB [2012.08.23 18:50:06 | 000,106,496 | RHS- | M] () -- C:\Windows\SysWow64\ntkrnlpae.dll [2012.08.23 16:27:05 | 000,001,734 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2012.08.22 00:21:47 | 000,039,416 | ---- | M] () -- C:\Windows\DIIUnin.dat [2012.08.22 00:18:41 | 000,021,840 | ---- | M] () -- C:\Windows\SysWow64\SIntfNT.dll [2012.08.22 00:18:41 | 000,017,212 | ---- | M] () -- C:\Windows\SysWow64\SIntf32.dll [2012.08.22 00:18:41 | 000,012,067 | ---- | M] () -- C:\Windows\SysWow64\SIntf16.dll [2012.08.22 00:02:52 | 000,001,913 | ---- | M] () -- C:\Users\Chucky\Desktop\Diablo II - Lord of Destruction.lnk [2012.08.21 23:43:42 | 000,001,913 | ---- | M] () -- C:\Users\Public\Desktop\Diablo II.lnk [2012.08.21 23:43:30 | 000,102,400 | ---- | M] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2012.08.21 23:43:30 | 000,002,829 | ---- | M] () -- C:\Windows\DIIUnin.pif [2012.08.21 23:09:00 | 000,000,970 | ---- | M] () -- C:\Users\Chucky\Desktop\RegCleaner.lnk [2012.08.21 21:29:17 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.08.21 21:29:17 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.08.21 20:58:11 | 000,001,825 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7M.lnk [2012.08.21 17:52:31 | 000,000,210 | ---- | M] () -- C:\Users\Chucky\Documents\passwort.rtf [2012.08.17 14:33:43 | 000,296,632 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.16 18:50:25 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad ========== Files Created - No Company Name ========== [2012.08.29 01:59:29 | 929,676,396 | ---- | C] () -- C:\Users\Chucky\Desktop\Dont mess with me.wav [2012.08.28 23:13:03 | 000,001,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk [2012.08.23 18:50:06 | 000,106,496 | RHS- | C] () -- C:\Windows\SysWow64\ntkrnlpae.dll [2012.08.23 18:50:06 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\NPRA.job [2012.08.23 16:27:05 | 000,001,734 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk [2012.08.22 00:04:53 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll [2012.08.22 00:04:53 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll [2012.08.22 00:04:53 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll [2012.08.22 00:02:52 | 000,001,913 | ---- | C] () -- C:\Users\Chucky\Desktop\Diablo II - Lord of Destruction.lnk [2012.08.21 23:43:42 | 000,039,416 | ---- | C] () -- C:\Windows\DIIUnin.dat [2012.08.21 23:43:42 | 000,001,913 | ---- | C] () -- C:\Users\Public\Desktop\Diablo II.lnk [2012.08.21 23:43:30 | 000,002,829 | ---- | C] () -- C:\Windows\DIIUnin.pif [2012.08.21 23:07:51 | 000,000,970 | ---- | C] () -- C:\Users\Chucky\Desktop\RegCleaner.lnk [2012.08.21 20:58:11 | 000,001,825 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7M.lnk [2012.08.21 20:42:01 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.21 18:08:27 | 000,000,938 | ---- | C] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk [2012.08.21 17:52:31 | 000,000,210 | ---- | C] () -- C:\Users\Chucky\Documents\passwort.rtf [2012.08.16 03:52:00 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad [2012.04.17 22:34:18 | 000,003,584 | ---- | C] () -- C:\Users\Chucky\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.03.29 21:25:15 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2012.03.26 17:00:12 | 003,907,072 | ---- | C] () -- C:\Users\Chucky\LC.exe [2012.03.26 17:00:12 | 000,000,056 | ---- | C] () -- C:\Users\Chucky\lccnct.dta [2012.03.26 17:00:12 | 000,000,042 | ---- | C] () -- C:\Users\Chucky\sl.dta [2012.03.26 17:00:12 | 000,000,004 | ---- | C] () -- C:\Users\Chucky\vtm.brn [2012.03.26 17:00:12 | 000,000,001 | ---- | C] () -- C:\Users\Chucky\ln.dta [2012.03.21 21:56:56 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.03.08 14:01:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.03.08 13:50:02 | 000,003,126 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat [2011.11.22 18:49:26 | 000,000,123 | ---- | C] () -- C:\Users\Chucky\luncher.dat [2011.10.04 15:25:52 | 000,003,126 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat < End of report > |
|
30.08.2012, 17:38
| #2 |
| /// Malware-holic   |  Ihavenet.com Virus hi
__________________dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
[2012.08.23 18:50:06 | 000,106,496 | RHS- | M] () -- C:\Windows\SysWow64\ntkrnlpae.dll
[2012.08.23 18:50:06 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\NPRA.job
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
 danach: downloade get info: File-Upload.net - GetInfo.exe doppelklicke die .exe im selben ordner wird nun eine .txt erstellt: summary-info.txt diese doppelklicken und deren inhalt posten.
__________________ |
|
30.08.2012, 18:49
| #3 |
| | Ihavenet.com Virus Ich habe kein Textdokument auf meinen Desktop und meine Desktop Symbole werden angezeigt.
__________________Was soll ich tun? Das stand in dem Txt document das aufging nachdem ich neugestartet habe Files\Folders moved on Reboot... C:\Users\Chucky\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Chucky\AppData\Local\Temp\MMDUtl.log moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... Upload hat funktioniert getinfo log System volume information: dwHighDateTime = 0x1cc9e06,dwLowDateTime = 0xa5e469dc System32: dwHighDateTime = 0x1c7c427,dwLowDateTime = 0x1f6db2c0 dwSerialNumber = 0x8c7ac318 Geändert von Schwompf (30.08.2012 um 19:04 Uhr) |
|
30.08.2012, 20:10
| #4 |
| /// Malware-holic | Ihavenet.com Virus sehr gut. bitte jetzt folgendes: lade 7zip und instaliere es: 7-Zip starte neu dann gehe auf start, ausführen tippe: regedit.exe enter alles auf der linken seite zuklappen, datei, exportieren, suche einen ordner den du gut wiederfindest, zb desktop dann vergib nen namen den du wieder erkennst dann rechtsklickauf die datei, 7zip menü auf klappen, zu einem archiv hinzufügen wählen archiv format: 7z kompressionsstärke: ultra kompressionsverfahren: lzma2 wörterbuch größe: 64 mb wortgröße: 273 größe solider blöcke, solide ok klicken archiv bei: File-Upload.net - Ihr kostenloser File Hoster! hochladen link als private nachicht an mich
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
31.08.2012, 10:59
| #5 | |
| /// Malware-holic | Ihavenet.com Virus danke für den upload Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
05.09.2012, 23:25
| #6 |
| | Ihavenet.com Virus Combofix Logfile: Code:
ATTFilter ComboFix 12-09-05.02 - Chucky 05.09.2012 23:47:53.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8174.6506 [GMT 2:00]
ausgeführt von:: c:\users\Chucky\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ism_0_llatsni.pad
c:\users\Chucky\AppData\Roaming\Help\coredb\storage
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\chrome.manifest
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\funmoods.css
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\funmoods.xul
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\de.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\en.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\es.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\he.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\il.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\it.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\no.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\se.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\us.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\help_16.gif
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\home.gif
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\logo.png
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\loader.xul
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\mtstart.js
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\tmplt.js
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\content\uninsthk.js
c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\extensions\ffxtlbr@funmoods.com\install.rdf
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-05 bis 2012-09-05 ))))))))))))))))))))))))))))))
.
.
2012-09-05 21:56 . 2012-09-05 21:56 -------- d-----w- c:\users\Papa\AppData\Local\temp
2012-09-05 21:56 . 2012-09-05 21:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-30 17:36 . 2012-08-30 18:01 -------- d-----w- C:\_OTL
2012-08-30 13:52 . 2012-08-30 13:52 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-08-29 17:21 . 2012-08-29 17:21 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2012-08-28 21:13 . 2012-08-29 15:31 -------- d-----w- c:\users\Chucky\AppData\Roaming\Audacity
2012-08-28 21:12 . 2012-08-28 21:13 -------- d-----w- c:\program files (x86)\Audacity
2012-08-28 21:02 . 2012-08-28 21:02 -------- dc-h--w- c:\programdata\{45A5DECC-D6B1-4364-8030-F693CF272758}
2012-08-28 20:09 . 2012-08-28 20:09 -------- d-----w- c:\program files\WinRAR
2012-08-28 19:03 . 2012-08-28 19:03 -------- dc-h--w- c:\programdata\{BDB6EDEE-42BB-412F-AD4C-3C03928601E5}
2012-08-28 19:02 . 2012-08-28 19:02 -------- d-----w- c:\program files (x86)\Common Files\Native Instruments
2012-08-28 19:02 . 2012-08-28 19:02 -------- dc-h--w- c:\programdata\{A2A4D724-2D08-46E4-BAA8-EC9EE875D133}
2012-08-28 19:02 . 2012-08-28 19:02 -------- dc-h--w- c:\programdata\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}
2012-08-28 19:02 . 2012-08-28 21:02 -------- d-----w- c:\program files\Native Instruments
2012-08-28 19:02 . 2012-08-28 19:02 -------- d-----w- c:\programdata\Native Instruments
2012-08-28 19:02 . 2012-08-28 19:02 -------- d-----w- c:\program files\Common Files\Native Instruments
2012-08-23 19:10 . 2012-08-23 19:10 -------- d-----w- c:\users\Papa\AppData\Local\Macromedia
2012-08-23 14:24 . 2012-08-23 14:24 -------- d-----w- C:\Riot Games
2012-08-23 13:22 . 2012-08-23 13:22 -------- d-----w- c:\program files (x86)\Ask.com
2012-08-23 12:19 . 2012-08-28 12:19 -------- d-----w- c:\users\Papa\AppData\Local\LogMeIn Hamachi
2012-08-22 21:22 . 2012-08-22 21:22 -------- d-----w- c:\users\Chucky\AppData\Roaming\ATI
2012-08-22 21:22 . 2012-08-22 21:22 -------- d-----w- c:\users\Chucky\AppData\Local\ATI
2012-08-22 21:22 . 2012-08-22 21:22 -------- d-----w- c:\programdata\ATI
2012-08-21 22:04 . 2012-08-21 22:18 21840 ----atw- c:\windows\SysWow64\SIntfNT.dll
2012-08-21 22:04 . 2012-08-21 22:18 17212 ----atw- c:\windows\SysWow64\SIntf32.dll
2012-08-21 22:04 . 2012-08-21 22:18 12067 ----atw- c:\windows\SysWow64\SIntf16.dll
2012-08-21 21:43 . 2012-08-21 21:43 2829 ----a-w- c:\windows\DIIUnin.pif
2012-08-21 21:43 . 2012-08-21 21:43 102400 ----a-w- c:\windows\DIIUnin.exe
2012-08-21 21:19 . 2012-09-02 20:05 -------- d-----w- c:\program files (x86)\Diablo II
2012-08-21 21:07 . 2012-08-21 21:07 -------- d-----w- c:\program files (x86)\RegCleaner
2012-08-21 19:00 . 2012-08-21 20:25 -------- d-----w- c:\users\Chucky\D2-1.12A-deDE
2012-08-21 18:56 . 2012-09-05 17:18 -------- d-----w- c:\users\Chucky\AppData\Roaming\ICQ
2012-08-21 18:56 . 2012-08-21 18:59 -------- d-----w- c:\program files (x86)\ICQ7M
2012-08-21 18:55 . 2012-08-21 18:55 -------- d-----w- c:\users\Chucky\AppData\Local\Macromedia
2012-08-21 18:42 . 2012-08-21 19:29 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-21 18:08 . 2012-08-21 18:08 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2012-08-21 16:09 . 2009-03-18 15:35 33856 ---ha-w- c:\windows\system32\hamachi.sys
2012-08-21 16:08 . 2012-09-05 22:17 -------- d-----w- c:\users\Chucky\AppData\Local\LogMeIn Hamachi
2012-08-21 15:51 . 2012-08-01 22:58 9309624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E3D2B59C-E996-4CFE-9B69-3EDDA55DDFB3}\mpengine.dll
2012-08-17 03:40 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
2012-08-17 03:40 . 2012-05-05 07:46 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2012-08-17 03:40 . 2012-07-04 22:13 136704 ----a-w- c:\windows\system32\browser.dll
2012-08-17 03:40 . 2012-02-11 06:43 751104 ----a-w- c:\windows\system32\win32spl.dll
2012-08-17 03:40 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2012-08-17 03:40 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2012-08-17 03:40 . 2012-02-11 05:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2012-08-17 03:40 . 2012-07-18 18:15 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-08-17 03:40 . 2012-07-04 22:16 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-08-17 03:40 . 2012-07-04 22:13 59392 ----a-w- c:\windows\system32\browcli.dll
2012-08-17 03:40 . 2012-07-04 21:14 41984 ----a-w- c:\windows\SysWow64\browcli.dll
2012-08-17 03:38 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
2012-08-17 00:39 . 2012-08-17 00:39 -------- d-----w- c:\users\Papa\AppData\Local\AVG Secure Search
2012-08-16 02:04 . 2012-08-16 02:04 -------- d-----w- c:\users\Chucky\AppData\Roaming\Malwarebytes
2012-08-16 02:04 . 2012-08-16 02:04 -------- d-----w- c:\programdata\Malwarebytes
2012-08-16 02:04 . 2012-08-17 03:10 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-16 00:15 . 2012-08-17 03:10 -------- d-----w- c:\program files (x86)\AVG Secure Search
2012-08-16 00:10 . 2012-08-16 00:10 -------- d-----w- c:\users\Chucky\AppData\Local\AVG Secure Search
2012-08-16 00:10 . 2012-08-16 00:10 -------- d-----w- c:\programdata\AVG Secure Search
2012-08-16 00:10 . 2012-08-17 03:10 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2012-08-16 00:10 . 2012-08-16 00:10 -------- d--h--w- c:\programdata\Common Files
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-21 19:29 . 2011-10-04 13:36 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-09 05:43 . 2012-07-11 07:04 14172672 ----a-w- c:\windows\system32\shell32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-07-29 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
2011-12-27 10:07 87480 ----a-w- c:\progra~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-07-29 20:05 1515688 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}"= "c:\progra~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll" [2011-12-27 87480]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-07-29 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\Chucky\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-13 138096]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Akamai NetSession Interface"="c:\users\Chucky\AppData\Local\Akamai\netsession_win.exe" [2012-08-10 4440896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-02-08 336384]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-07-29 887976]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-08-29 1996200]
.
c:\users\Chucky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Chucky\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
Facebook Messenger.lnk - c:\users\Chucky\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe [2012-7-26 244656]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll c:\progra~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 250056]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 ks2avs;Kontrol S2 WDM Audio;c:\windows\system32\Drivers\ks2avs.sys [2012-02-22 358480]
R3 ks2usb_svc;Traktor Kontrol S2;c:\windows\system32\Drivers\ks2usb.sys [2012-02-22 80464]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-29 114144]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-07-20 247400]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R3 X6va006;X6va006;c:\users\Chucky\AppData\Local\Temp\0064944.tmp [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS [2011-05-16 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS [2012-03-29 1092728]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-06-19 1161376]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [2011-11-29 167048]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20120702.001\IDSvia64.sys [2012-06-14 509088]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [2012-03-29 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1307010.005\SYMNETS.SYS [2012-03-29 405624]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-02-08 203776]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-07-01 353360]
S2 ePowerSvc;ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2011-08-02 872552]
S2 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [2011-05-30 36456]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-08-29 2369960]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-12 13336]
S2 Live Updater Service;Live Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2011-04-22 244624]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-03-29 598312]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-12-16 5827072]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe [2012-03-27 138232]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-02-08 9078272]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-02-08 299520]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-16 115216]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-11-12 138024]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-09-27 76912]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 82432]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 181760]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 19:29]
.
2012-09-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1023281595-233733860-1608270950-1000Core.job
- c:\users\Chucky\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-14 22:37]
.
2012-09-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1023281595-233733860-1608270950-1000UA.job
- c:\users\Chucky\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-14 22:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\Chucky\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-10 11785832]
"Power Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2011-08-02 1831016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\progra~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll c:\progra~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.ask.com/?l=dis&o=1586&gct=hp
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://packardbell.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=12&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE: Free YouTube to MP3 Converter - c:\users\Chucky\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
FF - ProfilePath - c:\users\Chucky\AppData\Roaming\Mozilla\Firefox\Profiles\3gz7d7mi.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=177&systemid=2&sr=0&q=
FF - user.js: extensions.funmoods_i.hmpg - true
FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=make
FF - user.js: extensions.funmoods_i.dfltSrch - true
FF - user.js: extensions.funmoods_i.srchPrvdr - Search
FF - user.js: extensions.funmoods_i.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=make
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=make&q=
FF - user.js: extensions.funmoods_i.id - 8c7ac318000000000000ccaf782f8974
FF - user.js: extensions.funmoods_i.instlDay - 15435
FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.167:59
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - make
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef -
FF - user.js: extensions.funmoods_i.dfltLng -
FF - user.js: extensions.funmoods_i.excTlbr - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va006]
"ImagePath"="\??\c:\users\Chucky\AppData\Local\Temp\0064944.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\Launch Manager\LMworker.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-06 00:23:00 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-09-05 22:23
.
Vor Suchlauf: 12 Verzeichnis(se), 211.591.692.288 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 211.333.255.168 Bytes frei
.
- - End Of File - - 0E5CFB248A6A8BA41EB0422C8A1F9592
sorry dasses so lange gedauert hat |
|
06.09.2012, 16:25
| #7 |
| /// Malware-holic | Ihavenet.com Virus öffne malwarebytes, berichte, poste logs mit funden
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.09.2012, 21:09
| #8 |
| | Ihavenet.com Virus Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.09.06.11 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Chucky :: CHUCKY-PC [Administrator] Schutz: Aktiviert 06.09.2012 20:58:02 mbam-log-2012-08-16 (05-44-03).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 460645 Laufzeit: 1 Stunde(n), 7 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Backup\Chucky\Downloads\DownloadSetup (28).exe (Affiliate.Downloader) -> Keine Aktion durchgeführt. C:\_OTL\MovedFiles\08302012_193627\C_Windows\SysWOW64\ntkrnlpae.dll (Trojan.Agent) -> Keine Aktion durchgeführt. (Ende) |
|
06.09.2012, 21:33
| #9 |
| /// Malware-holic | Ihavenet.com Virus lade den CCleaner standard: CCleaner Download - CCleaner 3.22.1800 falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.09.2012, 17:22
| #10 |
| | Ihavenet.com Virus 7-Zip 9.20 12.05.2012 notwendig 7-Zip 9.20 (x64 edition) Igor Pavlov 30.08.2012 3,45MB 9.20.00.0 Adobe AIR Adobe Systems Inc. 07.03.2012 1.5.3.9130 notwendig Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 20.08.2012 6,00MB 11.3.300.271 notwendig Adobe Flash Player 11 Plugin Adobe Systems Incorporated 20.08.2012 6,00MB 11.4.402.265 notwendig Adobe Reader X MUI Adobe Systems Incorporated 03.10.2011 471MB 10.0.0 notwendig Akamai NetSession Interface Akamai Technologies, Inc 21.06.2012 unbekannt Akamai NetSession Interface Service 09.06.2012 unbekannt Ask Toolbar Ask.com 22.08.2012 3,73MB 1.13.0.0 notwendig Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver Atheros Communications Inc. 07.03.2012 1.0.0.36 notwendig ATI Catalyst Install Manager ATI Technologies, Inc. 07.03.2012 22,4MB 3.0.812.0 notwendig Audacity 2.0.2 Audacity Team 27.08.2012 43,6MB 2.0.2 notwendig CCleaner Piriform 12.03.2012 3.16 notwendig Diablo II 20.08.2012 notwendig Dropbox Dropbox, Inc. 09.06.2012 1.4.7 notwendig ETDWare PS/2-X64 8.0.6.0_WHQL ELAN Microelectronic Corp. 07.03.2012 8.0.6.0 unbekannt Facebook Messenger 2.1.4623.0 Facebook 05.09.2012 35,2MB 2.1.4623.0 notwendig Free YouTube to MP3 Converter version 3.11.17.319 DVDVideoSoft Ltd. 27.07.2012 75,2MB 3.11.17.319 notwendig HomeMedia CyberLink Corporation 07.03.2012 2.0.8920 unbekannt ICQ7M ICQ 20.08.2012 7.8 notwendig Identity Card Packard Bell 07.03.2012 1.00.3501 notwendig Intel(R) Management Engine Components Intel Corporation 08.03.2012 7.0.0.1144 notwendig Intel(R) Rapid Storage Technology Intel Corporation 08.03.2012 10.1.2.1004 notwendig Java(TM) 6 Update 22 Oracle 12.03.2012 97,1MB 6.0.220 notwendig LastChaosGER Barunsongames CO., LTD. 25.03.2012 1.00.000 notwendig Launch Manager Packard Bell 07.03.2012 5.1.7 notwendig League of Legends Riot Games 22.08.2012 1.3 notwendig LogMeIn Hamachi LogMeIn, Inc. 29.08.2012 2.1.0.215 notwendig Malwarebytes Anti-Malware Version 1.62.0.1300 Malwarebytes Corporation 05.09.2012 18,8MB 1.62.0.1300 notwendig McAfee Security Scan Plus McAfee, Inc. 11.03.2012 8,30MB 2.0.181.2 notwendig Microsoft .NET Framework 4 Client Profile Microsoft Corporation 03.10.2011 38,8MB 4.0.30319 notwendig Microsoft Office 2010 Microsoft Corporation 07.03.2012 6,31MB 14.0.4763.1000 notwendig Microsoft Office Klick-und-Los 2010 Microsoft Corporation 20.03.2012 14.0.4763.1000 notwendig Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 20.03.2012 14.0.5128.5002 notwendig Microsoft Silverlight Microsoft Corporation 09.05.2012 60,4MB 4.1.10329.0 notwendig Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 03.10.2011 1,70MB 3.1.0000notwendig Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 12.03.2012 0,29MB 8.0.61001 notwendig Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 03.10.2011 0,77MB 9.0.30729.4148 notwendig Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 12.03.2012 0,77MB 9.0.30729.6161 notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 03.10.2011 0,23MB 9.0.30729 notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 03.10.2011 0,58MB 9.0.30729.4148 notwendig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 12.03.2012 0,59MB 9.0.30729.6161 notwendig Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 Microsoft Corporation 24.03.2012 13,7MB 10.0.30319 notwendig Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 13.03.2012 12,3MB 10.0.40219 notwendig Mozilla Firefox 15.0 (x86 de) Mozilla 28.08.2012 39,6MB 15.0 notwendig Mozilla Maintenance Service Mozilla 28.08.2012 0,32MB 15.0 notwendig MSXML 4.0 SP2 (KB954430) Microsoft Corporation 08.03.2012 1,28MB 4.20.9870.0 unbekannt MSXML 4.0 SP2 (KB973688) Microsoft Corporation 08.03.2012 1,33MB 4.20.9876.0 unbekannt Native Instruments Controller Editor 27.08.2012 notwendig Native Instruments Controller Editor Native Instruments 28.08.2012 notwendig Native Instruments Service Center 27.08.2012 notwendig Native Instruments Service Center Native Instruments 28.08.2012 notwendig Native Instruments Traktor 2 27.08.2012 notwendig Native Instruments Traktor 2 Native Instruments 28.08.2012 notwendig Native Instruments Traktor Kontrol S2 Driver 27.08.2012 notwendig Native Instruments Traktor Kontrol S2 Driver Native Instruments 28.08.2012 notwendig Nero BackItUp 10 Nero AG 03.10.2011 118,3MB 5.8.11000.8.100 notwendig Nero Express 10 Nero AG 03.10.2011 165,4MB 10.6.10700.5.100 notwendig Nero Multimedia Suite 10 Essentials Nero AG 03.10.2011 352MB 10.6.10300 notwendig Nero RescueAgent 10 Nero AG 03.10.2011 6,53MB 3.6.10500.3.100 notwendig Nero Update Nero AG 03.10.2011 1,46MB 1.0.10900.31.0 notwendig Norton Internet Security Symantec Corporation 07.03.2012 19.7.1.5 notwendig Norton Online Backup Symantec Corporation 03.10.2011 6,20MB 2.1.17869 notwendig OpenOffice.org 3.3 OpenOffice.org 12.03.2012 415MB 3.3.9567 notwendig Packard Bell Games WildTangent 03.10.2011 1.0.2.5 notwendig Packard Bell Power Management Packard Bell 07.03.2012 6.00.3008 notwendig Packard Bell Recovery Management Packard Bell 03.10.2011 5.00.3502 notwendig Packard Bell Registration Packard Bell 07.03.2012 1.04.3503 notwendig Packard Bell ScreenSaver Packard Bell 07.03.2012 1.1.1025.2010 notwendig Packard Bell Social Networks CyberLink Corp. 07.03.2012 33,2MB 3.0.3106 notwendig Packard Bell Updater Packard Bell 03.10.2011 1.02.3500 notwendig Pando Media Booster Pando Networks Inc. 22.08.2012 5,47MB 2.6.0.8 notwendig RAR File Open Knife - Free Opener Philipp Winterberg 12.05.2012 3.00 notwendig Realtek High Definition Audio Driver Realtek Semiconductor Corp. 07.03.2012 6.0.1.6329 notwendig Realtek USB 2.0 Card Reader Realtek Semiconductor Corp. 07.03.2012 6.1.7600.30123 notwendig Renesas Electronics USB 3.0 Host Controller Driver Renesas Electronics Corporation 07.03.2012 1,01MB 2.0.34.0 notwendig Universal Password Manager Adrian Smith 12.03.2012 2,20MB 1.7 notwendig Video Web Camera CyberLink Corp. 07.03.2012 33,8MB 1.0.1904 notwendig Wincore MediaBar Musiclab, LLC 16.04.2012 3.0.0.119265 notwendig Windows Live Essentials Microsoft Corporation 04.10.2011 15.4.3538.0513 notwendig WinRAR 4.20 (64-Bit) win.rar GmbH 27.08.2012 4.20.0 notwendig Yontoo 1.10.02 Yontoo LLC 12.05.2012 1,27MB 1.10.02 unbekannt Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 Intel 07.03.2012 13,3MB 2.1.23.0 notwendig ich bin mir bei manchen sachen net ganz sicher ob die wirklich notwendig sind |
|
11.09.2012, 15:00
| #11 |
| /// Malware-holic | Ihavenet.com Virus deinstaliere: Adobe Flash Player alle Adobe - Adobe Flash Player installieren neueste version laden adobe reader: Adobe - Adobe Reader herunterladen - Alle Versionen haken bei mcafee security scan raus nehmen bitte auch mal den adobe reader wie folgt konfigurieren: adobe reader öffnen, bearbeiten, voreinstellungen. allgemein: nur zertifizierte zusatz module verwenden, anhaken. internet: hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc. es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht. bei javascript den haken bei java script verwenden raus nehmen bei updater, automatisch instalieren wählen. übernehmen /ok deinstaliere: Ask : weg damit, ask ist nicht grade positiv bekannt geworden und toolbars sind ein zusatz risiko Java Download der kostenlosen Java-Software downloade java jre instalieren deinstaliere: öffne otl, breinigen neustart öffne ccleaner, analysieren starten pc neustarten wenn er läuft wie gewünscht, absichern: die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch! http://www.trojaner-board.de/96344-a...-rechners.html Starte bitte mit der Passage, Windows Vista und Windows 7 Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist. aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen. als browser rate ich dir zu chrome: Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe anleitung lesen bitte falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung Sandboxie Die devinition einer Sandbox ist hier nachzulesen: Sandbox Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen. Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen. Download Link: Sandboxie Download - Sandboxie 3.74 anleitung: http://www.trojaner-board.de/71542-a...sandboxie.html ausführliche anleitung als pdf, auch abarbeiten: Sandbox Einstellungen | bitte folgende zusatz konfiguration machen: sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen. dort klicke auf sandbox einstellungen. beschrenkungen, bei programm start und internet zugriff schreibe: chrome.exe dann gehe auf anwendungen, webbrowser, chrome. dort aktiviere alles außer gesammten profil ordner freigeben. Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen. Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate. Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten. Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten. Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar. Weiter mit: Maßnahmen für ALLE Windows-Versionen alles komplett durcharbeiten anmerkung zu file hippo. in den settings zusätzlich auswählen: hide beta updates. Run updateChecker when Windows starts Backup Programm: in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an: http://www.trojaner-board.de/82962-w...en-backup.html Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar. Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist. Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern bitte auch lesen, wie mache ich programme für alle sichtbar: Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox. wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird Sandboxie immer gestartet wenn du nen browser aufrufst. wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser passwort sicherheit: jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort bei der passwort verwaltung und erstellung hilft roboform Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager anleitung: RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.09.2012, 14:08
| #12 |
| | Ihavenet.com Virus so alles erledigt bis auf der panda security da ich die festplatte nie aus den händen gebe beim paragon backup & recovery programm ist das handbuch ein bisschen groß ^^ habe das wichtigste rausgelesen gibts da noch irgendwelche einstellungen die ich machen muss ? |
|
13.09.2012, 17:24
| #13 |
| /// Malware-holic | Ihavenet.com Virus hi, hast du chrome instaliert? dann absichern: adblock für chrome: http://filepony.de/download-ghostery_chrome/ aktiviere: - Enable GhostRank - Enable bug list - - auto updating - Enable bug blocking (und dann aus der liste alle auswählen). und diese von zeit zu zeit überprüfen, falls was neues hinzukommt, muss dass dann wieder aktiviert werden dann klicke auf safe, und speichere deine konfig. sicher surfen mit chrome: Sicher surfen mit Google Chrome | Verbraucher sicher online ich möchte erst mal anhand einer checkliste prüfen ob du alles hast. - instalieren von optionalen und wichtigen updates. - konfigurieren von windows updates. - dep für alle prozesse aktivieren. - sehop aktivieren. - chrome instalieren. - sandboxie instalieren. - autorun deaktivieren. - panda vaccine instalieren. - secunia instalieren. - file hippo instalieren. beachte: secunia und file hippo bieten englische updates, überall wo du auf die nutzeroberfläche zugreifst, wie zb reader, browser, etc benötigst du deutsche updates, also hier die hersteller seiten in den favoriten deines browsers speichern und wenn ein update gezeigt wird, von dort hohlen, bei java, flash quicktime, ist es egal ob deutsch oder englisch. - backup software instalieren, backup und rettungsdvd erstellen. hier ne kurze anleitung: Anleitung: Systemabbild mit Paragon Drive Backup - NETZWELT - wenn du onlinebanking machst, kann ich noch kurz was über die vorteile von card reader und banking software sagen. - passwort manager instaliert.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Ihavenet.com Virus |
| ihavenet.com, ihavenet.com virus, launch, packard bell, plug-in, spielen, trojaner, usb 3.0, virus, wildtangent games, wscript.exe, yontoo |
Linear-Darstellung
