| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spyware.zbot von malwarebytes gefunden und angeblich entfernt - bin ich sicher oder versteckt es sich nur?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
31.10.2012, 00:43
| #1 | |
| |  Spyware.zbot von malwarebytes gefunden und angeblich entfernt - bin ich sicher oder versteckt es sich nur? Salute! Vorhin beim Surfen hat avast plötzlich Alarm gemacht, es hätte eine Bedrohung blockiert. Habe die Seite, auf der ich gerade war, sofort geschlossen. Es kam eine Meldung à la (den genauen Wortlaut weiß ich nicht mehr) "Wollen Sie die Seite wirklich verlassen?", woraufhin ich auf verlassen geklickt habe. Blöd, ich weiß! Kurz darauf machte Avast wieder Alarm, diesmal sei eine Bedrohung von einer lokalen Datei (FFFFUUUUU!) abgewendet worden. Diese lag im Windows/Temp Ordner und hatte einen Titel in der Art von "wgswsgwwsgs.exe" (ist jetzt nicht nicht der genaue Name, aber er bestand im Wesentlichen aus w,g und s). (ab diesem Zeitpunkt habe ich übrigens sofort das WLAN ausgemacht, sicher ist sicher) Blick in msconfig: eine Datei in Appdata/Roaming/Failve namens dibog.exe möchte bitte im Autostart gestartet werden. Na klasse, das sieht nicht gut aus. Im abgesicherten Modus die Datei und den Autostarteintrag gelöscht und Malwarebytes antimalware über das gesamte System laufen lassen. Dieser fand die wgs[...].exe und identifizierte sie als spyware.zbot. Klick auf entfernen, und angeblich wurde die Datei nun gelöscht (liegt auch tatsächlich nicht mehr im Temp-Ordner). EDIT: Was mir gerade noch auffällt: Im Taskmanager fiel mir auf, dass jede Menge (angeblicher) Windows-Dienste zum Tablet- und Stiftbetrieb liefen. Das ist mir vorher noch nie so aufgefallen, könnte also eventuell auch vom Trojaner hervorgerufen worden sein. Meine Frage: Bin ich nun sicher? Google sagt, spyware.zbot sei ein fieser kleiner Rootkit-Bastard, der sich gerne gut versteckt und brilliant tarnt, also mag ich antimalware in dieser Sache nicht wirklich trauen. Vor allem, weil dieser Trojaner wohl hauptsächlich Onlinebanking-Daten abrippt - und ich mache viel Onlinebanking... Ich hoffe ich bin der Anleitung, wie man hier zu posten hat, richtig gefolgt. defogger habe ich seine Arbeit machen lassen, die OTL-Ausgabe präsentiere ich hier: OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.10.2012 23:28:29 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = E:\ Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,96 Gb Total Physical Memory | 1,33 Gb Available Physical Memory | 67,96% Memory free 3,92 Gb Paging File | 3,45 Gb Available in Paging File | 87,96% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 11,46 Gb Free Space | 7,69% Space Free | Partition Type: NTFS Drive E: | 3,73 Gb Total Space | 0,75 Gb Free Space | 20,10% Space Free | Partition Type: FAT32 Computer Name: LENNT-PC | User Name: Lennt | Logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.30 23:25:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- E:\OTL.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 02:14:42 | 000,181,760 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\TabTip.exe PRC - [2009.07.14 02:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe ========== Modules (No Company Name) ========== MOD - [2012.07.31 02:08:04 | 000,016,872 | ---- | M] () -- C:\Programme\Adobe\Reader 9.0\Reader\ViewerPS.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SBSDWSCService) SRV - [2012.10.30 21:13:21 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.10.28 17:18:51 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2011.10.27 10:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2011.01.13 09:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.10.21 08:38:32 | 004,869,488 | ---- | M] (Wacom Technology, Corp.) [Auto | Stopped] -- C:\Programme\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen) SRV - [2010.10.21 08:38:32 | 000,416,112 | ---- | M] (Wacom Technology, Corp.) [Auto | Stopped] -- C:\Programme\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen) SRV - [2010.03.23 12:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2010.02.19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.07.21 03:04:00 | 000,047,128 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.03.30 02:25:26 | 043,010,392 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SRV - [2009.03.30 02:23:32 | 000,254,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2009.03.30 02:23:24 | 000,366,936 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS) SRV - [2008.07.10 01:49:44 | 000,098,840 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2008.07.04 11:52:18 | 000,014,336 | ---- | M] (Vodafone) [Auto | Stopped] -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2004.10.29 15:29:16 | 000,086,016 | ---- | M] (NetGroup - Politecnico di Torino) [On_Demand | Stopped] -- C:\Programme\WinPcap\rpcapd.exe -- (rpcapd) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc) DRV - [2011.08.17 13:03:58 | 000,137,472 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2011.08.17 13:03:50 | 000,008,576 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2011.08.17 12:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2011.08.17 12:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2011.08.17 12:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2011.08.17 12:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2011.04.27 11:08:10 | 000,025,216 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2011.04.27 11:08:10 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2011.04.27 11:08:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) DRV - [2011.01.13 09:41:16 | 000,294,608 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2011.01.13 09:40:16 | 000,047,440 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011.01.13 09:37:30 | 000,023,632 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011.01.13 09:37:19 | 000,051,280 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2011.01.13 09:37:09 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2010.12.27 17:42:24 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.12.23 17:35:02 | 000,025,088 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgandmodem.sys -- (ANDModem) DRV - [2010.12.23 17:35:00 | 000,020,736 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lganddiag.sys -- (AndDiag) DRV - [2010.12.23 17:35:00 | 000,020,096 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgandgps.sys -- (AndGps) DRV - [2010.12.23 17:35:00 | 000,014,336 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgandbus.sys -- (Andbus) DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.10.05 12:26:10 | 000,016,240 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor) DRV - [2010.10.05 12:26:02 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter) DRV - [2010.10.05 12:26:00 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid) DRV - [2010.08.06 09:21:00 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgandadb.sys -- (androidusb) DRV - [2010.03.23 12:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2010.03.15 07:44:48 | 000,127,488 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort) DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM) DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum) DRV - [2009.09.15 18:40:18 | 006,114,816 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.13 23:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) DRV - [2009.03.30 02:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103) DRV - [2008.11.16 17:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.03.17 10:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2008.01.14 11:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ManyCam.sys -- (ManyCam) DRV - [2007.07.15 02:37:04 | 000,027,992 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\pstrip.sys -- (PStrip) DRV - [2007.01.18 19:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2007.01.12 12:33:34 | 000,021,952 | ---- | M] (OLYMPUS IMAGING CORP.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OlyUsbCam.sys -- (OlyUsbCam) DRV - [2006.09.24 14:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan) DRV - [2004.10.29 15:14:04 | 000,032,000 | ---- | M] (NetGroup - Politecnico di Torino) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF) DRV - [1996.04.03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C8 E8 A4 8F 67 9D CB 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" FF - prefs.js..browser.startup.homepage: "www.spiegel.de" FF - prefs.js..extensions.enabledAddons: exif_viewer@mozilla.doslash.org:2.00 FF - prefs.js..extensions.enabledAddons: tineye@ideeinc.com:1.1 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: exif_viewer@mozilla.doslash.org:1.60 FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0 FF - prefs.js..extensions.enabledItems: firetorrent@radicalsoft.com:2.0.3 FF - prefs.js..extensions.enabledItems: testpilot@labs.mozilla.com:1.0.4 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.9.1.14019 FF - prefs.js..network.proxy.backup.ftp: "195.162.195.10" FF - prefs.js..network.proxy.backup.ftp_port: 8080 FF - prefs.js..network.proxy.backup.gopher: "" FF - prefs.js..network.proxy.backup.gopher_port: 0 FF - prefs.js..network.proxy.backup.socks: "195.162.195.10" FF - prefs.js..network.proxy.backup.socks_port: 8080 FF - prefs.js..network.proxy.backup.ssl: "195.162.195.10" FF - prefs.js..network.proxy.backup.ssl_port: 8080 FF - prefs.js..network.proxy.ftp: "91.183.141.66" FF - prefs.js..network.proxy.ftp_port: 80 FF - prefs.js..network.proxy.gopher: "212.165.166.12" FF - prefs.js..network.proxy.gopher_port: 3128 FF - prefs.js..network.proxy.http: "91.183.141.66" FF - prefs.js..network.proxy.http_port: 80 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "91.183.141.66" FF - prefs.js..network.proxy.socks_port: 80 FF - prefs.js..network.proxy.ssl: "91.183.141.66" FF - prefs.js..network.proxy.ssl_port: 80 FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Lennt\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( ) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Lennt\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.06.05 20:47:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.17 20:23:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.17 20:23:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.28 17:18:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.28 17:18:42 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_7.0@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.24 14:07:55 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.28 17:18:52 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.28 17:18:42 | 000,000,000 | ---D | M] [2010.02.16 21:38:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\Extensions [2012.10.25 19:27:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\Firefox\Profiles\lpyijr88.default\extensions [2012.09.04 16:19:57 | 000,230,013 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\exif_viewer@mozilla.doslash.org.xpi [2011.09.13 13:56:20 | 000,008,001 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\tineye@ideeinc.com.xpi [2011.12.10 03:28:28 | 000,061,705 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}.xpi [2012.10.25 19:27:41 | 002,397,858 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\{c0c588b6-b11d-4898-af00-079fed05aa32}.xpi [2012.07.25 18:13:26 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.10.18 21:10:50 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\Lennt\AppData\Roaming\mozilla\firefox\profiles\lpyijr88.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012.10.28 17:18:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.10.28 17:18:38 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.10.28 17:18:52 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010.03.27 17:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npContribute.dll [2012.02.27 09:44:36 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2010.01.13 23:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.02.11 08:32:35 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.04 16:19:41 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.11 08:32:35 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.11 08:32:35 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.11 08:32:35 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.11 08:32:35 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.02.17 07:38:39 | 000,430,252 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 14809 more lines... O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Programme\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll (facemoods.com BHO) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll (facemoods.com) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKCU..\Run: [] File not found O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2CF63897-F230-41B0-A1B6-E6CFA3B36649}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{7d0deebc-11d8-11e0-86b8-002269f55515}\Shell - "" = AutoRun O33 - MountPoints2\{7d0deebc-11d8-11e0-86b8-002269f55515}\Shell\AutoRun\command - "" = E:\AUTORUN.EXE O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell - "" = AutoRun O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\AutoRun\command - "" = G:\setup.EXE /autorun O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\directx\command - "" = G:\DirectX\dxsetup.exe O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\dxtest\command - "" = G:\DirectX\dxdiag.exe O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\log\command - "" = G:\machine.exe -l O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\machine\command - "" = G:\machine.exe O33 - MountPoints2\{aafc8e9c-7b02-11e0-b018-002269f55515}\Shell\setup\command - "" = G:\setup.exe /autorun O33 - MountPoints2\{cd49135f-b1cb-11df-babc-002269f55515}\Shell - "" = AutoRun O33 - MountPoints2\{cd49135f-b1cb-11df-babc-002269f55515}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{cd4913e6-b1cb-11df-babc-002269f55515}\Shell - "" = AutoRun O33 - MountPoints2\{cd4913e6-b1cb-11df-babc-002269f55515}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.28 17:18:36 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.10.02 21:29:04 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Research [2012.10.02 21:29:04 | 000,000,000 | ---D | C] -- C:\Users\Lennt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft ICE ========== Files - Modified Within 30 Days ========== [2012.10.30 23:27:45 | 000,000,020 | ---- | M] () -- C:\Users\Lennt\defogger_reenable [2012.10.30 23:19:06 | 000,762,174 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.10.30 23:19:06 | 000,717,492 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.10.30 23:19:06 | 000,172,560 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.10.30 23:19:06 | 000,145,514 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.10.30 23:01:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.30 23:01:29 | 1579,601,920 | -HS- | M] () -- C:\hiberfil.sys [2012.10.30 21:24:10 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.30 21:24:10 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.30 21:19:16 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.30 20:54:02 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2781201719-715762440-871771399-1001UA.job [2012.10.30 20:52:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.10.29 23:54:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2781201719-715762440-871771399-1001Core.job [2012.10.29 17:06:53 | 000,128,201 | ---- | M] () -- C:\Users\Lennt\Desktop\mo.jpg [2012.10.18 20:13:22 | 000,751,146 | ---- | M] () -- C:\Users\Lennt\Desktop\mrsDj.jpg [2012.10.16 12:38:44 | 000,009,197 | ---- | M] () -- C:\Users\Lennt\Desktop\Report0ef64a0d-165b-47ef-b855-1fec07c4927c.pdf [2012.10.03 21:02:47 | 000,042,971 | ---- | M] () -- C:\Users\Lennt\Desktop\Results _ Mojo Upgrade.pdf [2012.10.02 22:12:20 | 013,345,084 | ---- | M] () -- C:\Users\Lennt\Desktop\P9265652_stitch.jpg [2012.10.02 22:05:11 | 015,636,078 | ---- | M] () -- C:\Users\Lennt\Desktop\P9255625_stitch.jpg [2012.10.02 21:59:00 | 014,026,855 | ---- | M] () -- C:\Users\Lennt\Desktop\P9245484_stitch.jpg [2012.10.02 21:56:31 | 009,445,483 | ---- | M] () -- C:\Users\Lennt\Desktop\P9245456_stitch.jpg [2012.10.02 21:50:48 | 005,094,871 | ---- | M] () -- C:\Users\Lennt\Desktop\P9235426_stitch.jpg [2012.10.02 21:39:50 | 015,049,946 | ---- | M] () -- C:\Users\Lennt\Desktop\P9225418_stitch.jpg [2012.10.02 21:26:46 | 002,270,208 | ---- | M] () -- C:\Users\Lennt\Desktop\ICE-1.4.4-for-32-bit-Windows.msi ========== Files Created - No Company Name ========== [2012.10.30 23:27:26 | 000,000,020 | ---- | C] () -- C:\Users\Lennt\defogger_reenable [2012.10.29 17:06:52 | 000,128,201 | ---- | C] () -- C:\Users\Lennt\Desktop\mo.jpg [2012.10.18 20:13:14 | 000,751,146 | ---- | C] () -- C:\Users\Lennt\Desktop\mrsDj.jpg [2012.10.16 12:38:44 | 000,009,197 | ---- | C] () -- C:\Users\Lennt\Desktop\Report0ef64a0d-165b-47ef-b855-1fec07c4927c.pdf [2012.10.03 21:02:45 | 000,042,971 | ---- | C] () -- C:\Users\Lennt\Desktop\Results _ Mojo Upgrade.pdf [2012.10.02 22:12:10 | 013,345,084 | ---- | C] () -- C:\Users\Lennt\Desktop\P9265652_stitch.jpg [2012.10.02 22:04:59 | 015,636,078 | ---- | C] () -- C:\Users\Lennt\Desktop\P9255625_stitch.jpg [2012.10.02 21:58:51 | 014,026,855 | ---- | C] () -- C:\Users\Lennt\Desktop\P9245484_stitch.jpg [2012.10.02 21:56:25 | 009,445,483 | ---- | C] () -- C:\Users\Lennt\Desktop\P9245456_stitch.jpg [2012.10.02 21:50:42 | 005,094,871 | ---- | C] () -- C:\Users\Lennt\Desktop\P9235426_stitch.jpg [2012.10.02 21:39:43 | 015,049,946 | ---- | C] () -- C:\Users\Lennt\Desktop\P9225418_stitch.jpg [2012.10.02 21:26:42 | 002,270,208 | ---- | C] () -- C:\Users\Lennt\Desktop\ICE-1.4.4-for-32-bit-Windows.msi [2012.09.08 12:42:52 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2012.09.08 12:41:02 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll [2012.06.02 13:21:43 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll [2012.02.13 23:52:02 | 000,000,032 | ---- | C] () -- C:\Users\Lennt\.simfy [2011.12.29 13:17:29 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll [2011.12.29 13:17:29 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini [2011.11.14 10:43:03 | 000,000,840 | ---- | C] () -- C:\Users\Lennt\.recently-used.xbel [2011.05.31 13:48:04 | 000,014,073 | ---- | C] () -- C:\Users\Lennt\AppData\Roaming\PStrip.bk! [2011.05.31 13:48:02 | 000,014,050 | ---- | C] () -- C:\Users\Lennt\AppData\Roaming\PStrip.bko [2011.05.30 20:16:07 | 000,014,050 | ---- | C] () -- C:\Users\Lennt\AppData\Roaming\PStrip.bak [2011.05.30 19:31:08 | 000,000,710 | ---- | C] () -- C:\Users\Lennt\ps_mon.inf [2011.05.30 19:21:57 | 000,014,073 | ---- | C] () -- C:\Users\Lennt\AppData\Roaming\PStrip.ini [2011.05.30 19:17:47 | 000,000,062 | ---- | C] () -- C:\Windows\wininit.ini [2011.05.30 18:01:36 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.05.30 17:59:36 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.05.10 18:00:43 | 000,000,465 | ---- | C] () -- C:\Windows\SIERRA.INI [2011.02.11 17:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll [2011.01.10 22:03:55 | 000,007,605 | ---- | C] () -- C:\Users\Lennt\AppData\Local\Resmon.ResmonCfg [2010.12.27 17:46:47 | 000,000,776 | ---- | C] () -- C:\Windows\Thps3.INI [2010.02.16 22:01:51 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.06.23 12:02:02 | 000,097,410 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2008.05.23 16:48:50 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011.09.25 09:49:26 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\.minecraft [2012.08.04 21:54:28 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\.purple [2012.10.30 23:00:07 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Beatw [2012.06.03 18:43:19 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\BOM [2011.03.17 15:57:07 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Canon [2010.12.27 17:46:30 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\DAEMON Tools Lite [2011.02.24 18:35:25 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\DC++ [2012.10.30 19:56:59 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Dropbox [2012.01.02 12:23:23 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Encryptomatic, LLC [2010.05.16 14:50:13 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Facebook [2012.10.30 21:30:15 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Failve [2011.02.24 21:51:56 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Foxit Software [2010.12.10 23:55:41 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\GetRightToGo [2010.02.27 13:28:24 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\GrabPro [2012.02.09 02:33:25 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\gtk-2.0 [2011.12.05 16:04:58 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\ICQ [2010.12.30 18:02:57 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\JAM Software [2011.01.10 20:58:31 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Leadertech [2010.03.27 22:31:39 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\ManyCam [2012.01.02 12:23:27 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\MessageViewer [2012.06.17 14:20:12 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\MyPhoneExplorer [2010.02.16 21:35:40 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\OpenOffice.org [2012.09.21 09:34:29 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Orbit [2011.11.24 14:15:09 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\PC Suite [2012.09.20 12:10:29 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\ProgSense [2012.02.13 23:51:55 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Simfy [2012.10.30 21:21:41 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Spotify [2011.04.19 22:06:39 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.11.05 12:33:22 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\TrafficMonitor [2011.10.16 19:12:09 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\TuneUp Software [2010.08.27 12:14:22 | 000,000,000 | ---D | M] -- C:\Users\Lennt\AppData\Roaming\Vodafone ========== Purity Check ========== < End of report > EDIT2: Der Erstellungszeitpunkt von Appdata/Roaming/Failve stimmt quasi exakt mit dem Zeitpunkt der zweiten Warnmeldung von Avast überein. Der Ordner Appdata/Roaming/Beatw wurde während des antimalware-checks angelegt. Ein Hinweis, dass der Trojaner dorthin "geflüchtet" ist? Der Ordner ist zwar leer, aber das muss ja nichts sagen. Extras.txt und Gmer.log im Anhang. Noch ein EDIT: Sorry, fiel mir gerade eben erst ein. Durch meinen voreiligen mbam-wipe habe ich ja eventuell "Beweise vernichtet", also hier auch nochmal der mbam-log, der enthält nämlich wie mir gerade erst auffiel unter anderem die info dass ich tatsächlich eine backdoor drin habe... Zitat:
Geändert von Lennt (31.10.2012 um 01:40 Uhr) |
| Themen zu Spyware.zbot von malwarebytes gefunden und angeblich entfernt - bin ich sicher oder versteckt es sich nur? |
| adobe, antivirus, application/pdf:, autorun, avast, bho, defender, desktop, downloader, entfernen, explorer, firefox, format, frage, gmer.log, google, limited.com/facebook, logfile, mozilla, nicht sicher, object, olympus, plug-in, pup.hacktool.loic, registry, scan, server, software, spyware.zbot, system, tiere, trojaner, wgsdgsdgdsgsd.exe, wlan |
Baum-Darstellung