| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Antivirus-HP's werden blockiert; mehrere Infektionen gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.09.2012, 15:50
| #1 |
| |  Antivirus-HP's werden blockiert; mehrere Infektionen gefunden Hallo,  nachdem ich mir offensichtlich einen Schädling eingefangen habe (Symptom: Antiviren Seiten wie die von AntiVir, Malwarebytes, Kaspersky, .. sind nicht mehr erreichbar) habe ich einen Scan mit AntiVir durchgeführt. Dabei sind mehrere Infektionen entdeckt worden, die ich in Quarantäne verschoben habe. Die Seiten sind allerdings nach wie vor nicht erreichbar. Der Antivir-Log dazu ist aus irgendeinem Grund nicht mehr verfügbar gewesen als ich ihn abrufen wollte, sorry. Hier zumindest die gefunden Ereignisse: Code:
ATTFilter Exportierte Ereignisse:
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\temp\jar_cache6418412145443349250.tmp'
enthielt einen Virus oder unerwünschtes Programm 'EXP/08-5353.AI' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1c3884c1.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\temp\jar_cache5585159417000856060.tmp'
enthielt einen Virus oder unerwünschtes Programm 'EXP/2008-5353.DP' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7a0fcb03.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei
'C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\1bb1bbc8-51824
d5a'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2008-5353.QB'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e17de2a.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\temp\jar_cache5440595845258302888.tmp'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-1723.A.177'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3f8be63d.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\txjoymqvc.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Graftor.35625.8' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7048b86f.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\ProgramData\Spybot - Search & Destroy\Recovery\FraudQIPGuard1.zip'
enthielt einen Virus oder unerwünschtes Programm 'GEN/PwdZIP' [heuristic].
Durchgeführte Aktion(en):
Der Fund wurde als verdächtig eingestuft.
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5d199718.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\temp\jar_cache3976520247787348655.tmp'
enthielt einen Virus oder unerwünschtes Programm 'EXP/08-5353.AI' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4090d45c.qua'
verschoben!
12.09.2012 11:02 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\temp\jar_cache2203615919976177960.tmp'
enthielt einen Virus oder unerwünschtes Programm 'EXP/2008-5353.DP' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0c28f816.qua'
verschoben!
Danach habe ich außerdem einen Scan mit MB Anti-Maleware durchgeführt. Logfile: Code:
ATTFilter Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.09.12.02 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 8.0.7601.17514 *** :: ***-PC [Administrator] 12.09.2012 15:21:27 mbam-log-2012-09-12 (15-42-13).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 221146 Laufzeit: 20 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 6 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 2 HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\***\AppData\Roaming\advantage\AdVantage.exe (Trojan.Agent) -> Keine Aktion durchgeführt. (Ende) (nur die OTL.txt, ein "Extra.txt" wurde bei mir nicht erstellt  )Code:
ATTFilter OTL logfile created on: 12.09.2012 16:30:46 - Run 4 OTL by OldTimer - Version 3.2.61.3 Folder = C:\Users\Nuellz\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,97 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 44,43% Memory free 5,93 Gb Paging File | 3,82 Gb Available in Paging File | 64,40% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 139,17 Gb Total Space | 43,35 Gb Free Space | 31,15% Space Free | Partition Type: NTFS Drive D: | 140,50 Gb Total Space | 6,44 Gb Free Space | 4,58% Space Free | Partition Type: NTFS Drive E: | 4,87 Gb Total Space | 1,76 Gb Free Space | 36,17% Space Free | Partition Type: NTFS Computer Name: NUELLZ-PC | User Name: Nuellz | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.12 15:50:22 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Nuellz\Desktop\OTL.exe PRC - [2012.09.07 20:26:05 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.09.07 20:26:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2012.09.07 20:25:55 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.09.07 20:25:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012.08.29 18:08:34 | 000,388,984 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files\BlueStacks\HD-FileSystem.exe PRC - [2012.08.29 18:08:32 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files\BlueStacks\HD-LogRotatorService.exe PRC - [2012.08.29 18:08:12 | 000,388,984 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files\BlueStacks\HD-BlockDevice.exe PRC - [2012.08.29 18:08:10 | 000,388,984 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files\BlueStacks\HD-Network.exe PRC - [2012.08.29 18:08:00 | 000,397,176 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files\BlueStacks\HD-Service.exe PRC - [2012.08.25 22:27:58 | 000,085,776 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Sandboxie\SbieSvc.exe PRC - [2012.08.16 14:47:32 | 004,912,584 | ---- | M] (Binary Fortress Software) -- C:\Program Files\DisplayFusion\DisplayFusion.exe PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Nuellz\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2012.05.15 11:27:34 | 000,857,920 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2011.10.05 16:45:56 | 000,130,976 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDHookSvc.exe PRC - [2011.10.05 16:45:42 | 000,169,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe PRC - [2011.10.05 16:45:40 | 000,955,816 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe PRC - [2011.10.05 16:45:38 | 000,892,336 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe PRC - [2011.10.01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011.03.23 13:13:19 | 001,122,304 | ---- | M] (Zhorn Software) -- C:\Program Files\Stickies\stickies.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.07.19 17:42:16 | 000,866,576 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe PRC - [2010.07.19 17:26:06 | 001,206,544 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe PRC - [2010.07.19 17:23:28 | 000,477,456 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe PRC - [2010.03.09 04:52:49 | 000,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe PRC - [2009.09.11 13:33:54 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe PRC - [2008.06.04 20:03:36 | 000,817,672 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\QtZgAcer.EXE ========== Modules (No Company Name) ========== MOD - [2012.09.12 00:15:28 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll MOD - [2012.09.12 00:15:16 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\6dc7ae907d0a57aa19331225f5192ca7\System.Web.ni.dll MOD - [2012.09.12 00:14:47 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012.09.12 00:14:38 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012.09.12 00:14:35 | 000,680,448 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\054fcff18035c210487b0888e6461192\System.Security.ni.dll MOD - [2012.09.12 00:14:32 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll MOD - [2012.09.12 00:14:28 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012.09.12 00:14:25 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll MOD - [2012.09.12 00:14:14 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll MOD - [2011.03.23 13:13:19 | 000,049,152 | ---- | M] () -- C:\Program Files\Stickies\shook70.dll MOD - [2010.11.13 02:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll MOD - [2010.03.09 04:55:56 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll MOD - [2010.03.09 04:55:54 | 000,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll MOD - [2010.03.09 04:52:49 | 000,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe ========== Services (SafeList) ========== SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDHookService) SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem) SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate) SRV - [2012.09.11 09:30:56 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.07 20:26:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.09.07 20:25:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.08.29 18:08:32 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012.08.29 18:08:00 | 000,397,176 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012.08.25 22:27:58 | 000,085,776 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc) SRV - [2012.07.06 16:47:53 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.06 20:39:12 | 000,077,520 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService) SRV - [2012.01.06 20:36:14 | 000,331,608 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (hshld) SRV - [2012.01.05 01:02:02 | 000,329,544 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd) SRV - [2012.01.05 01:01:58 | 000,363,336 | ---- | M] (AnchorFree Inc.) [Disabled | Stopped] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv) SRV - [2011.10.01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010.07.19 17:42:16 | 000,866,576 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2010.07.19 17:26:04 | 000,227,600 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV - [2010.07.19 17:23:28 | 000,477,456 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2010.06.25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [Disabled | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) SRV - [2009.09.11 13:33:54 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | System | Running] -- C:\Program Files\Spybot -- (SDHookDriver) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\NETw5s32.sys -- (NETw5s32) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Nuellz\AppData\Local\Temp\catchme.sys -- (catchme) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (abw2ymcb) DRV - [2012.09.07 20:26:05 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.09.07 20:26:05 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.09.07 20:26:05 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.08.29 18:08:22 | 000,066,424 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys -- (BstHdDrv) DRV - [2012.08.25 22:27:54 | 000,157,776 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV - [2012.05.15 12:26:00 | 011,354,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2012.04.18 19:08:04 | 000,148,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA) DRV - [2012.01.05 15:47:38 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\System32\drivers\truecrypt.sys -- (truecrypt) DRV - [2011.10.01 09:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol) DRV - [2011.10.01 09:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir) DRV - [2011.10.01 09:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay) DRV - [2011.10.01 09:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs) DRV - [2011.09.11 18:31:14 | 000,083,872 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2011.09.11 18:31:14 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2011.07.28 22:42:08 | 000,101,248 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmaudio.sys -- (avmaudio) DRV - [2011.02.28 18:14:51 | 000,229,208 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.09.22 21:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv) DRV - [2010.09.22 21:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss) DRV - [2010.08.03 01:35:31 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.07.14 04:42:24 | 006,814,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETwNs32.sys -- (NETwNs32) DRV - [2010.06.25 19:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.03.09 04:52:45 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5) DRV - [2009.12.31 11:22:09 | 000,295,936 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcvmm.sys -- (vpcvmm) DRV - [2009.12.18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv) DRV - [2009.09.23 03:19:31 | 000,055,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vpcnfltr.sys -- (vpcnfltr) DRV - [2009.09.23 03:18:08 | 000,078,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpcusb.sys -- (vpcusb) DRV - [2009.09.23 03:18:07 | 000,165,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vpchbus.sys -- (vpcbus) DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) DRV - [2009.06.29 18:59:02 | 000,112,128 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2009.06.29 18:59:02 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbfake.sys -- (hwusbfake) DRV - [2009.04.09 14:38:26 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2009.01.01 14:06:56 | 000,008,192 | ---- | M] (SNEG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FStarForce.sys -- (FStarForce) DRV - [2008.12.11 14:56:14 | 000,013,056 | ---- | M] (ROCCAT Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Kone.sys -- (KoneFltr) DRV - [2008.10.09 14:50:08 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad) DRV - [2008.10.09 14:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM) DRV - [2008.08.01 00:42:02 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901) DRV - [2008.07.03 05:24:46 | 000,026,752 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVerA310USB.sys -- (A310) DRV - [2008.07.03 05:24:42 | 000,047,104 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVerA310Cap.sys -- (BDASwCap) DRV - [2007.10.19 00:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2007.03.27 09:51:40 | 000,043,008 | ---- | M] (Winbond Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winbondcir.sys -- (winbondcir) DRV - [2007.01.29 07:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2) DRV - [2000.01.01 02:00:00 | 000,186,912 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV - [2000.01.01 02:00:00 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = {95289393-33EA-4F8D-B952-483415B9C955} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{206C00B9-24F8-4BC6-8F2F-BEF868B09369}: "URL" = hxxp://search.qip.ru/?query={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 47 47 16 5C 2F CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\Nuellz\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Web Search" FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3 FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10 FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31 FF - prefs.js..extensions.enabledAddons: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.9.5.1 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {9815d32d-08c2-42ca-a8c6-43e501a4512f}:0.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2 FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://search.qip.ru/search?from=FF&query=" FF - prefs.js..network.proxy.backup.ftp: "127.0.0.1" FF - prefs.js..network.proxy.backup.ftp_port: 4001 FF - prefs.js..network.proxy.backup.gopher: "127.0.0.1" FF - prefs.js..network.proxy.backup.gopher_port: 4001 FF - prefs.js..network.proxy.backup.socks: "127.0.0.1" FF - prefs.js..network.proxy.backup.socks_port: 4001 FF - prefs.js..network.proxy.backup.ssl: "127.0.0.1" FF - prefs.js..network.proxy.backup.ssl_port: 4001 FF - prefs.js..network.proxy.ftp: "127.0.0.1" FF - prefs.js..network.proxy.ftp_port: 4001 FF - prefs.js..network.proxy.gopher: "127.0.0.1" FF - prefs.js..network.proxy.gopher_port: 4001 FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 4001 FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "127.0.0.1" FF - prefs.js..network.proxy.socks_port: 4001 FF - prefs.js..network.proxy.socks_remote_dns: true FF - prefs.js..network.proxy.ssl: "127.0.0.1" FF - prefs.js..network.proxy.ssl_port: 4001 FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3503.0728: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Nuellz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Nuellz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.02 23:17:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2012.02.14 16:47:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.16 01:34:56 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.23 19:02:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2010.06.24 16:36:47 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins [2011.10.20 13:46:36 | 000,000,000 | ---D | M] [2010.06.24 16:37:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Extensions [2010.06.24 16:34:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.06.24 16:37:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28} [2012.09.11 23:12:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions [2011.02.04 20:05:55 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2012.02.20 17:51:16 | 000,000,000 | ---D | M] (Html Validator) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} [2011.01.27 01:57:12 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC} [2010.12.14 15:53:07 | 000,000,000 | ---D | M] (Tor-Proxy.NET Toolbar) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} [2010.08.31 13:06:05 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.02.17 13:22:50 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca} [2012.08.26 13:08:14 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2011.02.18 20:52:42 | 000,000,000 | ---D | M] (User Agent Switcher) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1} [2011.12.16 22:41:06 | 000,000,000 | ---D | M] (Anti-Aliasing Tuner) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\aatuner@hotmint.com [2012.08.26 13:08:18 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\fb_add_on@avm.de [2012.08.26 13:08:17 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\https-everywhere@eff.org [2011.01.12 21:47:37 | 000,000,000 | ---D | M] (Osirifox) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\osiris@kodeware.net [2011.01.12 21:47:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Firefox\Profiles\tn61asqk.default\extensions\osiris@kodeware.net\osiris\share\extensions [2010.06.24 16:37:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\Sunbird\Profiles\kbm78b69.default\extensions [2012.08.26 13:08:19 | 001,335,949 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\firebug@software.joehewitt.com.xpi [2012.08.26 13:08:13 | 000,118,496 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\searchy@searchy.xpi [2012.09.11 23:12:44 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.10.30 10:54:14 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2011.09.13 20:52:06 | 000,087,923 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi [2012.02.18 18:18:06 | 000,709,293 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2009.09.28 23:22:18 | 000,001,070 | ---- | M] () (No name found) -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\extensions\osiris@kodeware.net\osiris\share\plugins\AF9A4C281070FDB0F34CF417CDB168AB38C8A388\lib\test\test_xpickle.py [2011.01.14 14:24:51 | 000,002,062 | ---- | M] () -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\searchplugins\qip-search.xml [2011.07.11 20:04:02 | 000,000,633 | ---- | M] () -- C:\Users\Nuellz\AppData\Roaming\mozilla\firefox\profiles\tn61asqk.default\searchplugins\startsear.xml [2012.07.23 19:08:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2012.05.04 09:07:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012.02.19 22:44:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2010.12.27 16:19:36 | 000,000,000 | ---D | M] (Hotspot Shield Helper (Please allow this installation)) -- C:\Program Files\mozilla firefox\extensions\afurladvisor@anchorfree.com [2012.02.16 01:34:56 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.02.16 01:34:54 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.16 01:34:54 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.16 01:34:54 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.16 01:34:54 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.16 01:34:54 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.16 01:34:54 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Chrome\Application\21.0.1180.89\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Chrome\Application\21.0.1180.89\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: vShare.tv plug-in (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll CHR - plugin: vShare.tv plug-in (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npvsharetvplg.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Java(TM) Platform SE 7 U3 (Enabled) = C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 7.0.30.255 (Enabled) = C:\Windows\system32\npDeployJava1.dll CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Google Update (Enabled) = C:\Users\Nuellz\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.3_0\ CHR - Extension: Firebug Lite for Google Chrome\u2122 = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench\1.4.0.11967_0\ CHR - Extension: Adblock Plus (Beta) = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\ CHR - Extension: Hide My Ass! Web Proxy = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmgnmcnlncejehjlnhaglpnoolgbflbd\1.2.5_0\ CHR - Extension: AdBlock = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.43_0\ CHR - Extension: LastPass = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.10_0\ CHR - Extension: Reddit Enhancement Suite = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.1.3_0\ CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\ CHR - Extension: Hover Zoom = C:\Users\Nuellz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl\4.5_0\ O1 HOSTS File: ([2011.12.01 13:53:23 | 000,433,294 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 14939 more lines... O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\Nuellz\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4 - HKLM..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE (Dritek System Inc.) O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe () O4 - HKCU..\Run: [DisplayFusion] C:\Program Files\DisplayFusion\DisplayFusion.exe (Binary Fortress Software) O4 - HKCU..\Run: [Ictokidi] C:\Users\Nuellz\AppData\Roaming\Uzyft\osevb.exe () O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Nuellz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Nuellz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Nuellz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launch Manager.LNK = C:\Program Files\Launch Manager\QtZgAcer.EXE (Dritek System Inc.) O4 - Startup: C:\Users\Nuellz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files\Stickies\stickies.exe (Zhorn Software) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2) O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab (SysInfo Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{448CA375-86D9-46F0-AC1E-7FB3AD8ADF2D}: NameServer = 10.75.32.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78FFAE30-B8C6-4276-8DB9-E9FCC92C4457}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CFB30BC6-61BA-47B9-A783-7474ECFD6C59}: DhcpNameServer = 139.7.30.126 139.7.30.125 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20 - AppInit_DLLs: (C:\Windows\System32\guard32.dll) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.12 15:50:23 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Nuellz\Desktop\OTL.exe [2012.09.12 11:44:29 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.09.12 01:18:05 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Avira [2012.09.12 01:07:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.09.12 00:35:34 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2012.09.11 23:44:47 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.09.11 23:43:19 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.09.11 23:41:29 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.09.11 23:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.09.11 23:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2012.09.11 23:15:09 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Local\Macromedia [2012.09.11 22:57:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie [2012.09.11 10:56:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader [2012.09.08 13:12:56 | 000,000,000 | -HSD | C] -- C:\Users\Nuellz\AppData\Roaming\Common [2012.09.08 13:12:52 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\DisplayFusion [2012.09.08 13:12:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DisplayFusion [2012.09.08 13:12:43 | 000,000,000 | ---D | C] -- C:\Program Files\DisplayFusion [2012.09.08 13:12:30 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\Documents\DisplayFusion Backups [2012.09.06 08:24:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.09.03 16:12:46 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Windows Live Writer [2012.09.03 16:12:46 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Local\Windows Live Writer [2012.09.03 16:09:37 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.09.03 16:04:49 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Local\Windows Live [2012.09.01 13:19:33 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2012.09.01 12:58:07 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Thunderbird [2012.08.31 16:05:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks [2012.08.31 16:05:59 | 000,000,000 | ---D | C] -- C:\ProgramData\BlueStacks [2012.08.31 16:05:59 | 000,000,000 | ---D | C] -- C:\Program Files\BlueStacks [2012.08.31 15:48:22 | 000,000,000 | ---D | C] -- C:\ProgramData\BlueStacksSetup [2012.08.29 19:19:17 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\Documents\StudyProf 4.0 [2012.08.27 23:07:26 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Uzyft [2012.08.27 23:07:26 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Neli [2012.08.27 23:07:26 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Fiisx [2012.08.23 14:24:00 | 000,000,000 | ---D | C] -- C:\Users\Nuellz\AppData\Roaming\Microsoft Corporation [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\Nuellz\*.tmp files -> C:\Users\Nuellz\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.12 15:58:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.12 15:50:22 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Nuellz\Desktop\OTL.exe [2012.09.12 15:47:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2394246592-3773893724-523780310-1000UA.job [2012.09.12 15:46:02 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.12 14:47:08 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2394246592-3773893724-523780310-1000Core.job [2012.09.12 11:46:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.09.12 11:18:18 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 11:18:18 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 11:08:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.12 11:07:57 | 2388,287,488 | -HS- | M] () -- C:\hiberfil.sys [2012.09.11 23:01:47 | 000,002,206 | ---- | M] () -- C:\Windows\Sandboxie.ini [2012.09.11 22:43:27 | 000,318,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.09.11 22:28:36 | 000,718,650 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.09.11 22:28:36 | 000,668,560 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.09.11 22:28:36 | 000,154,956 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.09.11 22:28:36 | 000,126,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.09.11 12:08:29 | 000,000,218 | ---- | M] () -- C:\Users\Nuellz\.recently-used.xbel [2012.09.07 20:26:05 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.09.07 20:26:05 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.09.07 20:26:05 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.09.01 12:57:46 | 108,149,000 | ---- | M] () -- C:\Users\Nuellz\AppData\Roaming\Thunderbird2.rar [2012.08.28 11:44:25 | 108,149,000 | ---- | M] () -- C:\Users\Nuellz\AppData\Roaming\Thunderbird.rar [2012.08.23 14:05:11 | 000,000,055 | ---- | M] () -- C:\Users\Nuellz\Documents\.recently-used [2012.08.17 00:06:50 | 000,000,127 | ---- | M] () -- C:\Windows\System32\MRT.INI [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Users\Nuellz\*.tmp files -> C:\Users\Nuellz\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.11 12:08:29 | 000,000,218 | ---- | C] () -- C:\Users\Nuellz\.recently-used.xbel [2012.09.03 16:09:20 | 000,001,251 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk [2012.09.03 16:09:09 | 000,001,320 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk [2012.09.03 16:08:45 | 000,001,404 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2012.09.01 12:56:14 | 108,149,000 | ---- | C] () -- C:\Users\Nuellz\AppData\Roaming\Thunderbird2.rar [2012.08.28 11:43:05 | 108,149,000 | ---- | C] () -- C:\Users\Nuellz\AppData\Roaming\Thunderbird.rar [2012.08.17 00:06:50 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI [2012.08.09 15:11:10 | 000,000,133 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc [2012.07.10 10:48:58 | 000,055,296 | ---- | C] () -- C:\ProgramData\dtmmowvxxruiotq [2012.07.10 10:38:58 | 000,040,448 | ---- | C] () -- C:\ProgramData\pvwbrpcsinpxcqv [2012.07.10 10:38:58 | 000,000,098 | ---- | C] () -- C:\ProgramData\bdbdceeedabcacegfdgfdgdfg.cfg [2012.07.10 10:38:57 | 000,000,000 | ---- | C] () -- C:\ProgramData\bdbdceeedabcacegfdgfdgdfg.exe [2012.04.23 12:36:50 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2012.04.23 12:36:50 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2012.02.22 11:57:00 | 000,002,206 | ---- | C] () -- C:\Windows\Sandboxie.ini [2012.01.18 01:18:21 | 000,006,285 | ---- | C] () -- C:\Users\Nuellz\AppData\Roaming\gd.db [2012.01.18 01:18:21 | 000,000,286 | ---- | C] () -- C:\Users\Nuellz\AppData\Roaming\groovedown.settings [2011.12.17 22:57:43 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe [2011.12.05 22:41:42 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT [2011.10.10 00:12:47 | 000,000,980 | ---- | C] () -- C:\Windows\eReg.dat [2011.09.11 18:28:09 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2011.09.11 18:28:08 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011.06.22 20:24:59 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2011.06.22 20:24:59 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2011.06.22 20:24:59 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2011.05.20 16:08:03 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini [2011.04.17 22:53:06 | 000,001,459 | ---- | C] () -- C:\Users\Nuellz\gsview32.ini [2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2011.04.03 12:05:46 | 000,026,176 | -H-- | C] () -- C:\Windows\System32\hamachi.sys [2011.03.05 15:12:34 | 000,069,632 | ---- | C] () -- C:\Windows\System32\xmltok.dll [2011.03.05 15:12:34 | 000,036,864 | ---- | C] () -- C:\Windows\System32\xmlparse.dll [2011.03.01 12:41:48 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.02.17 20:32:22 | 000,000,000 | ---- | C] () -- C:\Windows\CrypTool.INI [2011.02.16 16:46:34 | 000,001,316 | ---- | C] () -- C:\Windows\ARCHPR4.INI [2011.02.15 12:57:38 | 000,000,223 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.02.15 12:57:06 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll [2011.02.07 20:03:37 | 000,011,264 | ---- | C] () -- C:\Users\Nuellz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.02.07 01:18:48 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2011.02.07 01:18:48 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2010.12.31 01:15:09 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat [2010.11.09 22:48:25 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini [2010.10.15 16:22:16 | 000,229,336 | ---- | C] () -- C:\Windows\hphins34.dat [2010.08.07 19:13:58 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.06.16 14:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 ========== LOP Check ========== [2012.09.12 12:23:21 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\.anki [2012.09.10 16:41:48 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\.matplotlib [2011.07.25 16:47:37 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\.minecraft [2012.08.07 21:03:38 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\advantage [2010.12.02 22:05:14 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Astroburn Pro [2012.09.05 17:20:22 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Audacity [2011.07.01 00:45:48 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Bitcoin [2012.08.07 20:56:13 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\BrainYoo [2012.02.14 16:48:24 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Bytemobile [2010.12.02 19:31:45 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Canneverbe Limited [2012.09.08 13:12:56 | 000,000,000 | -HSD | M] -- C:\Users\Nuellz\AppData\Roaming\Common [2011.08.06 13:15:54 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\CPUControl [2012.09.12 15:14:08 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\DAEMON Tools Lite [2010.08.02 01:57:27 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\DAEMON Tools Net [2012.09.09 12:49:20 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\DisplayFusion [2012.09.12 11:42:35 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Dropbox [2010.08.26 00:36:01 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\DVDVideoSoftIEHelpers [2012.04.18 11:45:59 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Embarcadero [2011.08.11 19:49:21 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\FFSJ [2012.08.27 23:07:26 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Fiisx [2012.09.11 18:19:01 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\foobar2000 [2012.06.11 12:26:56 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Foxit Software [2012.07.23 19:06:14 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\FreePDF [2012.09.11 12:08:17 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\gtk-2.0 [2012.08.22 14:20:00 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\IrfanView [2010.06.24 16:29:57 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\KeePass [2012.01.18 01:18:21 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\lang [2012.08.09 15:06:24 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\LearnLift [2012.07.31 11:55:22 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\LibreOffice [2012.03.31 19:31:08 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\LOVE [2010.12.10 13:48:53 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Miranda [2012.09.11 12:08:29 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\MonoDevelop [2012.08.07 20:07:59 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\mplayer [2012.09.12 15:47:48 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Neli [2010.06.24 19:06:46 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\OpenOffice.org [2011.12.28 14:34:45 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\QIP [2010.08.03 19:33:24 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\QuickScan [2010.06.26 15:57:11 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\ROCCAT [2012.09.11 22:39:58 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\SoftGrid Client [2010.06.25 20:16:21 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Steinberg [2012.04.18 11:49:27 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\stetic [2012.09.12 11:42:18 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\stickies [2012.04.18 11:58:29 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Subversion [2012.09.03 15:51:47 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Thunderbird [2011.03.01 20:55:07 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\TP [2012.07.20 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Trine2 [2010.07.08 16:44:35 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\TrojanHunter [2012.01.05 15:51:15 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\TrueCrypt [2011.01.27 23:38:16 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\UDC Profiles [2012.08.27 23:07:26 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Uzyft [2010.07.07 18:37:51 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Vaoq [2012.02.14 16:48:23 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Vodafone [2012.02.14 16:50:30 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Vodafone Mobile Connect [2010.06.25 20:16:21 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\VST3 Presets [2011.12.25 19:19:38 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Warsow 0.6 [2012.09.10 13:51:25 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Windows Live Writer [2012.04.18 11:47:59 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\xbuild [2011.09.11 20:51:44 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\XRay Engine [2012.07.28 13:28:07 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:E8BE05FA @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report >  im Voraus. |
|
12.09.2012, 17:20
| #2 |
| /// Malware-holic   | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden hi
__________________ersetze *** durch nutzernamen, im script, damits funktioniert dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [Ictokidi] C:\Users\Nuellz\AppData\Roaming\Uzyft\osevb.exe ()
[2012.08.27 23:07:26 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Fiisx
[2010.07.07 18:37:51 | 000,000,000 | ---D | M] -- C:\Users\Nuellz\AppData\Roaming\Vaoq
:Files
C:\Users\Nuellz\AppData\Roaming\Uzyft
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
__________________ |
|
12.09.2012, 18:12
| #3 |
| | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden Hi markus,
__________________zuerst: schonmal Danke für den schnellen Einsatz!  Das Skript habe ich ausgeführt und die MovedFiles.zip habe ich geuploaded. Hier noch der OTL-Log: Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ictokidi deleted successfully.
C:\Users\Nuellz\AppData\Roaming\Uzyft\osevb.exe moved successfully.
C:\Users\Nuellz\AppData\Roaming\Fiisx folder moved successfully.
C:\Users\Nuellz\AppData\Roaming\Vaoq folder moved successfully.
========== COMMANDS ==========
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: nlz
->Flash cache emptied: 996 bytes
User: Nuellz
->Flash cache emptied: 563 bytes
User: Public
Total Flash Files Cleaned = 0,00 mb
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: nlz
->Temp folder emptied: 266821 bytes
->Temporary Internet Files folder emptied: 3162540 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Nuellz
->Temp folder emptied: 176563241 bytes
->Temporary Internet Files folder emptied: 7606362 bytes
->Java cache emptied: 8479656 bytes
->FireFox cache emptied: 87311336 bytes
->Google Chrome cache emptied: 288941937 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1067592 bytes
%systemroot%\System32 .tmp files removed: 4384 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16172 bytes
RecycleBin emptied: 246528 bytes
Total Files Cleaned = 547,00 mb
OTL by OldTimer - Version 3.2.61.3 log created on 09122012_185359
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
12.09.2012, 18:18
| #4 |
| /// Malware-holic | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden danke nutzt du den pc für oninebanking, zum einkaufen, für sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie berufliches?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.09.2012, 18:26
| #5 |
| | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden Zum OnlineBanking nutze ich ihn schon... |
|
12.09.2012, 18:28
| #6 |
| /// Malware-holic | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden ok, bank anrufen, notfall nummer: 116 116 bescheid geben das du das onlinebanking wegen zbot trojaner (banking trojaner) sperren möchtest. der pc muss neu aufgesetzt und dann abgesichert werden 1. Datenrettung:
ich werde außerdem noch weitere punkte dazu posten. 4. alle Passwörter ändern! 5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen. 6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.
__________________ --> Antivirus-HP's werden blockiert; mehrere Infektionen gefunden |
|
12.09.2012, 21:06
| #7 |
| | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden verdammt, ich hatte gehofft genau das vermeiden zu können, weil ich im moment wenig zeit dafür habe. aber ich nehme an, eine Neuinstallation alternativlos? auf jeden fall ganz vielen dank für die mühe. |
|
13.09.2012, 17:03
| #8 |
| /// Malware-holic | Antivirus-HP's werden blockiert; mehrere Infektionen gefunden jepp, zumindest dann, wenn ihr euer geld behalten wollt :-)
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Antivirus-HP's werden blockiert; mehrere Infektionen gefunden |
| adblock, application/pdf:, autorun, avg, avira, bho, blockiert, bluestacks, defender, error, firefox, flash player, format, gen/pwdzip, google, helper, hotspot, installation, kaspersky, langs, launch, locker, logfile, nodrives, object, plug-in, programm, realtek, registry, scan, schädling, software, system, trojan, user agent, virus, vodafone |
Linear-Darstellung
