Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Schweizer Eidgenossenschaft Virus eingefangen!

Schweizer Eidgenossenschaft Virus eingefangen!


Plagegeister aller Art und deren Bekämpfung: Schweizer Eidgenossenschaft Virus eingefangen!

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 03.10.2012, 22:04   #1
burghex24
 
Schweizer Eidgenossenschaft Virus eingefangen! - Standard

Schweizer Eidgenossenschaft Virus eingefangen!


Ich kann leider nicht mehr am Computer was machen..kommt jedesmal beim normalem Starten Schweizer Eidgenossenschaft Trojaner mit der Aufforderung 100 SFR zu bezahlen.
Jetzt habe ich im abgesichertenm Modus den OTL-Text kopiert!

Bin dankbar für jede Hilfe!

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 04/10/2012 01:11:46 - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = E:\PROGRAMS\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
7.00 Gb Paging File | 7.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 584.42 Gb Total Space | 481.18 Gb Free Space | 82.33% Space Free | Partition Type: NTFS
Drive D: | 11.65 Gb Total Space | 1.19 Gb Free Space | 10.23% Space Free | Partition Type: NTFS
Drive E: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: SASCHA-HP | User Name: Sascha
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/06/27 16:52:00 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010/04/23 21:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) [Auto] -- C:\Windows\System32\ezSharedSvcHost.exe -- (ezSharedSvc)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012/08/27 18:14:50 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/05/08 17:43:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/08 17:43:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/11/19 21:51:51 | 000,075,136 | ---- | M] () [Auto] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/09/09 18:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011/06/29 15:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand] -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011/03/28 18:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/04/04 01:01:24 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/15 00:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto] -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/06/26 20:09:36 | 000,167,936 | ---- | M] () [Auto] -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe -- (WlanWpsSvc)
 
 
========== Driver Services (SafeList) ==========
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Schweiz : Hotmail, Messenger, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\Sascha\AppData\Local\Roblox\Versions\version-fb3436d54f9e4598\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\@powerchallenge.com/PowerLoader: C:\Users\Sascha\AppData\LocalLow\POWERC~1\nppowerloader.dll (Power Challenge Sweden AB)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/20 20:13:26 | 000,000,000 | ---D | M]
 
[2011/01/16 23:06:00 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Extensions
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (SearchCore for Browsers) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\BROWSE~1.DLL (SearchCore for Browsers)
O2 - BHO: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SearchCore for Browsers) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~2\SEARCH~1\SEARCH~1\BROWSE~1.DLL (SearchCore for Browsers)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-191333542-478042241-1473518873-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-191333542-478042241-1473518873-1001\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O4:64bit: - HKLM..\Run: [FullScreen]  File not found
O4:64bit: - HKLM..\Run: [hpsysdrv] C:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\SEARCH~1\DATAMN~1.EXE (iMesh, Inc)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: []  File not found
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: [Badoo Desktop]  File not found
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: [Ubzexucega] C:\Users\Sascha\AppData\Roaming\Neovo\ywray.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found
F3:64bit: - HKU\S-1-5-21-191333542-478042241-1473518873-1001 WinNT: Load - (C:\Users\Sascha\LOCALS~1\Temp\msiakw.exe) -  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 91.233.182.2 194.230.1.39
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll (iMesh, Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll (iMesh, Inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll (iMesh, Inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll (iMesh, Inc)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\System32\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-191333542-478042241-1473518873-1001 Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-191333542-478042241-1473518873-1001 Winlogon: Shell - (C:\Users\Sascha\AppData\Roaming\msconfig.dat) - C:\Users\Sascha\AppData\Roaming\msconfig.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 13:06:41 | 000,000,053 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\reatogoMenu.exe -- [2005/07/16 23:36:50 | 000,240,128 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/22 08:19:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/09/22 08:19:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/09/22 08:19:27 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2012/09/22 08:19:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/09/22 08:19:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/09/22 08:19:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/09/22 08:19:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/09/22 08:19:27 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/09/22 08:19:27 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/09/22 08:19:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/09/22 08:19:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/09/22 08:19:25 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2012/09/22 08:19:25 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012/09/22 08:19:23 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/09/22 08:19:23 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/09/22 08:19:23 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/09/22 08:19:23 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Urokwo
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Lyfoy
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Cetudi
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Wuusud
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Neovo
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ebusuw
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Upuzka
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ugyzt
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Iqywna
[2012/09/12 19:34:16 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10level9.dll
[2012/09/12 19:34:16 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/10/04 01:03:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/04 01:03:50 | 3019,333,632 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/03 20:16:13 | 000,000,047 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\msconfig.ini
[2012/10/03 20:15:50 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/03 19:18:33 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/03 17:53:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/01 00:33:29 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForSascha.job
[2012/09/27 21:05:34 | 000,000,378 | ---- | M] () -- C:\Windows\tasks\ReclaimerResumeInstall_Sascha.job
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/10/03 19:38:27 | 000,000,047 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\msconfig.ini
[2012/09/27 21:20:58 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForSascha.job
[2012/09/26 20:10:51 | 000,000,378 | ---- | C] () -- C:\Windows\tasks\ReclaimerResumeInstall_Sascha.job
[2012/04/15 16:16:28 | 000,000,168 | -H-- | C] () -- C:\ProgramData\-a2nTSv2scHA1SCr
[2012/04/15 16:16:28 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-a2nTSv2scHA1SC
[2012/04/15 16:16:25 | 000,000,256 | -H-- | C] () -- C:\ProgramData\a2nTSv2scHA1SC
[2012/01/11 11:08:59 | 000,077,824 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\msconfig.dat
[2011/11/19 19:18:07 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/11/19 19:18:05 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011/11/19 19:18:05 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/06/27 17:23:20 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/06/23 18:41:45 | 000,001,854 | -H-- | C] () -- C:\Users\Sascha\AppData\Roaming\GhostObjGAFix.xml
[2011/04/18 17:55:07 | 001,526,296 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/01/13 21:25:51 | 000,146,721 | ---- | C] () -- C:\Windows\hpoins44.dat
[2011/01/13 21:25:51 | 000,000,512 | ---- | C] () -- C:\Windows\hpomdl44.dat
[2011/01/12 19:17:42 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/11/02 00:45:10 | 000,009,988 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2010/11/02 00:18:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2012/09/20 18:29:27 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\Babylon
[2012/09/20 18:12:03 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Cetudi
[2011/04/19 19:52:20 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2012/09/18 22:50:04 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Ebusuw
[2012/09/18 22:48:36 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Iqywna
[2012/09/25 18:10:44 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Lyfoy
[2011/10/18 21:32:55 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\MusicNet
[2012/09/18 22:50:04 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Neovo
[2012/04/15 16:45:46 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\OpenCandy
[2012/09/27 22:39:41 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\SoftGrid Client
[2011/09/16 19:42:32 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\temp
[2011/04/18 17:56:04 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\TP
[2012/09/20 20:18:51 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Ugyzt
[2012/09/20 18:22:10 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Upuzka
[2012/09/20 18:12:03 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Urokwo
[2011/01/20 20:38:38 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\WinBatch
[2012/10/02 19:16:16 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Wuusud
[2011/10/18 21:32:55 | 000,000,000 | -H-D | M] -- C:\ProgramData\37301
[2012/04/10 20:07:20 | 000,000,000 | -H-D | M] -- C:\ProgramData\AMD
[2010/11/02 00:28:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AmUStor
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/04/03 21:28:03 | 000,000,000 | -H-D | M] -- C:\ProgramData\Babylon
[2011/10/18 21:32:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\boost_interprocess
[2012/03/24 12:35:31 | 000,000,000 | -H-D | M] -- C:\ProgramData\Codemasters
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/10/01 00:34:16 | 000,000,000 | -H-D | M] -- C:\ProgramData\PDFC
[2012/10/04 06:14:40 | 000,000,000 | -H-D | M] -- C:\ProgramData\Recovery
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2012/04/15 16:37:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/04/18 20:17:16 | 000,000,000 | -H-D | M] -- C:\ProgramData\VirtualizedApplications
[2012/04/15 16:45:27 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent
[2010/11/02 00:29:50 | 000,000,000 | ---D | M] -- C:\ProgramData\{0F47B255-CF9F-48C5-B558-B7DAF9345268}
[2011/01/20 20:39:49 | 000,000,000 | ---D | M] -- C:\ProgramData\{23D58E70-3B83-4B83-A227-68770F84F5EC}
[2012/03/11 20:19:42 | 000,000,000 | ---D | M] -- C:\ProgramData\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}
[2011/09/15 19:40:13 | 000,000,000 | ---D | M] -- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
[2012/09/27 21:05:34 | 000,000,378 | ---- | M] () -- C:\Windows\Tasks\ReclaimerResumeInstall_Sascha.job
[2012/08/31 17:33:35 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

Alt 04.10.2012, 00:02   #2
markusg
/// Malware-holic
 
Schweizer Eidgenossenschaft Virus eingefangen! - Standard

Schweizer Eidgenossenschaft Virus eingefangen!


hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
ATTFilter
:OTL
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: [Ubzexucega] C:\Users\Sascha\AppData\Roaming\Neovo\ywray.exe ()
F3:64bit: - HKU\S-1-5-21-191333542-478042241-1473518873-1001 WinNT: Load - (C:\Users\Sascha\LOCALS~1\Temp\msiakw.exe) -  File not found
O20 - HKU\S-1-5-21-191333542-478042241-1473518873-1001 Winlogon: Shell - (C:\Users\Sascha\AppData\Roaming\msconfig.dat) - C:\Users\Sascha\AppData\Roaming\msconfig.dat
()
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Urokwo
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Lyfoy
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Cetudi
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Wuusud
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Neovo
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ebusuw
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Upuzka
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ugyzt
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Iqywna
:Files
C:\Users\Sascha\AppData\Roaming\Neovo
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus
__________________

__________________
Alt 04.10.2012, 18:55   #3
burghex24
 
Schweizer Eidgenossenschaft Virus eingefangen! - Standard

Schweizer Eidgenossenschaft Virus eingefangen!


Danke erst mal für deine rasche Antwort!Es ist so ich habe die Fix.txt in das programm eingefügt und auf den Button Run Fix gedrückt aber es tat sich dann nicht.Ich muss auch dazu sagen das das Programm bei mir nur über den gesicherten Modus läuft!Das heisst ich gehe dann im gesicherten Modus auf mein Laufwerk und öffne das Programm manuel.Vielleicht ist es ja auch alles richtig was ich gemacht habe.Hier nochmal der das aktuelle otl-txt:
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 05/10/2012 00:37:33 - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = E:\PROGRAMS\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 80.00% Memory free
7.00 Gb Paging File | 7.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 584.42 Gb Total Space | 481.13 Gb Free Space | 82.32% Space Free | Partition Type: NTFS
Drive D: | 11.65 Gb Total Space | 1.19 Gb Free Space | 10.23% Space Free | Partition Type: NTFS
Drive E: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 491.52 Mb Total Space | 490.82 Mb Free Space | 99.86% Space Free | Partition Type: FAT
 
Computer Name: SASCHA-HP | User Name: Sascha
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/06/27 16:52:00 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010/04/23 21:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) [Auto] -- C:\Windows\System32\ezSharedSvcHost.exe -- (ezSharedSvc)
SRV:64bit: - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012/08/27 18:14:50 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/05/08 17:43:44 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/08 17:43:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/11/19 21:51:51 | 000,075,136 | ---- | M] () [Auto] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/09/09 18:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011/06/29 15:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand] -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011/03/28 18:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/04/04 01:01:24 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/15 00:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto] -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/06/26 20:09:36 | 000,167,936 | ---- | M] () [Auto] -- C:\Program Files (x86)\D-Link\DWA-131 revA\WlanWpsSvc.exe -- (WlanWpsSvc)
 
 
========== Driver Services (SafeList) ==========
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQCON/11
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/CQCON/11
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQCON/11
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/CQCON/11
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/CQCON/11
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQCON/11
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-191333542-478042241-1473518873-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: C:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\Sascha\AppData\Local\Roblox\Versions\version-fb3436d54f9e4598\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\@powerchallenge.com/PowerLoader: C:\Users\Sascha\AppData\LocalLow\POWERC~1\nppowerloader.dll (Power Challenge Sweden AB)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/20 20:13:26 | 000,000,000 | ---D | M]
 
[2011/01/16 23:06:00 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Extensions
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (SearchCore for Browsers) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\BROWSE~1.DLL (SearchCore for Browsers)
O2 - BHO: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SearchCore for Browsers) - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\PROGRA~2\SEARCH~1\SEARCH~1\BROWSE~1.DLL (SearchCore for Browsers)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-191333542-478042241-1473518873-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-191333542-478042241-1473518873-1001\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O4:64bit: - HKLM..\Run: [FullScreen]  File not found
O4:64bit: - HKLM..\Run: [hpsysdrv] C:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\SEARCH~1\DATAMN~1.EXE (iMesh, Inc)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: []  File not found
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: [Badoo Desktop]  File not found
O4 - HKU\S-1-5-21-191333542-478042241-1473518873-1001..\Run: [Ubzexucega] C:\Users\Sascha\AppData\Roaming\Neovo\ywray.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found
F3:64bit: - HKU\S-1-5-21-191333542-478042241-1473518873-1001 WinNT: Load - (C:\Users\Sascha\LOCALS~1\Temp\msiakw.exe) -  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 91.233.182.2 194.230.1.39
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll (iMesh, Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll (iMesh, Inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll (iMesh, Inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll (iMesh, Inc)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\System32\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-191333542-478042241-1473518873-1001 Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-191333542-478042241-1473518873-1001 Winlogon: Shell - (C:\Users\Sascha\AppData\Roaming\msconfig.dat) - C:\Users\Sascha\AppData\Roaming\msconfig.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 13:06:41 | 000,000,053 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\reatogoMenu.exe -- [2005/07/16 23:36:50 | 000,240,128 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/22 08:19:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/09/22 08:19:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/09/22 08:19:27 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2012/09/22 08:19:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/09/22 08:19:27 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/09/22 08:19:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/09/22 08:19:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/09/22 08:19:27 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/09/22 08:19:27 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/09/22 08:19:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/09/22 08:19:25 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/09/22 08:19:25 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2012/09/22 08:19:25 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012/09/22 08:19:23 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/09/22 08:19:23 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/09/22 08:19:23 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/09/22 08:19:23 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Urokwo
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Lyfoy
[2012/09/20 18:12:03 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Cetudi
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Wuusud
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Neovo
[2012/09/18 22:50:04 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ebusuw
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Upuzka
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ugyzt
[2012/09/18 22:48:36 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Iqywna
[2012/09/12 19:34:16 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10level9.dll
[2012/09/12 19:34:16 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/10/05 00:04:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/05 00:04:47 | 3019,333,632 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/04 22:59:21 | 000,000,047 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\msconfig.ini
[2012/10/04 22:57:09 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/03 19:18:33 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/03 17:53:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/01 00:33:29 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForSascha.job
[2012/09/27 21:05:34 | 000,000,378 | ---- | M] () -- C:\Windows\tasks\ReclaimerResumeInstall_Sascha.job
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/10/03 19:38:27 | 000,000,047 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\msconfig.ini
[2012/09/27 21:20:58 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForSascha.job
[2012/09/26 20:10:51 | 000,000,378 | ---- | C] () -- C:\Windows\tasks\ReclaimerResumeInstall_Sascha.job
[2012/04/15 16:16:28 | 000,000,168 | -H-- | C] () -- C:\ProgramData\-a2nTSv2scHA1SCr
[2012/04/15 16:16:28 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-a2nTSv2scHA1SC
[2012/04/15 16:16:25 | 000,000,256 | -H-- | C] () -- C:\ProgramData\a2nTSv2scHA1SC
[2012/01/11 11:08:59 | 000,077,824 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\msconfig.dat
[2011/11/19 19:18:07 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/11/19 19:18:05 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011/11/19 19:18:05 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011/09/28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/06/27 17:23:20 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011/06/23 18:41:45 | 000,001,854 | -H-- | C] () -- C:\Users\Sascha\AppData\Roaming\GhostObjGAFix.xml
[2011/04/18 17:55:07 | 001,526,296 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/01/13 21:25:51 | 000,146,721 | ---- | C] () -- C:\Windows\hpoins44.dat
[2011/01/13 21:25:51 | 000,000,512 | ---- | C] () -- C:\Windows\hpomdl44.dat
[2011/01/12 19:17:42 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/11/02 00:45:10 | 000,009,988 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2010/11/02 00:18:59 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2012/09/20 18:29:27 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\Babylon
[2012/09/20 18:12:03 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Cetudi
[2011/04/19 19:52:20 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2012/09/18 22:50:04 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Ebusuw
[2012/09/18 22:48:36 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Iqywna
[2012/09/25 18:10:44 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Lyfoy
[2011/10/18 21:32:55 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\MusicNet
[2012/09/18 22:50:04 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Neovo
[2012/04/15 16:45:46 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\OpenCandy
[2012/09/27 22:39:41 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\SoftGrid Client
[2011/09/16 19:42:32 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\temp
[2011/04/18 17:56:04 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\TP
[2012/09/20 20:18:51 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Ugyzt
[2012/09/20 18:22:10 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Upuzka
[2012/09/20 18:12:03 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Urokwo
[2011/01/20 20:38:38 | 000,000,000 | -H-D | M] -- C:\Users\Sascha\AppData\Roaming\WinBatch
[2012/10/02 19:16:16 | 000,000,000 | ---D | M] -- C:\Users\Sascha\AppData\Roaming\Wuusud
[2011/10/18 21:32:55 | 000,000,000 | -H-D | M] -- C:\ProgramData\37301
[2012/04/10 20:07:20 | 000,000,000 | -H-D | M] -- C:\ProgramData\AMD
[2010/11/02 00:28:43 | 000,000,000 | ---D | M] -- C:\ProgramData\AmUStor
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/04/03 21:28:03 | 000,000,000 | -H-D | M] -- C:\ProgramData\Babylon
[2011/10/18 21:32:58 | 000,000,000 | -H-D | M] -- C:\ProgramData\boost_interprocess
[2012/03/24 12:35:31 | 000,000,000 | -H-D | M] -- C:\ProgramData\Codemasters
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/10/01 00:34:16 | 000,000,000 | -H-D | M] -- C:\ProgramData\PDFC
[2012/10/04 06:14:40 | 000,000,000 | -H-D | M] -- C:\ProgramData\Recovery
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2012/04/15 16:37:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2009/07/14 07:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/04/18 20:17:16 | 000,000,000 | -H-D | M] -- C:\ProgramData\VirtualizedApplications
[2012/04/15 16:45:27 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent
[2010/11/02 00:29:50 | 000,000,000 | ---D | M] -- C:\ProgramData\{0F47B255-CF9F-48C5-B558-B7DAF9345268}
[2011/01/20 20:39:49 | 000,000,000 | ---D | M] -- C:\ProgramData\{23D58E70-3B83-4B83-A227-68770F84F5EC}
[2012/03/11 20:19:42 | 000,000,000 | ---D | M] -- C:\ProgramData\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}
[2011/09/15 19:40:13 | 000,000,000 | ---D | M] -- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}
[2012/09/27 21:05:34 | 000,000,378 | ---- | M] () -- C:\Windows\Tasks\ReclaimerResumeInstall_Sascha.job
[2012/08/31 17:33:35 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---
__________________
Alt 04.10.2012, 20:12   #4
markusg
/// Malware-holic
 
Schweizer Eidgenossenschaft Virus eingefangen! - Standard

Schweizer Eidgenossenschaft Virus eingefangen!


hi
1. soll man das eigendlich über cd starten.
2. kannst du den fix perhand eintragen und dann auf runfix klicken, dass sollte gehen
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Schweizer Eidgenossenschaft Virus eingefangen!
abgesicherte, arten, aufforderung, compu, computer, dankbar, eidgenossenschaft, eingefangen, gefangen, hilfe!, jedesmal, kopiert, modus, nicht mehr, normalem, plug-in, schaf, searchcore, starte, starten, troja, trojaner, virus, virus eingefangen


« Skype Virus | Trojan.Generic.KDV.84266 »


Ähnliche Themen: Schweizer Eidgenossenschaft Virus eingefangen!


  1. Schweizerische Eidgenossenschaft Virus auf MAC OS X
    Alles rund um Mac OSX & Linux - 04.11.2013 (0)
  2. Schweizer IT-Sicherheitsbehörde warnt vor Vormachtstellung der USA
    Nachrichten - 30.10.2013 (0)
  3. CIBS POL Schweizer Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 25.05.2013 (10)
  4. Schweizer Variante des GVU-Trojaners auf Netbook
    Plagegeister aller Art und deren Bekämpfung - 19.02.2013 (12)
  5. Cybercrime investigation department Schweizer Eidgenossenschaft
    Log-Analyse und Auswertung - 19.01.2013 (14)
  6. Schweizer Eidgenossenschaft Trojaner
    Plagegeister aller Art und deren Bekämpfung - 14.01.2013 (10)
  7. BKA-Virus schweizer Version, Windows XP
    Plagegeister aller Art und deren Bekämpfung - 25.11.2012 (18)
  8. Virus Schweizer Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 24.11.2012 (22)
  9. Schweizerische Eidgenossenschaft, Windows 7 x64
    Log-Analyse und Auswertung - 12.11.2012 (6)
  10. schweizer eidgenossenschaft - trojaner
    Plagegeister aller Art und deren Bekämpfung - 17.10.2012 (59)
  11. Ukash, Schweizerische Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 01.10.2012 (11)
  12. Ukash & Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (13)
  13. PC gesperrt - Schweizer Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 10.09.2012 (1)
  14. Computer gesperrt, schweizerische eidgenossenschaft?
    Log-Analyse und Auswertung - 08.09.2012 (1)
  15. Virus Schweizer Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 27.08.2012 (13)
  16. Laptop gesperrt: Schweizer Eidgenossenschaft
    Plagegeister aller Art und deren Bekämpfung - 20.08.2012 (25)
  17. Computer gesperrt! Ukash-Virus (Schweizer Version)
    Plagegeister aller Art und deren Bekämpfung - 16.07.2012 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Schweizer Eidgenossenschaft Virus eingefangen! - Ich kann leider nicht mehr am Computer was machen..kommt jedesmal beim normalem Starten Schweizer Eidgenossenschaft Trojaner mit der Aufforderung 100 SFR zu bezahlen. Jetzt habe ich im abgesichertenm Modus den - Schweizer Eidgenossenschaft Virus eingefangen!...
Archiv
Du betrachtest: Schweizer Eidgenossenschaft Virus eingefangen! auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130