| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.09.2012, 18:30
| #1 |
 |  selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Hallo Leute, Ich habe nun seit längerer Zeit kleinere .exe Dateien auf meinem Laptop (Windows 7 Home Premium). Die Dateien sind nicht sehr groß. Lediglich rund 350 KB. Sie befinden sich im Ordner Roaming. In der Suchleiste bei Windows einfach "%appdata%" eingeben. Die Minecraft-Spieler kennen den Ordner. Es ist der Ordner in in den man den .minecraft Ordner platzieren muss. Und genau darin befinden sich die Dateien. Sie erstellen sich auch immer neu.  Ich habe schon mehrmals versucht sie einfach zu löschen, aber es funktioniert nicht. Sie werden einfach wieder erstellt. Und es sind auch nicht immer dieselben Dateinamen. Und sie öffnen sich auch automatisch; Im Taskmanager unter Prozesse werden IMMER 2 identische Viren geöffnet. Egal welchen Namen sie haben, es sind immer 2 gleiche. Ich poste mal ein Screenshot hier rein, wie das bei mir aussieht:Also erstmal der Roaming Ordner wo sich die Dateien befinden: Und hier ist der/ sind die Prozesse im Task Manager: Ich habe keiner Ahnung wo diese Teile herkommen. Durch irgendeinen Download höchstwahrscheinlich. Der Virus bremst auch erheblich die Systemleistung aus. Wenn mir jemand helfen kann, wäre ich sehr dankbar  Gruß, Janis |
|
02.10.2012, 07:14
| #2 |
| /// the machine /// TB-Ausbilder    | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Hi,
__________________Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%windir%\installer\*. /5
%localappdata%\*. /5
CREATERESTOREPOINT
__________________ |
|
02.10.2012, 18:59
| #3 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Danke erstmal, schrauber...
__________________Ich habe den Scan gestartet, jedoch hängt sich das Programm immer auf wenn folgendes gescannt wird: "Scanning HKEY_CURRENT_USER Run Keys..." Muss ich einfach nur lange warten? Ich hatte nämlich ca. 15 Minuten gewartet, doch es hat sich nichts getan....  |
|
02.10.2012, 19:00
| #4 |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Dann versuchen wir was andres. Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop. dds.com dds.scr dds.pif
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.10.2012, 21:20
| #5 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Danke, hat geklappt. Also hier ist das Attach file: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT .DDS Logfile: Code:
ATTFilter DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 06.03.2012 13:03:52
System Uptime: 02.10.2012 11:47:51 (11 hours ago)
.
Motherboard: Acer | | Aspire one
Processor: Intel(R) Atom(TM) CPU N270 @ 1.60GHz | CPU | 800/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 114 GiB total, 18,399 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: AVG AVI Loader Driver
Device ID: ROOT\LEGACY_AVGLDX86\0000
Manufacturer:
Name: AVG AVI Loader Driver
PNP Device ID: ROOT\LEGACY_AVGLDX86\0000
Service: Avgldx86
.
Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
Description: Unknown Device
Device ID: USB\VID_0000&PID_0000\5&36089DE0&0&2
Manufacturer: (Standard-USB-Hostcontroller)
Name: Unknown Device
PNP Device ID: USB\VID_0000&PID_0000\5&36089DE0&0&2
Service:
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Download Assistant
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Help Manager
Adobe Illustrator CS6
Adobe Photoshop CS6
Adobe Reader X (10.1.3) - Deutsch
Adobe Shockwave Player
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
µTorrent
Audacity 1.2.6
AVG 2012
AVS Update Manager 1.0
AVS Video Converter 8
Broadcom Wireless Utility
Camtasia Studio 7
Canon IJ Network Scan Utility
Canon IJ Network Tool
Canon MP640 series MP Drivers
CDBurnerXP
Cheat Engine 6.1
CINEMA 4D 11.514
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
DarkLoader v4.1
Dev-C++ 5 beta 9 release (4.9.9.2)
Driver Genius Professional Edition
eReg
Führerschein-Trainer 2007
Fraps (remove only)
GadgetBox
GBox
GermaniXEncoder
Google Chrome
Google Earth
Google Update Helper
Hama Wireless LAN Adapter
Hex-Editor MX
Iminent
Intel(R) Graphics Media Accelerator Driver
InterActual Player
IsoBuster 2.8.5
Java 7 Update 7
Java Auto Updater
JavaFX 2.1.1
JDiskReport 1.4.0
LAME v3.99.3 (for Windows)
Logitech SetPoint 6.32
Media Player Codec Pack 4.1.9
Microsoft .NET Framework 4.5 DEU Language Pack RC
Microsoft .NET Framework 4.5 RC
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Word MUI (German) 2010
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft_VC80_CRT_x86
Microsoft_VC90_CRT_x86
Minecraft Version Changer
mIRC
Mozilla Firefox 13.0.1 (x86 de)
MP3 Skype Recorder
MSVCRT Redists
Orbit Downloader
PDF Settings CS6
Pflanzen gegen Zombies
Realtek High Definition Audio Driver
Skype™ 5.10
SopCast 3.5.0
sprotector 1.62
Stream Player
swMSM
TeamSpeak 3 Client
Tunatic
Vegas Pro 10.0
VLC media player 1.1.11
WebCam
WinRAR 4.11 (32-Bit)
Xilisoft HD Video Converter 6
.
==== End Of File ===========================
Und hier ist das DDS file:
[TABLE].
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2
Run by Janis at 22:00:20 on 2012-10-02
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1033.18.1014.224 [GMT 2:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Hama\Common\RaRegistry.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\WebCam\S6000\S6000Mnt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\taskeng.exe
C:\ProgramData\Premium\GBox\GBox.exe
C:\Windows\System32\taskmgr.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp
uURLSearchHooks: H - No File
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\cinema 4d\documents\msdcsc\msdcsc.exe,c:\users\cinema 4d\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
BHO: IMinent WebBooster (BHO): {a09ab6eb-31b5-454c-97ec-9b294d92ee2a} - c:\program files\iminent\Iminent.WebBooster.InternetExplorer.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~2\office14\URLREDIR.DLL
BHO: Help the General-Search Project: {ca4520f3-ae13-4fb1-a513-58e23991c86d} - c:\users\janis\appdata\roaming\mediaf~1\extens~1\GENCRA~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
uRun: [ViStart] c:\program files\vistart\ViStart.exe
uRun: [85d7b90b3f039ec268747896125a906f]
uRun: [Microsoft DLL Registration] c:\users\janis\appdata\roaming\regsrv32.exe
uRun: [MicroUpdate] c:\users\janis\documents\msdcsc\msdcsc.exe
uRun: [Fztitn] c:\users\janis\appdata\roaming\Fztitn.exe
uRun: [AdobeBridge]
uRun: [Google Update] "c:\users\janis\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [MP3 Skype Recorder] c:\program files\mp3 skype recorder\MP3 Skype Recorder.exe
uRun: [WINSXS32] c:\users\janis\appdata\roaming\A86B.exe
mRun: [Driver Genius]
mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.exe
mRun: [S6000Mnt] Rundll32.exe S6000Rmv.dll ,WinMainRmv /StartStillMnt
mRun: [WINSXS32] c:\users\janis\appdata\roaming\DA66.exe
mRun: [RTHDVCPL] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [Broadcom Wireless Manager UI] c:\program files\broadcom\broadcom 802.11 network adapter\WLTRAY.exe
mRun: [TaskTray]
mRun: [Iminent] c:\program files\iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
mRun: [IminentMessenger] c:\program files\iminent\Iminent.Messengers.exe /startup
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "c:\program files\common files\adobe\cs6servicemanager\CS6ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ROC_ROC_JULY_P1] "c:\program files\avg secure search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1
mRun: [Skype Recorder] "c:\program files\skype recorder\Skype Recorder.exe"
StartupFolder: c:\users\janis\appdata\roaming\microsoft\windows\start menu\programs\startup\explorer.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\hamawi~1.lnk - c:\program files\hama\common\RaUI.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\micros~2\office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\media finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\micros~2\office14\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{06FECF99-3B43-4B79-86CF-19CD04F12C59} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{0D919A74-7B99-489D-A36B-D638B135663D} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A}\2475D2E45647A7775627B6 : DhcpNameServer = 82.212.62.62 78.42.43.62
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A}\75C414E4D2145413935393 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{AECCD3BF-6684-4A29-98B1-59BDF8643224} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{B94362DE-0FA9-41E4-9AFE-BCAFFD87BFEB}\4456661657C647 : DhcpNameServer = 82.212.62.62 192.168.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\mp3 skype recorder\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
AppInit_DLLs: c:\progra~2\sprote~1\sprote~1.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\janis\appdata\roaming\mozilla\firefox\profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.2.5.32&sap=ku&q=
FF - plugin: c:\progra~2\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\users\janis\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
---- FIREFOX POLICIES ----
.
user_pref('extensions.dealply.partner', 'vita');
.
user_pref('extensions.dealply.channel', 'vitaeazel');
.
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
.
user_pref('extensions.dealply.installIdSource', 'inst');
.
user_pref('extensions.dealply.sampleGroup', '0');
.
user_pref('extensions.dealply.partner', 'vita');
.
user_pref('extensions.dealply.channel', 'vitaeazel');
.
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
.
user_pref('extensions.dealply.installIdSource', 'inst');
.
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56:43
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-3-19 301248]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-2-22 235216]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg2012\avgidsagent.exe" --> c:\program files\avg\avg2012\avgidsagent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\avg\avg2012\avgwdsvc.exe" --> c:\program files\avg\avg2012\avgwdsvc.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-4-30 104872]
S2 gupdate;Google Update-Dienst (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-4-17 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-12 250288]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-4-17 116648]
S3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\drivers\netr73.sys [2012-9-10 562464]
S3 PortTalk;PortTalk;c:\windows\system32\drivers\porttalk.sys [2012-3-7 3567]
S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\drivers\S6000KNT.sys [2010-8-5 167576]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
.
=============== Created Last 30 ================
.
2012-10-02 20:00:35 195072 ----a-w- c:\users\janis\appdata\roaming\Fztitn.exe
2012-10-02 15:33:21 347136 ----a-w- c:\users\janis\appdata\roaming\A86B.exe
2012-10-01 19:29:36 -------- d-----w- c:\programdata\Premium
2012-10-01 19:29:33 -------- d-----w- c:\program files\SProtector
2012-10-01 19:29:24 -------- d-----w- c:\program files\GadgetBox
2012-10-01 19:29:07 -------- d-----w- c:\programdata\InstallMate
2012-09-30 19:24:36 347136 ----a-w- c:\users\janis\appdata\roaming\963D.exe
2012-09-30 17:11:00 -------- d-----w- c:\program files\ps3emu
2012-09-28 17:27:43 369664 ----a-w- c:\users\janis\appdata\roaming\E7AA.exe
2012-09-28 17:19:47 348160 ----a-w- c:\users\janis\appdata\roaming\A3F5.exe
2012-09-28 16:53:39 353280 ----a-w- c:\users\janis\appdata\roaming\B7A3.exe
2012-09-28 16:36:55 353280 ----a-w- c:\users\janis\appdata\roaming\66A5.exe
2012-09-28 16:30:23 353280 ----a-w- c:\users\janis\appdata\roaming\6AD8.exe
2012-09-26 18:31:46 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{6bb8abbd-b80f-46c1-9878-7292ddc844c6}\offreg.dll
2012-09-20 21:00:03 -------- d-----w- c:\windows\Profiles
2012-09-17 15:10:54 -------- d-----w- c:\users\janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57:29 -------- d-----w- c:\users\janis\flash-disinfector-
2012-09-13 21:11:39 132597 ----a-w- c:\users\janis\flash-disinfector-.exe
2012-09-10 18:23:36 -------- d-----w- c:\programdata\ALM
2012-09-10 18:01:29 -------- d-----w- c:\users\janis\crack il
2012-09-10 16:14:15 -------- d-----w- c:\users\janis\stick musik
2012-09-10 14:48:07 -------- d-----w- c:\programdata\Ralink
2012-09-10 14:45:14 562464 ----a-w- c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45:14 226592 ----a-w- c:\windows\system32\RaCoInst.dll
2012-09-10 14:45:12 -------- d-----w- c:\programdata\RalinkRT7x Driver
2012-09-10 14:43:52 776480 ----a-w- c:\windows\system32\RAIHV.dll
2012-09-10 14:43:52 102688 ----a-w- c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43:50 1590560 ----a-w- c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43:44 -------- d-----w- c:\program files\Hama
2012-09-09 12:12:25 -------- d-----w- c:\program files\Skype Recorder
2012-09-09 12:02:56 153 ----a-w- c:\users\janis\settings.bin
2012-09-07 15:56:23 -------- d-----w- c:\program files\Tunatic
2012-09-06 09:37:57 -------- d-----w- c:\users\janis\appdata\roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07:55 -------- d-----w- c:\users\janis\appdata\roaming\Iminent
2012-09-05 07:52:20 -------- d-----r- c:\users\janis\sound
2012-09-04 20:34:39 -------- d-----w- c:\program files\VideoLAN
2012-09-04 14:26:58 -------- d-----w- c:\users\janis\savegame cod 4 janis
2012-09-04 08:12:21 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:09:09 -------- d-----w- c:\users\janis\PS3
.
==================== Find3M ====================
.
2012-09-21 20:51:36 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51:36 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11:45 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11:45 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-27 14:31:34 299047 ----a-w- c:\users\janis\Crusader_Multihack_Beta.exe
.
============= FINISH: 22:03:28,72 ===============
--- --- --- --- --- --- --- --- --- Das war's, Gruß, Janis |
|
03.10.2012, 06:23
| #6 | |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ --> selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... |
|
03.10.2012, 11:14
| #7 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Danke, schrauber. Das ist das Text file: Combofix Logfile: Code:
ATTFilter ComboFix 12-10-02.02 - Janis 03.10.2012 11:33:08.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1033.18.1014.302 [GMT 2:00]
ausgeführt von:: c:\downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\DealPly
c:\program files\DealPly\DealPlyTune.dll
c:\users\Janis\AppData\Roaming\66A5.exe
c:\users\Janis\AppData\Roaming\6AD8.exe
c:\users\Janis\AppData\Roaming\963D.exe
c:\users\Janis\AppData\Roaming\A3F5.exe
c:\users\Janis\AppData\Roaming\A86B.exe
c:\users\Janis\AppData\Roaming\B7A3.exe
c:\users\Janis\AppData\Roaming\E7AA.exe
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Templates\Lame_v3.99.3_for_Windows.exe
c:\users\Janis\Crusader_Multihack_Beta.exe
c:\users\Janis\flash-disinfector-.exe
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-09-03 bis 2012-10-03 ))))))))))))))))))))))))))))))
.
.
2012-10-03 09:53 . 2012-10-03 09:54 -------- d-----w- c:\users\Janis\AppData\Local\temp
2012-10-03 09:53 . 2012-10-03 09:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-03 09:17 . 2012-10-03 09:17 195072 ----a-w- c:\users\Janis\AppData\Roaming\Fztitn.exe
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11 -------- d-----w- c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-01 15:04 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00 -------- d-----w- c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00 -------- d-----w- c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40 -------- d-----w- c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11 -------- d-----w- c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57 -------- d-----w- c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23 -------- d-----w- c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25 -------- d-----w- c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15 -------- d-----w- c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34 -------- d-----w- c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06 562464 ----a-w- c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07 226592 ----a-w- c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16 776480 ----a-w- c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16 102688 ----a-w- c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16 1590560 ----a-w- c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43 -------- d-----w- c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00 -------- d-----w- c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02 153 ----a-w- c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56 -------- d-----w- c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37 -------- d-----w- c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07 -------- d-----w- c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52 -------- d-----r- c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26 -------- d-----w- c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34 -------- d-----w- c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27 -------- d-----w- c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17 -------- d-----w- c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11 -------- d-----w- c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09 -------- d-----w- c:\users\Janis\PS3
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Fztitn"="c:\users\Janis\AppData\Roaming\Fztitn.exe" [2012-10-03 195072]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fztitn]
2012-10-03 09:17 195072 ----a-w- c:\users\Janis\AppData\Roaming\Fztitn.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33 136176 ----atw- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33 17418928 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
HKCU-Run-ViStart - c:\program files\ViStart\ViStart.exe
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-WINSXS32 - c:\users\Janis\AppData\Roaming\A86B.exe
HKLM-Run-Driver Genius - (no file)
HKLM-Run-WINSXS32 - c:\users\Janis\AppData\Roaming\DA66.exe
HKLM-Run-TaskTray - (no file)
HKLM-Run-Iminent - c:\program files\Iminent\Iminent.exe
HKLM-Run-IminentMessenger - c:\program files\Iminent\Iminent.Messengers.exe
HKLM-Run-ROC_ROC_JULY_P1 - c:\program files\AVG Secure Search\ROC_ROC_JULY_P1.exe
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
MSConfigStartUp-Media Finder - c:\program files\Media Finder\MF.exe
MSConfigStartUp-MicroUpdate - c:\users\Janis\Documents\MSDCSC\01M7kAsKUXn3\msdcsc.exe
MSConfigStartUp-NetLimiter - c:\program files\NetLimiter 3\NLClientApp.exe
MSConfigStartUp-vProt - c:\program files\AVG Secure Search\vprot.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆ mm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03 12:00:15
ComboFix-quarantined-files.txt 2012-10-03 10:00
.
Vor Suchlauf: 23 Verzeichnis(se), 22.124.974.080 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 23.053.103.104 Bytes frei
.
- - End Of File - - 34727DBB192449BBDB7B1FD505BDF8B1
|
|
03.10.2012, 15:15
| #8 |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Combofix muss vom Desktop ausgeführt werden. Bitte Combofix löschen, neu laden auf den Desktop und nochmal laufen lassen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.10.2012, 16:57
| #9 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Alles klar, ich hab das jetzt nochmal gemacht. Wenns wieder falsch ist, weiß ich auch nicht was los ist... Combofix Logfile: Code:
ATTFilter ComboFix 12-10-03.03 - Janis 03.10.2012 17:30:32.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1033.18.1014.347 [GMT 2:00]
ausgeführt von:: c:\downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Cinema 4D\Documents\MSDCSC\msdcsc.exe
c:\users\Janis\AppData\Roaming\Fztitn.exe
c:\users\Janis\Documents\MSDCSC\msdcsc.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-09-03 bis 2012-10-03 ))))))))))))))))))))))))))))))
.
.
2012-10-03 15:49 . 2012-10-03 15:49 -------- d-----w- c:\users\Janis\AppData\Local\temp
2012-10-03 15:49 . 2012-10-03 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11 -------- d-----w- c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-01 15:04 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00 -------- d-----w- c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00 -------- d-----w- c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40 -------- d-----w- c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11 -------- d-----w- c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57 -------- d-----w- c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23 -------- d-----w- c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25 -------- d-----w- c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15 -------- d-----w- c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34 -------- d-----w- c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06 562464 ----a-w- c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07 226592 ----a-w- c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16 776480 ----a-w- c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16 102688 ----a-w- c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16 1590560 ----a-w- c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43 -------- d-----w- c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00 -------- d-----w- c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02 153 ----a-w- c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56 -------- d-----w- c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37 -------- d-----w- c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07 -------- d-----w- c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52 -------- d-----r- c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26 -------- d-----w- c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34 -------- d-----w- c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27 -------- d-----w- c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17 -------- d-----w- c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11 -------- d-----w- c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09 -------- d-----w- c:\users\Janis\PS3
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33 136176 ----atw- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33 17418928 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Fztitn - c:\users\Janis\AppData\Roaming\Fztitn.exe
MSConfigStartUp-Fztitn - c:\users\Janis\AppData\Roaming\Fztitn.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆ mm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03 17:54:17
ComboFix-quarantined-files.txt 2012-10-03 15:54
ComboFix2.txt 2012-10-03 10:00
.
Vor Suchlauf: 29 Verzeichnis(se), 21.680.721.920 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 21.752.598.528 Bytes frei
.
- - End Of File - - D1711FB957BBBCE9F0450E85E2704112
|
|
03.10.2012, 18:19
| #10 | |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.10.2012, 19:44
| #11 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... dafuqIch hab das Teil doch auf den Desktop gezogen o__o Ok ich machs nochmal  |
|
03.10.2012, 19:51
| #12 |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Mach am Besten ausschneiden/einfügen, nicht dass du durch irgend nen dummen zufall nur ne verknüpfung machst
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.10.2012, 20:26
| #13 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Rate, was ich aus irgend nem dummen Zufall gemacht hab...  Aber egal :P Hier ist jetz das richtige: Combofix Logfile: Code:
ATTFilter ComboFix 12-10-03.03 - Janis 03.10.2012 20:52:53.3.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1033.18.1014.359 [GMT 2:00]
ausgeführt von:: c:\users\Janis\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-09-03 bis 2012-10-03 ))))))))))))))))))))))))))))))
.
.
2012-10-03 19:11 . 2012-10-03 19:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-10-03 15:54 . 2012-10-03 19:11 -------- d-----w- c:\users\Janis\AppData\Local\temp
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29 -------- d-----w- c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11 -------- d-----w- c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-03 17:46 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00 -------- d-----w- c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00 -------- d-----w- c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40 -------- d-----w- c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11 -------- d-----w- c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57 -------- d-----w- c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23 -------- d-----w- c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25 -------- d-----w- c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15 -------- d-----w- c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34 -------- d-----w- c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06 562464 ----a-w- c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07 226592 ----a-w- c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16 776480 ----a-w- c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16 102688 ----a-w- c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16 1590560 ----a-w- c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43 -------- d-----w- c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00 -------- d-----w- c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02 153 ----a-w- c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56 -------- d-----w- c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37 -------- d-----w- c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07 -------- d-----w- c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52 -------- d-----r- c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26 -------- d-----w- c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34 -------- d-----w- c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27 -------- d-----w- c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17 -------- d-----w- c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11 -------- d-----w- c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09 -------- d-----w- c:\users\Janis\PS3
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33 136176 ----atw- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33 17418928 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆ mm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03 21:16:37
ComboFix-quarantined-files.txt 2012-10-03 19:16
ComboFix2.txt 2012-10-03 10:00
.
Vor Suchlauf: 29 Verzeichnis(se), 18.122.334.208 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 17.834.000.384 Bytes frei
.
- - End Of File - - 7E6B314E5AC42F013C7B44C246271941
|
|
04.10.2012, 06:32
| #14 |
| /// the machine /// TB-Ausbilder | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Hi, Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.10.2012, 18:03
| #15 |
| | selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... Danke schrauber, hier ist das Text file: # AdwCleaner v2.003 - Logfile created 10/04/2012 at 17:56:18 # Updated 23/09/2012 by Xplode # Operating system : Windows 7 Home Premium (32 bits) # User : Janis - JANIS-PC # Boot Mode : Normal # Running from : C:\Users\Janis\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml File Found : C:\Program Files\Mozilla Firefox\searchplugins\SearchTheWeb.xml File Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\searchplugins\SearchTheWeb.xml Folder Found : C:\Program Files\AVG Secure Search Folder Found : C:\ProgramData\Babylon Folder Found : C:\ProgramData\boost_interprocess Folder Found : C:\ProgramData\Iminent Folder Found : C:\ProgramData\InstallMate Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder Folder Found : C:\ProgramData\Premium Folder Found : C:\Users\Janis\AppData\LocalLow\BabylonToolbar Folder Found : C:\Users\Janis\AppData\Roaming\Iminent Folder Found : C:\Users\Janis\AppData\Roaming\Media Finder Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} ***** [Registry] ***** Key Found : HKCU\Software\IGearSettings Key Found : HKCU\Software\Iminent Key Found : HKCU\Software\MediaFinder Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Key Found : HKCU\Software\Softonic Key Found : HKLM\Software\Babylon Key Found : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11} Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL Key Found : HKLM\SOFTWARE\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7} Key Found : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761} Key Found : HKLM\SOFTWARE\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F} Key Found : HKLM\SOFTWARE\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0} Key Found : HKLM\SOFTWARE\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90} Key Found : HKLM\SOFTWARE\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43} Key Found : HKLM\SOFTWARE\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD} Key Found : HKLM\SOFTWARE\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257} Key Found : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF} Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840} Key Found : HKLM\SOFTWARE\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064} Key Found : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797} Key Found : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6} Key Found : HKLM\SOFTWARE\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF} Key Found : HKLM\SOFTWARE\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81} Key Found : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63} Key Found : HKLM\SOFTWARE\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758} Key Found : HKLM\SOFTWARE\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289} Key Found : HKLM\SOFTWARE\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD} Key Found : HKLM\SOFTWARE\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2} Key Found : HKLM\SOFTWARE\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83} Key Found : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823} Key Found : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA} Key Found : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16} Key Found : HKLM\SOFTWARE\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F} Key Found : HKLM\SOFTWARE\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898} Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984} Key Found : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler Key Found : HKLM\SOFTWARE\Classes\Iminent Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1 Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1 Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1 Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1 Key Found : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Key Found : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Key Found : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Key Found : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Key Found : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Key Found : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Key Found : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Key Found : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Key Found : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Key Found : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Key Found : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Key Found : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Key Found : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Key Found : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Key Found : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Key Found : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Key Found : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Found : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Key Found : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Key Found : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Key Found : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Key Found : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Key Found : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Key Found : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Key Found : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5} Key Found : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Key Found : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Key Found : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Key Found : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Key Found : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113} Key Found : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36} Key Found : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Key Found : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Key Found : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Key Found : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Key Found : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Key Found : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Key Found : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Key Found : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Key Found : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Key Found : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Key Found : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Key Found : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Key Found : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Key Found : HKLM\SOFTWARE\Classes\MF Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF} Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl Key Found : HKLM\Software\Iminent Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CF0E9A-D48B-4942-9537-259ED0568DF4} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp -\\ Mozilla Firefox v13.0.1 (de) Profile name : default File : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\prefs.js Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Found : user_pref("browser.search.defaultenginename", "AVG Secure Search"); Found : user_pref("browser.search.order.1", "Search the web (Babylon)"); Found : user_pref("browser.startup.homepage", "hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e[...] Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Found : user_pref("extensions.BabylonToolbar_i.babExt", ""); Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=060612_5_"); Found : user_pref("extensions.BabylonToolbar_i.hardId", "70fd172f00000000000000235a6166e6"); Found : user_pref("extensions.BabylonToolbar_i.id", "70fd172f00000000000000235a6166e6"); Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15511"); Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Found : user_pref("extensions.BabylonToolbar_i.newTab", true); Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=06061[...] Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:56:43"); Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Found : user_pref("greasemonkey.scriptvals.71f8f12556abe601d230ac099af2e207/Sharecash survey bypasser, metho[...] Found : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&[...] -\\ Google Chrome v22.0.1229.79 File : C:\Users\Janis\AppData\Local\Google\Chrome\User Data\Default\Preferences Found [l.12] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp", Found [l.1764] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp", ************************* AdwCleaner[R1].txt - [20972 octets] - [04/10/2012 17:56:18] ########## EOF - C:\AdwCleaner[R1].txt - [21033 octets] ########## |
|
| Themen zu selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... |
| ahnung, appdata, automatisch, dateien, dateiname, download, einfach, erstellen, funktioniert, home, ide, laptop, leute, löschen, ordner, prozesse, screenshot, systemleistung, task manager, taskmanager, viren, virus, windows, windows 7, öffnen |
Textbox.
Linear-Darstellung
