| |
| |||||||
Log-Analyse und Auswertung: Zugriff auf Filezilla ... wohl über einen TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
07.09.2012, 18:07
| #1 | |
 |  Zugriff auf Filezilla ... wohl über einen Trojaner Hallo allerseits, kurzzusammenfassung: Im Januar hatte ich eine Reinigung gestartet. Damals bin ich bei dem ESET Online-Scanner hängengeblieben, den ich mehrfach "über nacht" gestartet habe, er kam aber nie "durch". Ich kann mich nicht mehr erinnern, ob das daran lag, daß er hängengeblieben ist oder einfach nur viel zu lange gebraucht hat (mehr als 24 Stunden). Gestern hatte ich ziemlich sicher einen Virenbefall. Nachdem jemand meine FTP-Accounts gehackt hat vermute ich, daß er an meine FileZilla-Einstellungsdateien rankam (FileZilla ist berüchtigt dafür, Passwörter im Klartext abzuspeichern, was ich nicht wusste) und nicht über eine Sicherheitslücke Online. Ich habe GData konstant laufen, dort war nichts gemeldet. Ich habe einmal Malwarebystes aktualisiert und einen Quick-Scan gemcaht, da wurde was gefunden: Zitat:
Aktuell arbeite ich fast nur noch mit einem Zweitrechner, von meinem Hauptrechner aus greife ich auf nichts zu, wo ich ein Passwort eingeben muß oder ähnlihces. Für mich steht die Frage an: Lassen sich alle Viren/Trojaner finden oder muß ich komplett neu Installieren. Im Zweifelsfall neige ich eher zum Neu-Installieren, möchte aber gerne zuerst versuchen, den Rechner ohne Neuinstallation zu retten. Hier die Log-Files. - defogger hat nichts gemeldet. - OLT Es steht dabei "Alle Programme schließen". Wie sieht es aus mit Hintergrundprozessen wie Firewall, Treibern oder ähnliches? Ich habe alle Programme gschlossen, aber nichts "deaktiviert". Hier der Log: Code:
ATTFilter OTL logfile created on: 07.09.2012 18:51:32 - Run 2 OTL by OldTimer - Version 3.2.61.1 Folder = C:\Users\Julian\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,52 Gb Available Physical Memory | 37,99% Memory free 7,99 Gb Paging File | 5,26 Gb Available in Paging File | 65,86% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 74,43 Gb Total Space | 3,30 Gb Free Space | 4,44% Space Free | Partition Type: NTFS Drive D: | 931,51 Gb Total Space | 57,95 Gb Free Space | 6,22% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 53,84 Gb Free Space | 5,78% Space Free | Partition Type: NTFS Computer Name: SILVERSTONE | User Name: Julian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found -- PRC - [2012.09.07 18:50:49 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Julian\Desktop\OTL.exe PRC - [2012.08.17 14:43:24 | 000,413,184 | ---- | M] () -- C:\Program Files (x86)\Polar\Daemon\polard.exe PRC - [2012.07.18 12:17:47 | 000,913,888 | ---- | M] (Mozilla Corporation) -- D:\Programme\Firefox\firefox.exe PRC - [2012.07.18 12:17:46 | 000,016,864 | ---- | M] (Mozilla Corporation) -- D:\Programme\Firefox\plugin-container.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.05.25 14:19:24 | 001,540,120 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe PRC - [2012.05.24 05:23:01 | 000,985,624 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe PRC - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe PRC - [2012.03.26 09:00:48 | 000,640,440 | ---- | M] (Adobe Systems Inc.) -- D:\Programme\Adobe\Adobe Acrobat\Acrobat\acrotray.exe PRC - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2010.11.22 15:50:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\nlssrv32.exe PRC - [2010.11.04 08:26:21 | 000,274,608 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe PRC - [2010.02.16 12:10:46 | 000,308,640 | ---- | M] (Panasonic Corporation) -- C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe PRC - [2009.11.11 16:17:02 | 000,771,360 | ---- | M] (Apple Inc.) -- D:\Programme\AirPort\APAgent.exe PRC - [2009.08.19 13:56:38 | 000,090,112 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe PRC - [2009.07.23 17:14:40 | 000,086,016 | ---- | M] (Contour Design, Inc.) -- C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe PRC - [2009.07.23 17:14:30 | 000,118,784 | ---- | M] (Contour Design, Inc.) -- C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe PRC - [2009.07.17 16:25:02 | 000,319,488 | -H-- | M] (DeviceVM, Inc.) -- C:\ASUS.SYS\config\DVMExportService.exe PRC - [2009.06.04 20:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2008.07.11 15:22:56 | 000,251,184 | ---- | M] (BUFFALO INC.) -- C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe PRC - [2007.06.15 12:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\Windows\SysWOW64\bgsvcgen.exe ========== Modules (No Company Name) ========== MOD - [2012.07.18 12:17:47 | 002,003,424 | ---- | M] () -- D:\Programme\Firefox\mozjs.dll MOD - [2012.05.18 05:19:54 | 008,797,856 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe MOD - [2009.02.27 16:39:28 | 000,019,968 | ---- | M] () -- D:\Programme\Adobe\Adobe Acrobat\Acrobat\AcroTray.DEU MOD - [2009.02.27 16:32:26 | 000,020,480 | ---- | M] () -- D:\Programme\Adobe\Adobe Acrobat\Acrobat\AcroTray.FRA ========== Services (SafeList) ========== SRV:64bit: - [2008.05.08 01:29:38 | 000,122,880 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\Windows\SysNative\Crypserv.exe -- (Crypkey License) SRV - [2012.08.17 14:43:24 | 000,413,184 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Polar\Daemon\polard.exe -- (Polar Daemon) SRV - [2012.07.18 12:17:47 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.06.01 05:05:18 | 002,011,056 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe -- (AVKWCtl) SRV - [2012.05.25 14:19:24 | 001,540,120 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy) SRV - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan) SRV - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\AntiVirus\AVK\AVKService.exe -- (AVKService) SRV - [2011.05.21 07:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2010.11.22 15:50:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc) SRV - [2010.09.17 12:35:08 | 057,966,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\sqlservr.exe -- (MSSQL$TRIPLOG) SRV - [2010.09.17 12:35:08 | 000,154,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.09.17 12:33:26 | 000,430,424 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$TRIPLOG) SRV - [2010.05.01 20:11:11 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.03.22 15:51:54 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.08.19 13:56:38 | 000,090,112 | R--- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService) SRV - [2009.07.23 17:14:40 | 000,086,016 | ---- | M] (Contour Design, Inc.) [Auto | Running] -- C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe -- (ShuttleEngine) SRV - [2009.07.17 16:25:02 | 000,319,488 | -H-- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\ASUS.SYS\config\DVMExportService.exe -- (DvmMDES) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) SRV - [2008.07.11 15:22:56 | 000,251,184 | ---- | M] (BUFFALO INC.) [Auto | Running] -- C:\Program Files (x86)\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService) SRV - [2008.07.11 06:54:52 | 000,061,976 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100) SRV - [2007.06.15 12:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\Windows\SysWOW64\bgsvcgen.exe -- (bgsvcgen) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.06.01 08:26:03 | 000,065,912 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd) DRV:64bit: - [2012.05.01 09:29:13 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD) DRV:64bit: - [2012.04.24 11:48:07 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre) DRV:64bit: - [2012.04.24 11:48:05 | 000,122,744 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt) DRV:64bit: - [2012.04.24 11:48:05 | 000,054,136 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave) DRV:64bit: - [2012.04.24 11:45:16 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt) DRV:64bit: - [2011.11.29 04:28:28 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2011.08.01 16:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.07.17 13:47:07 | 000,121,432 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2011.07.17 13:46:42 | 000,069,704 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS) DRV:64bit: - [2011.07.17 13:46:32 | 000,084,808 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K) DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.05.18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) DRV:64bit: - [2011.05.10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.05.09 06:56:55 | 000,031,448 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GdNetMon64.sys -- (GdNetMon) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:09:02 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\irda.sys -- (irda) DRV:64bit: - [2009.07.10 05:07:02 | 001,222,144 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.04 19:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2008.03.18 12:03:30 | 000,346,624 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8187B.sys -- (RTL8187B) DRV:64bit: - [2008.03.17 19:12:26 | 000,028,664 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Ckldrv.sys -- (NetworkX) DRV:64bit: - [2008.01.19 06:28:36 | 000,033,792 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\irstusb.sys -- (STIrUsb) DRV:64bit: - [2007.04.23 13:15:48 | 000,031,016 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtlProt.sys -- (RtlProt) DRV:64bit: - [2006.08.25 14:36:52 | 000,039,208 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cdrbsdrv.sys -- (cdrbsdrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2006.11.14 21:26:48 | 000,015,664 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nlp-deutschland.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 17 DA 31 72 E9 CD CA 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {187F8661-AB7B-4276-93C8-25441D77E658} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{187F8661-AB7B-4276-93C8-25441D77E658}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "google.de PWS" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..extensions.enabledAddons: toolbar@seomoz.org:2.23 FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.599: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.599: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.599: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.599: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: D:\Programme\Adobe\Adobe Acrobat\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: D:\Programme\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.10.25 22:03:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.03.14 03:56:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: D:\Programme\Firefox\components [2012.07.18 12:17:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: D:\Programme\Firefox\plugins [2012.07.31 03:16:41 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{E0CC257A-4D42-4ED7-AFAF-0AE6422F60D0}: D:\Programme\Copernic Desktop Search - Home\Firefox36Connector [2010.11.03 08:51:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Extensions [2010.11.03 08:51:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.08.31 23:55:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\z1o5kx9v.default\extensions [2012.08.30 23:56:26 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\z1o5kx9v.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012.08.31 23:55:39 | 001,625,368 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\z1o5kx9v.default\extensions\firebug@software.joehewitt.com.xpi [2012.04.06 06:11:45 | 000,738,156 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\z1o5kx9v.default\extensions\toolbar@seomoz.org.xpi [2012.07.24 12:18:02 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\z1o5kx9v.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012.06.04 18:22:45 | 000,001,742 | ---- | M] () -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\z1o5kx9v.default\searchplugins\googlede-pws.xml [2011.04.21 14:51:22 | 000,002,101 | ---- | M] () -- C:\Users\Julian\AppData\Roaming\mozilla\firefox\profiles\z1o5kx9v.default\searchplugins\googlede.xml [2012.03.14 03:56:03 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5 ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = hxxp://www.google.de/search?q={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://www.google.com/ CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Julian\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll CHR - plugin: Page Speed Plugin (Enabled) = C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gplegfbjlmmehdoakndmohflojccocli\1.12.0.6_0\pagespeed_plugin_WINNT_x86-msvc.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.40.135.2_0\McChPlg.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Firefox\plugins\nppdf32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Adobe Contribute CS5 (Enabled) = D:\Programme\Firefox\plugins\npContribute.dll CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = D:\Programme\Firefox\plugins\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = D:\Programme\Firefox\plugins\NPOFF12.DLL CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = D:\Programme\Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = D:\Programme\Firefox\plugins\nprpjplug.dll CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = D:\Programme\Firefox\plugins\nprjplug.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - Extension: PageSpeed Insights (by Google) = C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gplegfbjlmmehdoakndmohflojccocli\2.0.2.0_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft) O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3:64bit: - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer64.dll (IvoSoft) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Programme\Classic Shell\ClassicExplorer32.dll (IvoSoft) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [Classic Start Menu] C:\Programme\Classic Shell\ClassicStartMenu.exe (IvoSoft) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [VIAAUD] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VIAAUD.exe File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Programme\Adobe\Adobe Acrobat\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] D:\Programme\Adobe\Adobe Acrobat\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AirPort Base Station Agent] D:\Programme\AirPort\APAgent.exe (Apple Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [Contour Shuttle Device Helper] C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe (Contour Design, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [DisplayFusion] "D:\Programme\DisplayFusion\DisplayFusion.exe" File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Julian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Mit FRITZ!Box Anrufen - Reg Error: Value error. File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8:64bit: - Extra context menu item: 使用快车3下载 - C:\Users\Julian\AppData\Roaming\FlashGetBHO\GetUrl.htm () O8:64bit: - Extra context menu item: 使用快车3下载全部链接 - C:\Users\Julian\AppData\Roaming\FlashGetBHO\GetAllUrl.htm () O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube Download - C:\Users\Julian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Mit FRITZ!Box Anrufen - Reg Error: Value error. File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: 使用快车3下载 - C:\Users\Julian\AppData\Roaming\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Users\Julian\AppData\Roaming\FlashGetBHO\GetAllUrl.htm () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet) O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites) O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet) O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung) O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 10.5.0) O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D97AACD9-A5E3-4745-9647-F4CD22EFEF4F}: NameServer = 192.168.2.0 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FEC55FE3-66C6-48C3-8A6C-C3A228221151}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (MACHINE BootExecut) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.07 18:50:47 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Users\Julian\Desktop\OTL.exe [2012.09.07 02:39:37 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\Joomla_2.5.6-Stable-Full_Package [2012.09.07 00:59:59 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Unqyok [2012.09.07 00:59:59 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Ator [2012.08.27 06:53:18 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\com_virtuemart.2.0.10_extract_first [2012.08.26 21:09:21 | 004,702,324 | ---- | C] (Polar Electro Oy ) -- C:\Users\Julian\Desktop\PolarWebLink_2.4.13.exe [2012.08.26 19:13:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Polar [2012.08.26 08:47:13 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\Shape5_shoppingbag_PSD [2012.08.16 14:46:30 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\EasyDuplicateFinder [2012.08.16 14:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyDuplicateFinder [2012.08.15 09:41:58 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\julian and friends fotos [2012.08.14 09:13:38 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\graphicriver-2461181-bronze-silver-gold-platinum-price-table-more [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.07 18:50:49 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Julian\Desktop\OTL.exe [2012.09.07 18:50:28 | 000,000,000 | ---- | M] () -- C:\Users\Julian\defogger_reenable [2012.09.07 18:49:24 | 000,050,477 | ---- | M] () -- C:\Users\Julian\Desktop\Defogger.exe [2012.09.07 18:44:44 | 000,014,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.07 18:44:44 | 000,014,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.07 18:20:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.07 14:20:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.09.07 11:07:54 | 000,789,796 | ---- | M] () -- C:\Windows\SysWow64\sig.bin [2012.09.07 11:07:54 | 000,043,821 | ---- | M] () -- C:\Windows\SysWow64\nmp.map [2012.09.07 06:11:28 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx [2012.09.07 06:01:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.07 06:01:22 | 3219,664,896 | -HS- | M] () -- C:\hiberfil.sys [2012.09.07 05:38:30 | 000,006,326 | ---- | M] () -- C:\Users\Julian\Desktop\index.html [2012.09.07 04:26:30 | 057,310,133 | ---- | M] () -- C:\Users\Julian\Desktop\ja_community_plus_joomla_2.5.zip [2012.09.07 02:39:40 | 007,872,678 | ---- | M] () -- C:\Users\Julian\Desktop\Joomla_2.5.6-Stable-Full_Package.zip [2012.09.05 13:32:07 | 114,667,008 | ---- | M] () -- C:\Users\Julian\Desktop\sandra.bak [2012.09.02 20:25:11 | 000,005,297 | ---- | M] () -- C:\Users\Julian\Desktop\julian.jpg [2012.08.31 21:54:02 | 000,001,456 | ---- | M] () -- C:\Users\Julian\AppData\Local\Adobe Für Web speichern 12.0 Prefs [2012.08.28 08:24:19 | 003,491,515 | ---- | M] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_metroshows_current.zip.part [2012.08.28 08:24:19 | 001,695,348 | ---- | M] () -- C:\Users\Julian\Desktop\Shape5_metroshows_template_current.zip.part [2012.08.28 08:22:08 | 011,548,701 | ---- | M] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_Modern_Flavor_current.zip [2012.08.28 08:22:05 | 004,390,262 | ---- | M] () -- C:\Users\Julian\Desktop\Shape5_Modern_Flavor_psds.zip [2012.08.28 08:21:59 | 000,870,835 | ---- | M] () -- C:\Users\Julian\Desktop\Shape5_Modern_Flavor_template_current.zip [2012.08.28 08:21:31 | 000,748,779 | ---- | M] () -- C:\Users\Julian\Desktop\Shape5_Corporate_Response_psds.zip [2012.08.28 08:21:29 | 011,238,799 | ---- | M] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_Corporate_Response_current.zip [2012.08.28 08:21:24 | 000,774,254 | ---- | M] () -- C:\Users\Julian\Desktop\Shape5_Corporate_Response_template_current.zip [2012.08.27 07:42:45 | 000,059,068 | ---- | M] () -- C:\Users\Julian\Desktop\com_virtuemart_sofort.2.0.1.zip [2012.08.27 02:03:39 | 001,097,017 | ---- | M] () -- C:\Users\Julian\Desktop\advancedmodulemanager-v3.2.6.zip [2012.08.26 21:09:59 | 000,001,793 | ---- | M] () -- C:\Users\Public\Desktop\Polar WebLink.lnk [2012.08.26 21:09:22 | 004,702,324 | ---- | M] (Polar Electro Oy ) -- C:\Users\Julian\Desktop\PolarWebLink_2.4.13.exe [2012.08.26 17:46:09 | 011,803,376 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.08.26 08:50:47 | 000,020,385 | ---- | M] () -- C:\Users\Julian\Desktop\oswald.zip [2012.08.24 14:40:00 | 000,203,092 | ---- | M] () -- C:\Users\Julian\Desktop\3-jahres-vergleich.pdf [2012.08.24 13:39:00 | 000,668,615 | ---- | M] () -- C:\Users\Julian\Desktop\januar_juni_2012.pdf [2012.08.24 13:23:48 | 000,040,798 | ---- | M] () -- C:\Users\Julian\Desktop\27203_102074779827474_3682304_n.jpg [2012.08.19 14:42:29 | 001,385,736 | ---- | M] () -- C:\Users\Julian\Desktop\rt_diametric-sources.zip [2012.08.18 11:50:00 | 000,709,385 | ---- | M] () -- C:\Users\Julian\Desktop\calendar-side.jpg.zip [2012.08.15 09:35:58 | 1220,553,136 | ---- | M] () -- C:\Users\Julian\Desktop\julian and friends fotos.zip [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.07 18:49:23 | 000,050,477 | ---- | C] () -- C:\Users\Julian\Desktop\Defogger.exe [2012.09.07 04:25:46 | 057,310,133 | ---- | C] () -- C:\Users\Julian\Desktop\ja_community_plus_joomla_2.5.zip [2012.09.07 03:52:43 | 000,006,326 | ---- | C] () -- C:\Users\Julian\Desktop\index.html [2012.09.07 02:39:31 | 007,872,678 | ---- | C] () -- C:\Users\Julian\Desktop\Joomla_2.5.6-Stable-Full_Package.zip [2012.09.05 13:32:04 | 114,667,008 | ---- | C] () -- C:\Users\Julian\Desktop\sandra.bak [2012.09.02 20:25:11 | 000,005,297 | ---- | C] () -- C:\Users\Julian\Desktop\julian.jpg [2012.08.28 08:22:06 | 001,695,348 | ---- | C] () -- C:\Users\Julian\Desktop\Shape5_metroshows_template_current.zip.part [2012.08.28 08:22:04 | 003,491,515 | ---- | C] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_metroshows_current.zip.part [2012.08.28 08:22:00 | 004,390,262 | ---- | C] () -- C:\Users\Julian\Desktop\Shape5_Modern_Flavor_psds.zip [2012.08.28 08:21:58 | 000,870,835 | ---- | C] () -- C:\Users\Julian\Desktop\Shape5_Modern_Flavor_template_current.zip [2012.08.28 08:21:52 | 011,548,701 | ---- | C] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_Modern_Flavor_current.zip [2012.08.28 08:21:31 | 000,748,779 | ---- | C] () -- C:\Users\Julian\Desktop\Shape5_Corporate_Response_psds.zip [2012.08.28 08:21:24 | 000,774,254 | ---- | C] () -- C:\Users\Julian\Desktop\Shape5_Corporate_Response_template_current.zip [2012.08.28 08:21:15 | 011,238,799 | ---- | C] () -- C:\Users\Julian\Desktop\SiteShaper_Shape5_Corporate_Response_current.zip [2012.08.27 07:42:44 | 000,059,068 | ---- | C] () -- C:\Users\Julian\Desktop\com_virtuemart_sofort.2.0.1.zip [2012.08.27 02:03:37 | 001,097,017 | ---- | C] () -- C:\Users\Julian\Desktop\advancedmodulemanager-v3.2.6.zip [2012.08.26 21:09:59 | 000,001,793 | ---- | C] () -- C:\Users\Public\Desktop\Polar WebLink.lnk [2012.08.26 08:50:46 | 000,020,385 | ---- | C] () -- C:\Users\Julian\Desktop\oswald.zip [2012.08.24 14:40:00 | 000,203,092 | ---- | C] () -- C:\Users\Julian\Desktop\3-jahres-vergleich.pdf [2012.08.24 13:39:00 | 000,668,615 | ---- | C] () -- C:\Users\Julian\Desktop\januar_juni_2012.pdf [2012.08.24 13:23:48 | 000,040,798 | ---- | C] () -- C:\Users\Julian\Desktop\27203_102074779827474_3682304_n.jpg [2012.08.19 14:42:29 | 001,385,736 | ---- | C] () -- C:\Users\Julian\Desktop\rt_diametric-sources.zip [2012.08.18 11:50:00 | 000,709,385 | ---- | C] () -- C:\Users\Julian\Desktop\calendar-side.jpg.zip [2012.08.15 09:23:33 | 1220,553,136 | ---- | C] () -- C:\Users\Julian\Desktop\julian and friends fotos.zip [2012.07.14 04:39:52 | 000,711,240 | ---- | C] () -- C:\Windows\is-PUNPV.exe [2012.04.04 16:54:09 | 000,007,610 | ---- | C] () -- C:\Users\Julian\AppData\Local\Resmon.ResmonCfg [2012.02.16 23:17:52 | 000,001,456 | ---- | C] () -- C:\Users\Julian\AppData\Local\Adobe Save for Web 12.0 Prefs [2012.02.15 15:19:53 | 000,000,165 | ---- | C] () -- C:\Windows\wiso.ini [2012.01.30 04:05:15 | 000,000,000 | ---- | C] () -- C:\Users\Julian\defogger_reenable [2011.11.30 08:54:58 | 000,000,132 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.11.17 18:28:42 | 000,000,132 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\Adobe GIF Format CS5 Prefs [2011.06.01 03:07:04 | 000,000,125 | ---- | C] () -- C:\Windows\FlashDecompiler.INI [2011.05.09 08:53:13 | 000,789,796 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2011.04.04 06:31:37 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.03.14 02:21:54 | 000,003,584 | ---- | C] () -- C:\Users\Julian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.01.09 22:43:22 | 000,000,295 | ---- | C] () -- C:\Windows\MindMan.INI [2010.12.15 22:11:35 | 000,000,003 | ---- | C] () -- C:\ProgramData\z156787 [2010.12.15 22:11:34 | 000,013,679 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\standard [2010.12.15 22:11:34 | 000,013,653 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\standard.bak [2010.12.15 22:11:28 | 000,000,007 | ---- | C] () -- C:\ProgramData\om [2010.12.15 22:11:25 | 000,000,045 | ---- | C] () -- C:\ProgramData\omicro.dll [2010.12.15 22:10:48 | 000,000,048 | ---- | C] () -- C:\ProgramData\zem13a45i2l [2010.12.15 22:10:26 | 000,000,025 | ---- | C] () -- C:\ProgramData\1764414 [2010.12.15 22:10:26 | 000,000,003 | ---- | C] () -- C:\ProgramData\156787 [2010.11.22 04:26:20 | 000,000,891 | ---- | C] () -- C:\Windows\SysWow64\secushr.dat [2010.11.22 04:21:51 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI [2010.11.15 18:35:41 | 000,000,600 | ---- | C] () -- C:\Users\Julian\AppData\Local\PUTTY.RND [2010.11.02 20:35:11 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI [2010.10.25 01:09:46 | 000,000,004 | ---- | C] () -- C:\Windows\vx86036.dat [2010.10.25 01:05:31 | 000,000,068 | ---- | C] () -- C:\Windows\spwdrg.INI [2010.10.25 01:05:25 | 000,000,077 | ---- | C] () -- C:\Windows\Crypkey.ini [2010.10.25 01:05:22 | 000,027,648 | R--- | C] () -- C:\Windows\Setup_ck.exe [2010.10.25 01:05:22 | 000,018,432 | ---- | C] () -- C:\Windows\Setup_ck.dll [2010.10.25 01:05:22 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe [2010.10.19 07:01:27 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2010.09.26 05:05:39 | 000,000,600 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\winscp.rnd [2010.09.21 04:59:30 | 000,000,132 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\Adobe PNG Format CS5 Prefs [2010.08.04 19:02:52 | 000,001,456 | ---- | C] () -- C:\Users\Julian\AppData\Local\Adobe Für Web speichern 12.0 Prefs [2010.03.30 04:30:59 | 000,409,966 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\farm.bmp [2010.03.30 04:25:25 | 000,018,363 | ---- | C] () -- C:\Users\Julian\AppData\Roaming\settings.dat ========== LOP Check ========== [2010.03.28 03:51:38 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Artisteer [2012.09.07 01:02:55 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Ator [2010.11.22 04:26:12 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\BITS [2012.02.15 15:17:23 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Buhl Data Service [2010.08.02 23:13:24 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.06.25 19:24:09 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Copernic [2011.12.12 01:13:46 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\DAEMON Tools Lite [2011.04.04 06:24:18 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Digiarty [2010.03.28 21:40:59 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\DigitalJuice [2010.06.30 16:14:58 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\DisplayFusion [2011.03.09 18:18:08 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\DVDVideoSoftIEHelpers [2011.08.26 08:13:47 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Easy Duplicate Finder [2012.08.16 14:46:30 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\EasyDuplicateFinder [2010.07.18 23:29:31 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\EditPlus 3 [2011.09.13 11:11:39 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Encryptomatic, LLC [2012.09.07 11:26:02 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\FileZilla [2011.01.10 05:35:17 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\FlashGet [2010.11.22 04:21:43 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\FlashGetBHO [2012.02.14 00:41:14 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\FRITZ! [2011.09.09 02:46:06 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\GrabPro [2010.09.07 01:46:36 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\HD Tune Pro [2010.07.01 21:45:22 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Itsth [2012.07.26 18:12:03 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\KastorFreeVimeoDownloader [2011.04.24 21:22:11 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Leadertech [2012.07.26 18:20:04 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\MediaProSoft Free YouTube to FLV Converter [2011.09.13 11:11:51 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\MessageViewer [2010.09.07 00:12:34 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\NASNaviator2 [2011.03.24 17:50:51 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Opus [2011.09.13 03:23:27 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Orbit [2010.08.02 16:41:57 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\PACE Anti-Piracy [2011.09.09 02:46:09 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\ProgSense [2010.03.27 23:16:44 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Publish Providers [2010.04.01 04:33:32 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Serif [2010.10.12 03:55:09 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Sierra Entertainment [2011.01.30 10:32:45 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Sincell [2011.08.18 01:53:42 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Sony [2010.04.14 17:53:09 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Sony Creative Software [2011.03.08 19:15:46 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Sony Creative Software Inc [2010.09.18 20:49:00 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\SorensonMedia [2010.10.04 13:56:48 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.08.24 16:15:36 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\TeamViewer [2010.11.03 08:51:43 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Thunderbird [2011.09.09 06:22:57 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Unity [2012.09.07 01:02:42 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Unqyok [2011.06.29 15:32:23 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\YCanPDF [2010.04.01 07:43:11 | 000,000,214 | ---- | M] () -- C:\Windows\Tasks\CreateChoiceProcessTask.job [2012.07.23 09:42:34 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 452 bytes -> C:\Users\Julian\Desktop\seminaranmeldung.ppp:SummaryInformation @Alternate Data Stream - 448 bytes -> C:\Users\Julian\Desktop\Namensschilder.ppp:SummaryInformation @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:4FF9FD44 @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DED17083 @Alternate Data Stream - 1173 bytes -> C:\Program Files\Common Files\System:RkiiH9tguVdpsjvqSTJA4GO @Alternate Data Stream - 1095 bytes -> C:\ProgramData\Microsoft:ZJG8wqVt0uDYTZve9O @Alternate Data Stream - 1073 bytes -> C:\ProgramData\Microsoft:7HJeLU7DD79D6Ymr79FdLleG < End of report > So, ich hoffe, ich habe kurz und knackig alle wichtigen Infso zusammenstellen können. ;-) Alles Liebe, Julian! |
|
11.09.2012, 08:00
| #2 |
| /// the machine /// TB-Ausbilder    | Zugriff auf Filezilla ... wohl über einen Trojaner Hi,
__________________Sorry für die Verspätung, brauchst Du noch Hilfe?
__________________ |
|
11.09.2012, 08:10
| #3 |
| | Zugriff auf Filezilla ... wohl über einen Trojaner Hi Schrauber,
__________________kein Problem, wollte auch nicht "stören" und nachfragen. Im Kern habe ich ziemlich viel getestet, aber nicht alles, und ich weiß nicht so recht, ob ich mich "sicher fühlen kann". Den einzigen Trojaner, den Malwarebytes gefunden hat, war der Trojan.ZbotR.Gen, und über den habe ich zwei Dinge gehört: 1. Er zielt auf Bankdaten 2. Er fummelt nicht-nachvollziebhar am Betriebssystem rum Bei mir sind alle Bankdaten allerdings unangetastet geblieben, auch Paypal, nur FileZilla wurde "ausgeräumt". Ich bin mir daher nicht sicher, ob es der Trojaner war, ob er noch was hinterlassen hat oder ob es ggf. sogar was anderes war. Was meinst Du? Sollte ich noch was checken? Alles Liebe, Julian! ------------------------------------ Korrektur: Eine Meldung gab es noch einmal: GData hat was gefunden. Datei C:\Users\Julian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\1d089eaf-6cf7e35d Virus Java:Agent-BTH[Trj] (Engine B) GData hat den im Leerlaufscan gefunden, zu der Zeit hatte ich aber in der Reinigungsaktion Java schon deinstalliert. Alles Liebe, Julian! |
|
11.09.2012, 08:15
| #4 |
| /// the machine /// TB-Ausbilder | Zugriff auf Filezilla ... wohl über einen Trojaner Dann schauen wir mal tiefer 
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!(ausführliche Anleitung -> Ein Leitfaden und Tutorium zur Nutzung von ComboFix)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.09.2012, 09:42
| #5 |
| | Zugriff auf Filezilla ... wohl über einen Trojaner Also ... kurze Zwischenfrage. Combofix rödelt jetzt seit über einer Stunde an "Stufe_7". Ein Problem hatte ich schon beim Start: GData lässt sich nicht komplett abschlaten. Der "Wächter" ist auszuschalten, aber sobald ich ComboFix gestartet habe sind dennoch verschiedene Warnungen hochgepoppt wegen "potentiell bösartiger Programme". Die habe ich mit der Option "Immmer Zulassen" weggeklickt. Anders ging es nicht: Nicht einmal im Task-Manager lässt sich GData terminieren, da heißt es dannn "Zugriff verweigert". Als es losging hat Combofix die Stufen 1 bis 6a recht zeitig durchgezogen, und seit nun einer Stunde steht es bei "Stufe 7". Allerdings fasse ich nichts an, gucke nicht einmal nach der Systemauslastung, daher weiß ich nicht, ob das Programm überhaupt noch läuft. (diese Nachricht schreibe ich von einem anderen Rechner) Soll ich einfach weiter abwarten? Anfänglich hieß es, ComboFix braucht ca 10 Minuten und das kann sich bei stark infizierten Rechnern locker verdoppelt. Aber 60 Minuten ist halt etwas mehr als verdoppelt. ;-) Alles Liebe, Julian! |
|
11.09.2012, 09:50
| #6 |
| /// the machine /// TB-Ausbilder | Zugriff auf Filezilla ... wohl über einen Trojaner nur leicht mehr als doppelt  warte noch 20 minuten, und dann schau mal in den taskmanager. wenn sich nichts regt cf abschiessen und nochmal im abgesicherten modus versuchen.
__________________ --> Zugriff auf Filezilla ... wohl über einen Trojaner |
|
11.09.2012, 10:10
| #7 |
| | Zugriff auf Filezilla ... wohl über einen Trojaner Okay, das war dann wohl wegen GData. Im Abgesicherten Modus war auch GData aus und CF lief in Rekordzeit durch. Hier der Log: Code:
ATTFilter ComboFix 12-09-10.04 - Julian 11.09.2012 10:57:34.2.8 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8190.7340 [GMT 2:00]
ausgeführt von:: c:\users\Julian\Desktop\ComboFix.exe
AV: G Data AntiVirus 2013 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
SP: G Data AntiVirus 2013 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 192 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\156787
c:\programdata\1764414
c:\programdata\omicro.dll
c:\users\Julian\AppData\Local\Microsoft\Windows\Temporary Internet Files\eportoZip
c:\users\Julian\AppData\Local\Microsoft\Windows\Temporary Internet Files\pplCsv.txt
c:\users\Julian\AppData\Local\Microsoft\Windows\Temporary Internet Files\tempCsv.txt
c:\windows\IsUn0407.exe
c:\windows\SysWow64\tmp9894.tmp
c:\windows\SysWow64\tmp98C4.tmp
c:\windows\XSxS
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-11 bis 2012-09-11 ))))))))))))))))))))))))))))))
.
.
2012-09-11 09:00 . 2012-09-11 09:00 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-09-11 09:00 . 2012-09-11 09:00 -------- d-----w- c:\users\Julian\AppData\Local\temp
2012-09-11 09:00 . 2012-09-11 09:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-11 00:12 . 2011-09-22 19:06 109416 ----a-w- c:\windows\system32\perf-MSSQL$TRIPLOG-sqlctr10.3.5500.0.dll
2012-09-11 00:12 . 2011-09-22 15:18 73064 ----a-w- c:\windows\SysWow64\perf-MSSQL$TRIPLOG-sqlctr10.3.5500.0.dll
2012-09-10 23:41 . 2012-09-10 23:41 -------- d-----w- c:\program files\Microsoft Silverlight
2012-09-10 23:41 . 2012-09-10 23:41 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2012-09-10 23:12 . 2012-09-10 23:12 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2012-09-10 23:12 . 2012-09-10 23:12 -------- d-----w- c:\program files\Microsoft.NET
2012-09-10 02:04 . 2011-12-06 10:26 14760 ----a-w- c:\windows\SysWow64\drivers\DRHMSR64.sys
2012-09-10 02:04 . 2011-12-06 10:26 14760 ----a-w- c:\windows\system32\drivers\DRHMSR64.sys
2012-09-10 02:04 . 2011-11-03 17:05 21984 ----a-w- c:\windows\SysWow64\drivers\DRHARD64.sys
2012-09-10 01:16 . 2009-08-19 21:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2012-09-10 00:24 . 2012-09-10 00:24 -------- d-----w- c:\program files (x86)\Microsoft
2012-09-10 00:22 . 2012-08-27 23:49 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E85C167-C499-4722-9572-E2F532532CEC}\mpengine.dll
2012-09-10 00:08 . 2012-06-29 03:45 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-09-10 00:08 . 2012-06-29 03:44 816640 ----a-w- c:\windows\system32\jscript.dll
2012-09-10 00:08 . 2012-06-29 00:16 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-09-10 00:08 . 2012-06-29 03:51 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-09-10 00:08 . 2012-06-29 03:50 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-09-10 00:08 . 2012-06-29 00:10 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-09-10 00:08 . 2012-06-29 00:10 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-09-10 00:08 . 2012-06-29 04:55 17809920 ----a-w- c:\windows\system32\mshtml.dll
2012-09-10 00:08 . 2012-06-29 04:09 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-09-09 23:59 . 2012-09-09 23:59 -------- d-----w- c:\users\Julian\AppData\Local\Macromedia
2012-09-09 00:04 . 2012-09-09 00:04 -------- d-----r- C:\Sandbox
2012-09-08 23:55 . 2012-09-08 23:55 -------- d-----w- c:\program files\Microsoft Device Center
2012-09-08 23:53 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-08 23:53 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-09-08 23:53 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-09-08 23:53 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-09-08 23:53 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-09-08 23:53 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-09-08 23:53 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-09-08 23:43 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-09-08 23:43 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-09-06 22:59 . 2012-09-06 23:02 -------- d-----w- c:\users\Julian\AppData\Roaming\Ator
2012-09-06 22:59 . 2012-09-06 23:02 -------- d-----w- c:\users\Julian\AppData\Roaming\Unqyok
2012-08-26 17:13 . 2012-08-26 17:13 -------- d-----w- c:\program files (x86)\Polar
2012-08-16 12:46 . 2012-08-16 12:46 -------- d-----w- c:\users\Julian\AppData\Roaming\EasyDuplicateFinder
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-08 23:48 . 2012-05-18 03:19 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-08 23:48 . 2011-11-22 18:32 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-03 02:27 . 2010-04-01 05:05 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-07-30 16:11 . 2012-07-30 16:11 16504 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2012-07-14 02:40 . 2012-07-14 02:39 711240 ----a-w- c:\windows\is-PUNPV.exe
2012-07-05 20:06 . 2012-07-30 22:21 772544 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-07-05 20:06 . 2010-09-23 04:18 687544 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-07-03 11:46 . 2011-08-19 02:20 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-26 19:38 . 2012-06-26 19:38 827728 ----a-w- c:\windows\system32\msvcr100.dll
2012-06-26 19:38 . 2012-06-26 19:38 770384 ----a-w- c:\windows\SysWow64\msvcr100.dll
2012-06-26 19:38 . 2012-06-26 19:38 607568 ----a-w- c:\windows\system32\msvcp100.dll
2012-06-26 19:38 . 2012-06-26 19:38 46176 ----a-w- c:\windows\system32\drivers\point64.sys
2012-06-26 19:38 . 2012-06-26 19:38 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2012-06-24 20:24 . 2012-06-24 20:24 52320 ----a-w- c:\windows\system32\drivers\dc3d.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 05:15 316416 ----a-w- c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="d:\programme\Sandboxie\SbieCtrl.exe" [2012-08-25 765200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-01-18 2787840]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2009-07-23 118784]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe Acrobat Speed Launcher"="d:\programme\Adobe\Adobe Acrobat\Acrobat\Acrobat_sl.exe" [2012-07-31 41944]
"Acrobat Assistant 8.0"="d:\programme\Adobe\Adobe Acrobat\Acrobat\Acrotray.exe" [2012-07-30 640480]
"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe" [2012-05-24 985624]
"AirPort Base Station Agent"="d:\programme\AirPort\APAgent.exe" [2009-11-11 771360]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="d:\programme\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"Malwarebytes' Anti-Malware"="d:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HD Writer.lnk - c:\program files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2010-9-26 308640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2012-04-24 122744]
R1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2012-06-01 65912]
R1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2012-05-01 106648]
R1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2012-04-24 64376]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-08-19 90112]
R2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-05-25 1540120]
R2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\AntiVirus\AVK\AVKService.exe [2012-01-27 468472]
R2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [2012-06-01 2011056]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 DRHARD64;DRHARD64;c:\windows\system32\drivers\DRHARD64.sys [2011-11-03 21984]
R2 DRHMSR64;DRHMSR64;c:\windows\system32\drivers\DRHMSR64.sys [2011-12-06 14760]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-07-17 319488]
R2 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 136176]
R2 MBAMService;MBAMService;d:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]
R2 MSSQL$JTLWAWI;SQL Server (JTLWAWI);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R2 MSSQL$TRIPLOG;SQL Server (TRIPLOG);c:\program files\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\sqlservr.exe [2011-09-22 58345832]
R2 NasPmService;NAS PM Service;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe [2008-07-11 251184]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE [2010-11-22 66560]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
R2 Polar Daemon;Polar Daemon;c:\program files (x86)\Polar\Daemon\polard.exe [2012-08-17 413184]
R2 RealtekUSB;RealtekUSB;c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-08 250568]
R3 DRHARD;DRHARD;c:\windows\system32\DRIVERS\DRHARD.SYS [x]
R3 GdNetMon;G Data Network Monitor;c:\windows\system32\drivers\GdNetMon64.sys [2011-05-09 31448]
R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2012-04-24 59768]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 136176]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-07 114144]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2008-03-18 346624]
R3 RtlProt;RtlProt;c:\windows\System32\Drivers\RtlProt.sys [2007-04-23 31016]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-10 1222144]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 61976]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [2011-09-22 311144]
R4 SQLAgent$TRIPLOG;SQL Server Agent (TRIPLOG);c:\program files\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 431464]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2012-04-24 54136]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-29 55856]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-06-24 52320]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2012-06-26 46176]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 23:48]
.
2012-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 22:33]
.
2012-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 22:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 05:15 378368 ----a-w- c:\program files\Classic Shell\ClassicExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2010-07-29 98304]
"IntelliType Pro"="c:\program files\Microsoft Device Center\itype.exe" [2012-06-26 1464928]
"IntelliPoint"="c:\program files\Microsoft Device Center\ipoint.exe" [2012-06-26 2004584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.nlp-deutschland.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\users\Julian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Mit FRITZ!Box Anrufen
IE: Mit FRITZ!Box Anrufen\Flags
IE: Nach Microsoft E&xel exportieren - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: ????3?? - c:\users\Julian\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Julian\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
Trusted Zone: kuaiche.com\software
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{D97AACD9-A5E3-4745-9647-F4CD22EFEF4F}: NameServer = 192.168.2.0
TCP: Interfaces\{FEC55FE3-66C6-48C3-8A6C-C3A228221151}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\z1o5kx9v.default\
FF - prefs.js: browser.search.selectedEngine - google.de PWS
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
------- Dateityp-Verknüpfung -------
.
txtfile="d:\programme\PSPad editor\PSPad.exe" "%1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-DisplayFusion - d:\programme\DisplayFusion\DisplayFusion.exe
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
HKLM_Wow6432Node-ActiveSetup-{71504FB8-F84D-4B63-A97F-D6D5F0F0F410} - msiexec
HKLM-Run-VIAAUD - c:\program files (x86)\VIA\VIAudioi\VDeck\VIAAUD.exe
AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\programdata\{A6DB2A6F-FF9D-453F-99D6-C1AA54BC0C14}\Service Center Setup PC.exe
AddRemove-{43E7798A-248E-4A3D-9969-FEA63543A462} - c:\programdata\{304AB988-6BC6-4931-931E-B5F92022F387}\Kontakt 4 Setup PC.exe
AddRemove-{B0FC9E28-1CE6-4A40-BEF1-C6E6EDFCA070} - c:\programdata\{47960B9E-9E4E-438D-AA0C-2F495913AD7E}\Kontakt Factory Selection Setup PC.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*
N}]
@="c:\\Users\\Julian\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*
N}hQèþ”¥c]
@="c:\\Users\\Julian\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{24E7365A-D829-08B1-CDB0-4DFC65F13BB0}*]
"ladgjnigkpgpcohjelkmdlcl"=hex:64,62,6c,65,6f,6e,6c,68,64,69,64,70,64,69,6b,67,
67,6b,63,69,68,67,64,6f,62,62,69,63,65,61,63,69,63,66,64,69,64,6b,6d,6e,00,\
"gadgjnigacegdn"=hex:69,61,63,68,63,61,63,68,68,6c,63,65,62,6d,6e,6f,64,66,00,
00
"hadgjnigacngnaem"=hex:64,61,64,6b,6a,62,63,67,00,fe
"cbdgjnighaaihojjaeiiobplnjlfimncnpbong"=hex:6d,61,66,68,6c,68,64,6a,61,6c,6c,
67,6e,66,64,6c,61,65,61,70,6d,6e,6b,6f,6f,69,00,80
"madgjnighaaihofiggmigmnjkk"=hex:67,61,6a,66,70,67,64,6f,68,6e,70,66,65,6a,00,
77
"oadgjnighaaihoiimddjbmiajodaig"=hex:69,61,65,67,69,61,66,62,65,70,6a,70,70,61,
62,6d,6f,69,00,00
"madgjnigkpgpcohjafgcanknce"=hex:6c,61,6f,6a,66,64,65,63,6e,6a,66,6b,62,68,65,
61,6a,69,6a,62,69,66,62,67,00,00
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C519E2AB-7C9A-1CC3-BC70-9EC171E89A87}*]
"magfglolbemkenojipaajdimjd"=hex:6c,61,6a,65,6d,69,63,6b,61,61,66,70,63,6d,69,
63,6d,61,6b,63,68,65,64,6a,00,00
"lagfglolbemkenojeaeompak"=hex:64,62,6f,64,67,65,69,6a,6e,6a,64,66,70,6c,6a,66,
66,65,62,6d,67,6e,68,62,65,6f,68,6b,66,61,6e,6b,6d,69,64,67,65,62,65,64,00,\
"gagfgloldkghjj"=hex:69,61,6e,6b,64,70,6c,64,70,61,70,61,6a,6b,65,6e,67,6c,00,
00
"hagfgloldkjgnnfb"=hex:64,61,67,62,66,68,6a,61,00,fe
"cbgfglolocfagmfemgjpphbibifponjpebbhlp"=hex:6d,61,65,6b,62,66,70,63,63,61,61,
67,68,6c,6a,66,70,70,68,6c,67,6b,6b,70,66,6c,00,80
"magfglolocfagmbfoafklabplk"=hex:67,61,69,65,6f,69,61,61,6f,66,6f,67,66,6c,00,
77
"oagfglolocfagmifebmfkgoimkeedd"=hex:69,61,64,66,6e,6f,61,62,6e,6c,6c,6c,6a,68,
68,62,62,69,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:7a,da,d8,37,41,8d,a9,ca,a2,90,38,5d,93,8f,ec,c2,bf,e3,ba,55,42,
dd,7e,c5,1d,01,75,7a,93,19,6a,aa,c5,54,06,10,a7,9a,9f,ef,56,0f,62,a9,85,61,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:7a,da,d8,37,41,8d,a9,ca,a2,90,38,5d,93,8f,ec,c2,bf,e3,ba,55,42,
dd,7e,c5,1d,01,75,7a,93,19,6a,aa,c5,54,06,10,a7,9a,9f,ef,56,0f,62,a9,85,61,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-09-11 11:02:13
ComboFix-quarantined-files.txt 2012-09-11 09:02
.
Vor Suchlauf: 3.383.115.776 Bytes frei
Nach Suchlauf: 7.470.571.520 Bytes frei
.
- - End Of File - - 439A655241475C2A349C6D20A28D5948
|
|
11.09.2012, 10:54
| #8 | |
| /// the machine /// TB-Ausbilder | Zugriff auf Filezilla ... wohl über einen Trojaner hi, Scripten mit Combofix
Zitat:
Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann Malwarebytes updaten, quick scan laufen lassen, bitte das log posten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.09.2012, 11:37
| #9 |
| | Zugriff auf Filezilla ... wohl über einen Trojaner Hi Schrauber, die TXT-Datei ist kein Problem gewesen. Neustart, Abgesicherter Modus, TXT draufgeschoben. 1. CF startet von alleine, wenn ich die Datei draufziehe. Ich nehme an, ich sollte es dann nicht NOCHMAL starten, richtig? 2. CF Meldet, daß GData noch aktiv wäre, udn warnt doppelt vor dem weitermachen. Da GData nicht "zu sehen" war habe ich es einfach dennoch durchgezogen. Noch funktioniert alles. ;-) Combofix Logfile: Code:
ATTFilter ComboFix 12-09-10.04 - Julian 11.09.2012 12:17:25.3.8 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8190.7362 [GMT 2:00]
ausgeführt von:: c:\users\Julian\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Julian\Desktop\cfscript.txt
AV: G Data AntiVirus 2013 *Enabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
SP: G Data AntiVirus 2013 *Enabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Julian\AppData\Roaming\Ator
c:\users\Julian\AppData\Roaming\Unqyok
c:\users\Julian\AppData\Roaming\Unqyok\aczo.mag
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-11 bis 2012-09-11 ))))))))))))))))))))))))))))))
.
.
2012-09-11 10:20 . 2012-09-11 10:20 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-09-11 10:20 . 2012-09-11 10:20 -------- d-----w- c:\users\Julian\AppData\Local\temp
2012-09-11 10:20 . 2012-09-11 10:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-11 00:12 . 2011-09-22 19:06 109416 ----a-w- c:\windows\system32\perf-MSSQL$TRIPLOG-sqlctr10.3.5500.0.dll
2012-09-11 00:12 . 2011-09-22 15:18 73064 ----a-w- c:\windows\SysWow64\perf-MSSQL$TRIPLOG-sqlctr10.3.5500.0.dll
2012-09-10 23:41 . 2012-09-10 23:41 -------- d-----w- c:\program files\Microsoft Silverlight
2012-09-10 23:41 . 2012-09-10 23:41 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2012-09-10 23:12 . 2012-09-10 23:12 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
2012-09-10 23:12 . 2012-09-10 23:12 -------- d-----w- c:\program files\Microsoft.NET
2012-09-10 02:04 . 2011-12-06 10:26 14760 ----a-w- c:\windows\SysWow64\drivers\DRHMSR64.sys
2012-09-10 02:04 . 2011-12-06 10:26 14760 ----a-w- c:\windows\system32\drivers\DRHMSR64.sys
2012-09-10 02:04 . 2011-11-03 17:05 21984 ----a-w- c:\windows\SysWow64\drivers\DRHARD64.sys
2012-09-10 01:16 . 2009-08-19 21:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2012-09-10 00:24 . 2012-09-10 00:24 -------- d-----w- c:\program files (x86)\Microsoft
2012-09-10 00:22 . 2012-08-27 23:49 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E85C167-C499-4722-9572-E2F532532CEC}\mpengine.dll
2012-09-10 00:08 . 2012-06-29 03:45 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-09-10 00:08 . 2012-06-29 03:44 816640 ----a-w- c:\windows\system32\jscript.dll
2012-09-10 00:08 . 2012-06-29 00:16 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-09-10 00:08 . 2012-06-29 03:51 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-09-10 00:08 . 2012-06-29 03:50 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-09-10 00:08 . 2012-06-29 00:10 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-09-10 00:08 . 2012-06-29 00:10 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-09-10 00:08 . 2012-06-29 04:55 17809920 ----a-w- c:\windows\system32\mshtml.dll
2012-09-10 00:08 . 2012-06-29 04:09 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-09-09 23:59 . 2012-09-09 23:59 -------- d-----w- c:\users\Julian\AppData\Local\Macromedia
2012-09-09 00:04 . 2012-09-09 00:04 -------- d-----r- C:\Sandbox
2012-09-08 23:55 . 2012-09-08 23:55 -------- d-----w- c:\program files\Microsoft Device Center
2012-09-08 23:53 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-08 23:53 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-09-08 23:53 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-09-08 23:53 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-09-08 23:53 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-09-08 23:53 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-09-08 23:53 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-09-08 23:43 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-09-08 23:43 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-08-26 17:13 . 2012-08-26 17:13 -------- d-----w- c:\program files (x86)\Polar
2012-08-16 12:46 . 2012-08-16 12:46 -------- d-----w- c:\users\Julian\AppData\Roaming\EasyDuplicateFinder
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-08 23:48 . 2012-05-18 03:19 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-08 23:48 . 2011-11-22 18:32 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-03 02:27 . 2010-04-01 05:05 62134624 ----a-w- c:\windows\system32\MRT.exe
2012-07-30 16:11 . 2012-07-30 16:11 16504 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2012-07-14 02:40 . 2012-07-14 02:39 711240 ----a-w- c:\windows\is-PUNPV.exe
2012-07-05 20:06 . 2012-07-30 22:21 772544 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-07-05 20:06 . 2010-09-23 04:18 687544 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-07-03 11:46 . 2011-08-19 02:20 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-26 19:38 . 2012-06-26 19:38 827728 ----a-w- c:\windows\system32\msvcr100.dll
2012-06-26 19:38 . 2012-06-26 19:38 770384 ----a-w- c:\windows\SysWow64\msvcr100.dll
2012-06-26 19:38 . 2012-06-26 19:38 607568 ----a-w- c:\windows\system32\msvcp100.dll
2012-06-26 19:38 . 2012-06-26 19:38 46176 ----a-w- c:\windows\system32\drivers\point64.sys
2012-06-26 19:38 . 2012-06-26 19:38 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2012-06-24 20:24 . 2012-06-24 20:24 52320 ----a-w- c:\windows\system32\drivers\dc3d.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-09-11_09.00.53 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-09-11 07:06 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-09-11 10:09 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-09-11 07:06 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-11 10:09 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-11 07:06 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-11 10:09 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2012-09-11 10:07 45458 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-27 11:52 . 2012-09-11 10:07 22024 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2012717551-1950593539-2622157764-1000_UserData.bin
+ 2010-03-27 11:30 . 2012-09-11 09:16 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-27 11:30 . 2012-09-11 07:59 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-27 11:30 . 2012-09-11 09:16 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-27 11:30 . 2012-09-11 07:59 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-09-11 09:16 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-09-11 07:59 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-09-11 10:15 . 2012-09-11 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-09-11 07:32 . 2012-09-11 08:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-09-11 07:32 . 2012-09-11 08:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-09-11 10:15 . 2012-09-11 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-05-09 06:53 . 2012-09-11 09:09 791832 c:\windows\SysWOW64\sig.bin
+ 2011-05-23 09:53 . 2012-09-11 10:09 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2011-05-23 09:53 . 2012-09-11 07:06 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-03-27 11:56 . 2012-09-11 10:07 108692 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:01 . 2012-09-11 07:31 707960 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-09-11 10:11 707960 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-03-29 21:05 . 2012-09-11 10:11 5388916 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2012717551-1950593539-2622157764-1000-12288.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 05:15 316416 ----a-w- c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="d:\programme\Sandboxie\SbieCtrl.exe" [2012-08-25 765200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-01-18 2787840]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2009-07-23 118784]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe Acrobat Speed Launcher"="d:\programme\Adobe\Adobe Acrobat\Acrobat\Acrobat_sl.exe" [2012-07-31 41944]
"Acrobat Assistant 8.0"="d:\programme\Adobe\Adobe Acrobat\Acrobat\Acrotray.exe" [2012-07-30 640480]
"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\AntiVirus\AVKTray\AVKTray.exe" [2012-05-24 985624]
"AirPort Base Station Agent"="d:\programme\AirPort\APAgent.exe" [2009-11-11 771360]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="d:\programme\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"Malwarebytes' Anti-Malware"="d:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HD Writer.lnk - c:\program files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2010-9-26 308640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2012-04-24 122744]
R1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2012-06-01 65912]
R1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2012-05-01 106648]
R1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2012-04-24 64376]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-08-19 90112]
R2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-05-25 1540120]
R2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\AntiVirus\AVK\AVKService.exe [2012-01-27 468472]
R2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\AntiVirus\AVK\AVKWCtlX64.exe [2012-06-01 2011056]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 DRHARD64;DRHARD64;c:\windows\system32\drivers\DRHARD64.sys [2011-11-03 21984]
R2 DRHMSR64;DRHMSR64;c:\windows\system32\drivers\DRHMSR64.sys [2011-12-06 14760]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-07-17 319488]
R2 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 136176]
R2 MBAMService;MBAMService;d:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]
R2 MSSQL$JTLWAWI;SQL Server (JTLWAWI);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R2 MSSQL$TRIPLOG;SQL Server (TRIPLOG);c:\program files\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\sqlservr.exe [2011-09-22 58345832]
R2 NasPmService;NAS PM Service;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe [2008-07-11 251184]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE [2010-11-22 66560]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
R2 Polar Daemon;Polar Daemon;c:\program files (x86)\Polar\Daemon\polard.exe [2012-08-17 413184]
R2 RealtekUSB;RealtekUSB;c:\program files (x86)\Realtek\RTL8187B Wireless LAN Utility\RtlService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-08 250568]
R3 DRHARD;DRHARD;c:\windows\system32\DRIVERS\DRHARD.SYS [x]
R3 GdNetMon;G Data Network Monitor;c:\windows\system32\drivers\GdNetMon64.sys [2011-05-09 31448]
R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2012-04-24 59768]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 136176]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-07 114144]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2008-03-18 346624]
R3 RtlProt;RtlProt;c:\windows\System32\Drivers\RtlProt.sys [2007-04-23 31016]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-10 1222144]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-11 61976]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [2011-09-22 311144]
R4 SQLAgent$TRIPLOG;SQL Server Agent (TRIPLOG);c:\program files\Microsoft SQL Server\MSSQL10.TRIPLOG\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 431464]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2012-04-24 54136]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-29 55856]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-06-24 52320]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2012-06-26 46176]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 23:48]
.
2012-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 22:33]
.
2012-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-20 22:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 05:15 378368 ----a-w- c:\program files\Classic Shell\ClassicExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"VIAAUD"="c:\program files (x86)\VIA\VIAudioi\VDeck\VIAAUD.exe" [BU]
"Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2010-07-29 98304]
"IntelliType Pro"="c:\program files\Microsoft Device Center\itype.exe" [2012-06-26 1464928]
"IntelliPoint"="c:\program files\Microsoft Device Center\ipoint.exe" [2012-06-26 2004584]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.nlp-deutschland.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\users\Julian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Mit FRITZ!Box Anrufen
IE: Mit FRITZ!Box Anrufen\Flags
IE: Nach Microsoft E&xel exportieren - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: ????3?? - c:\users\Julian\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: ????3?????? - c:\users\Julian\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
Trusted Zone: kuaiche.com\software
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{D97AACD9-A5E3-4745-9647-F4CD22EFEF4F}: NameServer = 192.168.2.0
TCP: Interfaces\{FEC55FE3-66C6-48C3-8A6C-C3A228221151}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\z1o5kx9v.default\
FF - prefs.js: browser.search.selectedEngine - google.de PWS
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*
N}]
@="c:\\Users\\Julian\\AppData\\Roaming\\FlashGetBHO\\GetUrl.htm"
"contexts"=dword:00000022
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Internet Explorer\MenuExt\O(uë_f3*
N}hQèþ”¥c]
@="c:\\Users\\Julian\\AppData\\Roaming\\FlashGetBHO\\GetAllUrl.htm"
"contexts"=dword:000000f3
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{24E7365A-D829-08B1-CDB0-4DFC65F13BB0}*]
"ladgjnigkpgpcohjelkmdlcl"=hex:64,62,6c,65,6f,6e,6c,68,64,69,64,70,64,69,6b,67,
67,6b,63,69,68,67,64,6f,62,62,69,63,65,61,63,69,63,66,64,69,64,6b,6d,6e,00,\
"gadgjnigacegdn"=hex:69,61,63,68,63,61,63,68,68,6c,63,65,62,6d,6e,6f,64,66,00,
00
"hadgjnigacngnaem"=hex:64,61,64,6b,6a,62,63,67,00,fe
"cbdgjnighaaihojjaeiiobplnjlfimncnpbong"=hex:6d,61,66,68,6c,68,64,6a,61,6c,6c,
67,6e,66,64,6c,61,65,61,70,6d,6e,6b,6f,6f,69,00,80
"madgjnighaaihofiggmigmnjkk"=hex:67,61,6a,66,70,67,64,6f,68,6e,70,66,65,6a,00,
77
"oadgjnighaaihoiimddjbmiajodaig"=hex:69,61,65,67,69,61,66,62,65,70,6a,70,70,61,
62,6d,6f,69,00,00
"madgjnigkpgpcohjafgcanknce"=hex:6c,61,6f,6a,66,64,65,63,6e,6a,66,6b,62,68,65,
61,6a,69,6a,62,69,66,62,67,00,00
.
[HKEY_USERS\S-1-5-21-2012717551-1950593539-2622157764-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C519E2AB-7C9A-1CC3-BC70-9EC171E89A87}*]
"magfglolbemkenojipaajdimjd"=hex:6c,61,6a,65,6d,69,63,6b,61,61,66,70,63,6d,69,
63,6d,61,6b,63,68,65,64,6a,00,00
"lagfglolbemkenojeaeompak"=hex:64,62,6f,64,67,65,69,6a,6e,6a,64,66,70,6c,6a,66,
66,65,62,6d,67,6e,68,62,65,6f,68,6b,66,61,6e,6b,6d,69,64,67,65,62,65,64,00,\
"gagfgloldkghjj"=hex:69,61,6e,6b,64,70,6c,64,70,61,70,61,6a,6b,65,6e,67,6c,00,
00
"hagfgloldkjgnnfb"=hex:64,61,67,62,66,68,6a,61,00,fe
"cbgfglolocfagmfemgjpphbibifponjpebbhlp"=hex:6d,61,65,6b,62,66,70,63,63,61,61,
67,68,6c,6a,66,70,70,68,6c,67,6b,6b,70,66,6c,00,80
"magfglolocfagmbfoafklabplk"=hex:67,61,69,65,6f,69,61,61,6f,66,6f,67,66,6c,00,
77
"oagfglolocfagmifebmfkgoimkeedd"=hex:69,61,64,66,6e,6f,61,62,6e,6c,6c,6c,6a,68,
68,62,62,69,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:7a,da,d8,37,41,8d,a9,ca,a2,90,38,5d,93,8f,ec,c2,bf,e3,ba,55,42,
dd,7e,c5,1d,01,75,7a,93,19,6a,aa,c5,54,06,10,a7,9a,9f,ef,56,0f,62,a9,85,61,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:7a,da,d8,37,41,8d,a9,ca,a2,90,38,5d,93,8f,ec,c2,bf,e3,ba,55,42,
dd,7e,c5,1d,01,75,7a,93,19,6a,aa,c5,54,06,10,a7,9a,9f,ef,56,0f,62,a9,85,61,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-09-11 12:21:41
ComboFix-quarantined-files.txt 2012-09-11 10:21
ComboFix2.txt 2012-09-11 09:02
.
Vor Suchlauf: 1.190.383.616 Bytes frei
Nach Suchlauf: 1.037.082.624 Bytes frei
.
- - End Of File - - 4598F9103E77AA2BEB8306D7BAF8C98B
Dann Malwarebytes. Erst das Programm aktualisiert, dann die Datenbank aktualisiert, dann QuickScan. Keine Meldungen. PHP-Code: |
|
11.09.2012, 11:57
| #10 |
| /// the machine /// TB-Ausbilder | Zugriff auf Filezilla ... wohl über einen TrojanerESET Online Scanner
Bitte poste noch ein frisches OTL logfile. Wie läuft der Rechner?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.09.2012, 16:03
| #11 |
| | Zugriff auf Filezilla ... wohl über einen Trojaner Da ich einen 8TB NAS dranhängen habe, und daneben noch so einige HDs "rumliegen" habe ich mir mal erlaubt, auf die Externen zu verzichten und nur die internen zu scannen. Die Externen werde ich noch nachholen, hier erstmal das Log von den Internen: Code:
ATTFilter D:\Programme\IMAPSize\Backup Mails\julian....@........de\INBOX\Facebook Password Reset Confirmation NR.18543_20100603_140831_200.eml Win32/TrojanDownloader.Bredolab.AA trojan
IMAP Size ist ein reiner Backup-Ordner von meinem IMAP-Postfach. An die Dateien gehe ich normalerweise nicht ran, und sicherlich öffne ich keine Anhänge aus offensichtlichen Spam-eMails (wie der, wo der Virus gefunden wurde). Alles Liebe, Julian! |
|
11.09.2012, 16:10
| #12 |
| /// the machine /// TB-Ausbilder | Zugriff auf Filezilla ... wohl über einen Trojaner ok, dann den rest bitte
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Zugriff auf Filezilla ... wohl über einen Trojaner |
| adobe, antivirus, bankguard, bho, bonjour, error, explorer, firefox, firewall, format, frage, gdata, gebraucht, google earth, home, homepage, infizierte, intranet, langs, logfile, mozilla, nvidia, plug-in, realtek, registry, server, sierra, siteadvisor, software, trojaner, vdeck.exe, windows |
Linear-Darstellung
