| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ukash Bundepolize TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.11.2012, 21:02
| #16 |
| /// TB-Ausbilder  |  Ukash Bundepolize Trojaner Steht in der Anleitung ... Funde erstmal nicht entfernen.
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
01.11.2012, 22:17
| #17 |
 | Ukash Bundepolize Trojaner hab ich auch noch nicht gemacht ... hab nur gesehn das du gepostet hast poste mir das NICHTS gefunden wurde ... wurde aber
__________________ hatte blos versehentlich den log nicht gespeichert deswegen musste ich den kram nun erneut laufen lassen damit ich den log erneut bekomme :-[ |
|
01.11.2012, 22:25
| #18 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner kann nicht schaden zwei mal zu scannen
__________________ |
|
01.11.2012, 22:25
| #19 |
| | Ukash Bundepolize Trojaner So, dann hier der Malware Log: Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.01.06 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 Isy :: ISY-PC [Administrator] 01.11.2012 18:25:21 mbam-log-2012-11-01 (18-25-21).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 198255 Laufzeit: 4 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Isy\AppData\Roaming\BAcroIEHelpe114.dll (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Isy\AppData\Roaming\loaupdt.jpg (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter C:\Users\Isy\AppData\Roaming\AcroIEHelpe112.dll Variante von Win32/Spy.Banker.YAT Trojaner
C:\_OTL\MovedFiles\10292012_221128\C_ProgramData\qdkettig.exe Variante von Win32/Injector.XKY Trojaner
C:\_OTL\MovedFiles\10292012_221128\C_ProgramData\tgwcfcouxpvxprt\main.html HTML/Ransom.B Trojaner
|
|
03.11.2012, 12:02
| #20 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Rückmeldungen zu Schritt 3 bis 5 fehlen. Benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
03.11.2012, 12:04
| #21 |
| | Ukash Bundepolize Trojaner Oh entschuldige, durch die aussage melde das der ESET Scan nichts gefunden hat war ich mir jetzt nicht mehr sicher ob ich dann weiter fortfahren sollte, da ja noch etwas gefunden wurde, ich lade gerade die updates. |
|
03.11.2012, 12:07
| #22 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Alles klar. Es ist auch nicht mehr viel zu machen
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
03.11.2012, 12:36
| #23 |
| | Ukash Bundepolize Trojaner So, es gab nicht mehr für alle Firefox plugins updates aber hier ist der Log: OTL Logfile: Code:
ATTFilter OTL logfile created on: 03.11.2012 12:23:57 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Isy\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 50,61% Memory free 4,22 Gb Paging File | 2,94 Gb Available in Paging File | 69,86% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,44 Gb Total Space | 20,87 Gb Free Space | 17,92% Space Free | Partition Type: NTFS Drive D: | 106,68 Gb Total Space | 106,58 Gb Free Space | 99,91% Space Free | Partition Type: NTFS Computer Name: ISY-PC | User Name: Isy | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.24 10:22:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Isy\Desktop\OTL.exe PRC - [2009.03.07 12:21:23 | 000,261,632 | ---- | M] () -- C:\Users\Isy\Adobe Media Player\Adobe Media Player.exe PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.08.23 12:39:23 | 002,641,920 | ---- | M] (pdfforge hxxp://www.pdfforge.org/) -- C:\_OTL\MovedFiles\10302012_213502\C_Program Files\PDFCreator\PDFCreator.exe PRC - [2008.06.26 21:50:27 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe PRC - [2008.01.31 13:01:38 | 000,159,744 | R--- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe PRC - [2008.01.21 03:23:53 | 001,143,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wercon.exe PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2007.09.29 03:59:08 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe PRC - [2007.09.01 01:38:12 | 000,180,224 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe PRC - [2007.08.19 06:26:59 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe PRC - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe PRC - [2007.08.03 04:52:40 | 000,778,240 | ---- | M] () -- C:\Program Files\P4P\P4P.exe PRC - [2007.08.02 03:27:50 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe PRC - [2007.07.12 18:25:28 | 000,225,280 | ---- | M] () -- C:\Program Files\ATK Hotkey\HControl.exe PRC - [2007.07.11 01:33:58 | 000,106,496 | ---- | M] () -- C:\Program Files\ATK Hotkey\WDC.exe PRC - [2007.07.10 18:59:56 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe PRC - [2007.05.24 00:56:14 | 002,420,736 | ---- | M] () -- C:\Program Files\ATK Hotkey\ATKOSD.exe PRC - [2007.05.18 10:31:16 | 000,073,728 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2007.04.17 21:39:42 | 000,077,824 | ---- | M] () -- C:\Program Files\ATK Hotkey\KBFiltr.exe PRC - [2007.02.06 02:13:14 | 000,094,208 | ---- | M] () -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe PRC - [2007.01.18 03:26:36 | 007,708,672 | ---- | M] () -- C:\Program Files\ATKOSD2\ATKOSD2.exe PRC - [2006.12.21 07:03:38 | 001,036,288 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe ========== Modules (No Company Name) ========== MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2009.03.07 12:21:23 | 000,261,632 | ---- | M] () -- C:\Users\Isy\Adobe Media Player\Adobe Media Player.exe MOD - [2008.06.26 21:50:27 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe MOD - [2007.08.14 21:59:54 | 006,365,184 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll MOD - [2007.08.03 04:52:40 | 000,778,240 | ---- | M] () -- C:\Program Files\P4P\P4P.exe MOD - [2007.08.02 03:27:50 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe MOD - [2007.07.12 21:55:52 | 000,131,072 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2007.07.12 21:55:28 | 001,581,056 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll MOD - [2007.06.15 18:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll MOD - [2007.06.02 03:01:21 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll MOD - [2007.06.02 01:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll ========== Services (SafeList) ========== SRV - [2012.11.03 12:22:09 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.10.14 16:32:00 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2007.08.03 20:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr) SRV - [2007.05.18 10:31:16 | 000,073,728 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) SRV - [2007.02.06 02:13:14 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIM) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard) DRV - [2009.10.02 09:59:16 | 000,489,952 | ---- | M] (ITETech ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AF15BDA.sys -- (AF15BDA) DRV - [2007.10.02 15:59:45 | 001,769,984 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) DRV - [2007.08.11 04:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm) DRV - [2007.08.05 05:26:21 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio) DRV - [2007.07.31 06:13:10 | 000,743,424 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP) DRV - [2007.06.19 08:51:20 | 000,107,304 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816mdm.sys -- (s816mdm) DRV - [2007.06.19 08:51:18 | 000,099,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816mgmt.sys -- (s816mgmt) DRV - [2007.06.19 08:51:18 | 000,097,704 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816unic.sys -- (s816unic) DRV - [2007.06.19 08:51:18 | 000,097,320 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816obex.sys -- (s816obex) DRV - [2007.06.19 08:51:18 | 000,021,928 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816nd5.sys -- (s816nd5) DRV - [2007.06.19 08:51:18 | 000,013,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816mdfl.sys -- (s816mdfl) DRV - [2007.06.19 08:51:16 | 000,081,832 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s816bus.sys -- (s816bus) DRV - [2007.03.22 06:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007.02.24 22:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007.01.26 19:08:39 | 000,005,632 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr) DRV - [2007.01.24 00:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006.12.17 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor) DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{080FBDF6-B230-4e4d-A4E7-7C7A56D7BABC}: "URL" = hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry={searchTerms}&type=Web&orig=IMC-IE IE - HKCU\..\SearchScopes\{31CF9EBE-5755-4a1d-AC25-2834D952D9B4}: "URL" = hxxp://search.pdfcreator-toolbar.org/search?p=Q&ts=ne&w={searchTerms}&csrc=search-field IE - HKCU\..\SearchScopes\{8F7A06B7-E051-47C5-A403-59F1DFCD4CFB}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.10 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.03 12:22:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.03 12:16:49 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.03 12:22:13 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.03 12:16:49 | 000,000,000 | ---D | M] [2008.12.08 16:01:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Isy\AppData\Roaming\mozilla\Extensions [2012.11.03 12:20:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Isy\AppData\Roaming\mozilla\Firefox\Profiles\xdbnt2my.default\extensions [2011.03.16 14:58:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Isy\AppData\Roaming\mozilla\Firefox\Profiles\xdbnt2my.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.05.29 13:40:32 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Isy\AppData\Roaming\mozilla\Firefox\Profiles\xdbnt2my.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2009.10.31 15:44:37 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-10.xml [2009.12.23 13:55:23 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-11.xml [2010.01.07 18:27:43 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-12.xml [2010.03.02 16:57:57 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-13.xml [2010.04.01 08:30:34 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-14.xml [2011.03.31 16:27:03 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-15.xml [2011.04.30 17:31:42 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-16.xml [2011.05.24 18:34:55 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-17.xml [2011.07.01 11:03:02 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-18.xml [2011.09.11 13:39:07 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-19.xml [2011.10.13 16:26:52 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-20.xml [2011.10.29 09:59:10 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-21.xml [2011.11.08 17:17:14 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-22.xml [2011.11.13 17:17:55 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-23.xml [2011.12.02 18:00:41 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-24.xml [2011.12.22 12:01:30 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-25.xml [2012.01.10 18:55:58 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-26.xml [2012.01.17 13:01:26 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-27.xml [2012.02.15 10:59:10 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-28.xml [2012.02.16 15:00:11 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-29.xml [2012.02.25 19:12:15 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-30.xml [2012.04.29 15:25:31 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-31.xml [2009.04.02 16:49:07 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-4.xml [2009.05.05 15:43:17 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-5.xml [2009.06.19 12:35:55 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-6.xml [2009.07.26 15:23:10 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-7.xml [2009.08.08 13:54:58 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-8.xml [2009.09.13 17:14:32 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin-9.xml [2012.11.03 12:20:08 | 000,000,950 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\icqplugin.xml [2008.12.12 19:23:54 | 000,002,158 | ---- | M] () -- C:\Users\Isy\AppData\Roaming\mozilla\firefox\profiles\xdbnt2my.default\searchplugins\MySpace.xml [2012.11.03 12:16:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2009.07.25 14:45:29 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.11.03 12:16:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012.11.03 12:22:12 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.11.03 12:22:04 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.03 12:22:04 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.11.03 12:22:04 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.11.03 12:22:04 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.11.03 12:22:04 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.11.03 12:22:04 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com CHR - default_search_provider: Yahoo! (Enabled) CHR - default_search_provider: search_url = hxxp://de.search.yahoo.com/search?fr=chr-greentree_gc&ei=utf-8&ilc=12&type=937811&p={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://www.google.com CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.94\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: YouTube = C:\Users\Isy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Isy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\Isy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe () O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe () O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\P4P\P4P.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent File not found O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found O4 - Startup: C:\Users\Isy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Users\Isy\Adobe Media Player\Adobe Media Player.exe () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Isy\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} hxxp://www3.snapfish.de/SnapfishActivia.cab (Snapfish Activia) O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1222596421 (Image Uploader Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {BA3BAF69-72B1-4BCE-BE96-A4D304EAFBB4} hxxp://assets.photobox.com/assets/aurigma/ImageUploader4.cab?20081022122533 (PhotoBox uploader) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{930CCADA-83CE-40C5-B50A-651EB469936F}: DhcpNameServer = 192.168.0.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Isy\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Isy\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{38c7833c-7cdf-11e1-b187-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{38c7833c-7cdf-11e1-b187-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{38c78352-7cdf-11e1-b187-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{38c78352-7cdf-11e1-b187-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{38c78361-7cdf-11e1-b187-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{38c78361-7cdf-11e1-b187-001fc67f864e}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{648d15b7-b9dd-11e1-bd31-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{648d15b7-b9dd-11e1-bd31-001fc67f864e}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{ad7f4ff1-6db6-11e0-bb5c-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{ad7f4ff1-6db6-11e0-bb5c-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{dd0039a7-7810-11e0-8b6d-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{dd0039a7-7810-11e0-8b6d-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{dd0039b9-7810-11e0-8b6d-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{dd0039b9-7810-11e0-8b6d-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f52bbcc9-73f6-11e0-a40d-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{f52bbcc9-73f6-11e0-a40d-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f52bbce2-73f6-11e0-a40d-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{f52bbce2-73f6-11e0-a40d-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f8ed9620-7e79-11e1-9ae7-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{f8ed9620-7e79-11e1-9ae7-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f8ed962c-7e79-11e1-9ae7-001fc67f864e}\Shell - "" = AutoRun O33 - MountPoints2\{f8ed962c-7e79-11e1-9ae7-001fc67f864e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.11.01 18:40:15 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2012.10.30 03:11:28 | 000,000,000 | ---D | C] -- C:\_OTL [2012.10.29 23:02:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Isy\Desktop\OTL.exe [2012.10.27 12:52:34 | 000,000,000 | ---D | C] -- C:\Users\Isy\AppData\Roaming\Malwarebytes [2012.10.27 12:52:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.10.27 12:52:21 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.10.27 12:52:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.10.14 16:23:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.10.14 16:21:44 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.10.14 16:21:40 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.10.14 16:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2012.10.14 14:01:08 | 020,664,552 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Users\Isy\Desktop\FreeYouTubeToMP3Converter33.exe [2012.10.07 20:16:32 | 000,000,000 | -HSD | C] -- C:\found.000 [2011.11.10 18:49:59 | 015,184,088 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Users\Isy\FreeYouTubeToMP3Converter.exe [1 C:\Users\Isy\AppData\Roaming\*.tmp files -> C:\Users\Isy\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.03 12:20:10 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.11.03 12:16:30 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.11.03 12:16:30 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.11.03 12:16:30 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.11.03 12:16:30 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.11.03 12:15:09 | 000,000,414 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{22A22202-E31B-49CA-AAA7-3D805DF235C4}.job [2012.11.03 12:10:13 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.11.03 12:09:52 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.03 12:09:52 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.03 12:09:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.03 12:09:44 | 2138,300,416 | -HS- | M] () -- C:\hiberfil.sys [2012.11.01 23:01:53 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2012.11.01 22:02:09 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.10.30 20:13:39 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe [2012.10.29 21:58:24 | 000,538,941 | ---- | M] () -- C:\Users\Isy\Desktop\adwcleaner.exe [2012.10.27 13:13:12 | 000,001,356 | ---- | M] () -- C:\Users\Isy\AppData\Local\d3d9caps.dat [2012.10.27 13:01:36 | 000,125,952 | ---- | M] () -- C:\Users\Isy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.10.24 10:22:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Isy\Desktop\OTL.exe [2012.10.14 16:14:06 | 000,004,303 | ---- | M] () -- C:\Users\Isy\Stellenangebote.abw [2012.10.14 14:02:22 | 020,664,552 | ---- | M] (DVDVideoSoft Ltd. ) -- C:\Users\Isy\Desktop\FreeYouTubeToMP3Converter33.exe [2012.10.06 11:34:28 | 000,001,158 | ---- | M] () -- C:\Users\Isy\Desktop\Free YouTube to MP3 Converter.lnk [1 C:\Users\Isy\AppData\Roaming\*.tmp files -> C:\Users\Isy\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.10.29 23:02:53 | 000,538,941 | ---- | C] () -- C:\Users\Isy\Desktop\adwcleaner.exe [2012.10.29 22:15:34 | 2138,300,416 | -HS- | C] () -- C:\hiberfil.sys [2012.10.14 16:14:06 | 000,004,303 | ---- | C] () -- C:\Users\Isy\Stellenangebote.abw [2012.10.01 08:54:30 | 000,058,725 | ---- | C] () -- C:\Users\Isy\tumblr_lw0t3m5VhO1qiek4fo1_500.jpg [2012.09.02 12:24:58 | 000,032,367 | ---- | C] () -- C:\Users\Isy\MiYxcfdoZegyjLm4_m_b.jpg [2012.08.10 16:57:03 | 000,899,025 | ---- | C] () -- C:\Users\Isy\IMAG0201.jpg [2012.07.20 18:24:02 | 000,005,752 | ---- | C] () -- C:\Users\Isy\getränke party.abw [2012.06.16 10:07:29 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI [2012.06.15 14:41:48 | 000,550,227 | ---- | C] () -- C:\Users\Isy\Bergen belsen.odp [2012.06.04 14:58:55 | 011,678,644 | ---- | C] () -- C:\Users\Isy\Bergen Belsen Video_0001.wmv [2012.05.29 16:05:39 | 000,019,171 | ---- | C] () -- C:\Users\Isy\300-viva-la-vida-sw.jpg [2012.05.09 09:52:35 | 000,023,848 | ---- | C] () -- C:\Users\Isy\Vom+Eisenerz+zum+Rohstahl.odt [2012.05.01 12:54:14 | 000,218,600 | ---- | C] () -- C:\Users\Isy\AppData\Roaming\AcroIEHelpe112.dll [2012.04.27 16:19:51 | 000,000,016 | ---- | C] () -- C:\Users\Isy\AppData\Roaming\blckdom.res [2012.04.02 17:19:49 | 000,001,356 | ---- | C] () -- C:\Users\Isy\AppData\Local\d3d9caps.dat [2011.03.16 17:11:45 | 000,010,238 | -HS- | C] () -- C:\Users\Isy\AlbumArt_{F7850FA3-CC97-4896-AC4A-6D80129BAC2F}_Large.jpg [2011.03.16 17:11:45 | 000,002,517 | -HS- | C] () -- C:\Users\Isy\AlbumArt_{F7850FA3-CC97-4896-AC4A-6D80129BAC2F}_Small.jpg [2010.12.10 17:55:58 | 000,152,224 | ---- | C] () -- C:\Users\Isy\Weihnachtsbrief.pdf [2010.07.12 15:33:36 | 000,000,164 | ---- | C] () -- C:\ProgramData\{701ACAF9-F102-47c2-8907-36246F4DFB51} [2010.06.02 19:50:59 | 000,378,368 | ---- | C] () -- C:\Users\Isy\iansomberh_a2xtb4ph.thm [2010.06.02 19:39:30 | 001,610,752 | ---- | C] () -- C:\Users\Isy\damonsalva_9tlhcpkn.thm [2010.01.07 19:01:03 | 000,005,499 | -HS- | C] () -- C:\Users\Isy\Folder.jpg [2010.01.07 19:01:03 | 000,001,832 | -HS- | C] () -- C:\Users\Isy\AlbumArtSmall.jpg [2008.08.22 20:14:17 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt [2008.08.22 19:41:52 | 000,125,952 | ---- | C] () -- C:\Users\Isy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.03.03 05:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 03:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2008.08.22 20:22:12 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\ConvertTemp [2010.07.12 15:30:48 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Degener [2012.10.14 14:04:37 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\DVDVideoSoft [2011.10.27 12:47:09 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\DVDVideoSoftIEHelpers [2008.08.23 07:33:17 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\gtk-2.0 [2011.06.22 12:20:44 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\ICQ [2008.08.24 19:43:34 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\ICQ Toolbar [2012.04.27 16:19:38 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\kock [2009.01.04 18:51:18 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\LimeWire [2010.05.26 16:51:16 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Lionhead Studios [2012.06.08 14:38:12 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\OpenOffice.org [2010.06.14 15:52:17 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Samsung [2012.10.06 14:03:04 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Spotify [2010.05.26 17:16:19 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Teleca [2008.08.22 20:22:12 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\Temporary [2012.04.03 18:01:35 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\TerraTec [2008.08.22 20:22:12 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\TransRender [2008.08.23 07:29:27 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\TuxPaint [2012.05.02 16:04:10 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\UAs [2012.05.02 16:04:11 | 000,000,000 | ---D | M] -- C:\Users\Isy\AppData\Roaming\xmldm ========== Purity Check ========== < End of report > [/CODE] |
|
03.11.2012, 19:36
| #24 | |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Kennst du diese Dateien hier? Wenn nicht, dann prüfe sie bitte wie beschrieben: Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
Zitat:
Warte bis unter Current status: Finished steht. Kopiere den Link aus deiner Adresszeile und poste ihn hier.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
04.11.2012, 13:05
| #25 |
| | Ukash Bundepolize Trojaner So, man kann scheinbar nur jeden file einzeln Scannen. Code:
ATTFilter
https://www.virustotal.com/file/8f7829cf8252e2cab8a0b429127ee6b5cd535045336ec48d944673d238bdbb14/analysis/1352029642/
https://www.virustotal.com/file/5c4e4d941d5e366a05a465bbc2da9e61c2e4865f782c7f79cbd32e6bb594153a/analysis/1352030442/
https://www.virustotal.com/file/9a30d97a3a36cb825dfb1857665ef07197ef6494ecf28cc5c7ceafe0e20378a2/analysis/1352030517/
https://www.virustotal.com/file/a5d7f1c0513f705b378b345f06c08ce6505eaf11f8b36b6e87cc4a3ccf8e9ad5/analysis/1352030593/
|
|
04.11.2012, 13:11
| #26 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Ja alles klar. Dann müssen wir da auch nicht weiter machen. Du solltest jetzt den pdfCreator deinstallieren und wenn du ihn noch brauchst neu installieren. Denn hab ich während des Säuberns leider zerschossen. pdfforge Download Aber installiere die Toolbar nicht wieder mit Hast du ansonsten noch Probleme mit dem Rechner? Scan mit SecurityCheck Downloade Dir bitte SecurityCheck
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
04.11.2012, 14:16
| #27 |
| | Ukash Bundepolize Trojaner PfdCreator ist deinstalliert, der Scan ist gelaufen, hier der Log: Code:
ATTFilter Results of screen317's Security Check version 0.99.54 Windows Vista Service Pack 1 x86 Out of date service pack!! Internet Explorer 7 Out of date! ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Java(TM) 6 Update 37 Java(TM) 6 Update 7 Java version out of Date! Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.4.402.287 Adobe Reader 8 Adobe Reader out of Date! Adobe Reader X KB403742.. Adobe Reader out of Date! Mozilla Firefox (16.0.2) Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.94 ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSASCui.exe Windows Defender MSASCui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` |
|
04.11.2012, 14:21
| #28 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Okay, wir müssen ein paar Updates machen und dann sind wir fertig. Schritt 1: Windows Vista Service Pack 2 installieren Schritt 2: Update bitte auch den Internetexplorer von dieser Webseite: Internet Explorer - Microsoft Windows Schritt 3: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Update: Adobe Reader
Probiere einen alternativen Viewer für pdf-Dokumente aus. Diese sind meist schlanker, schneller und schleusen sehr viel seltener Schädlinge ein. Mein Vorschlag:
Schritt 5: Update: Adobe Flash Player
Schritt 6: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
06.11.2012, 15:16
| #29 |
| /// TB-Ausbilder | Ukash Bundepolize Trojaner Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
06.11.2012, 17:34
| #30 |
| | Ukash Bundepolize Trojaner So, nach langem kampf mit dem flashplayer hab ich nun alles erledigt. Hier der Log: Code:
ATTFilter Results of screen317's Security Check version 0.99.54 Windows Vista Service Pack 2 x86 Internet Explorer 7 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Java(TM) 6 Update 37 Java 7 Update 9 Java(TM) 6 Update 7 Adobe Flash Player 11.5.502.110 Mozilla Firefox (16.0.2) Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.94 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` |
|
| Themen zu Ukash Bundepolize Trojaner |
| andere, anderen, benötigt, bundespolizei, bundespolizei trojaner, eingefangen, erstell, erstellt, freundin, gefangen, gen, hoffe, hänge, informationen, laptop, logfiles, otlpe, otlpenet, scan, scann, troja, trojane, trojaner, trojaner eingefangen, ukash |
Linear-Darstellung
