BKA Trojaner (Trojan.ransom)

delrod · 04.12.2012, 23:15

Ich brauche - mal wieder

- Hilfe:
Mein Sohn hat auf seinem Rechner den BKA-Trojaner eingefangen. Hat dann den Rechner ausgeschaltet - wieder eingeschaltet, konnte aber auf seinem üblichen User-Zugang (mit Admin-Rechten) nicht mehr arbeiten - immer wieder der Blockierungsbildschirm. Dann hat er einen neuen Admin-Zugang eingerichtet, hat dem vorherigen User die Admin-Rechte weggenommen, dann hat er ca. 4 GB Daten gelöscht und dann alles berichtet, als ich nach Hause kam. Aktuell gibt es auf dem neu eingerichteten Admin-Zugang scheinbar keine Beeinträchtigungen.
MBAM meldet 2 infizierte Dateien:

Zitat:

Infizierte Dateien: 2
C:\Users\Matze\wgsdgsdgdsgsd.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.
C:\Users\Matze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk (Trojan.Ransom.SUGen) -> Keine Aktion durchgeführt.

Ich habe dann noch defogger.exe ausgeführt, kann aber kein Log finden (???)
und OTL.exe ausgeführt. otl.txt ist vorhanden und kann gepostet werden, extra.txt finde ich nicht (???).

Ich freue mich, wenn mir jemand aus dem Team helfen kann und sage auf jeden Fall jetzt schon mal danke.

t'john · 05.12.2012, 19:19

das MBAM-Logfile vollstaendig posten!
Wo ist OTL.txt?

delrod · 06.12.2012, 07:20

hier ist MBAM Log:

Zitat:

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.12.04.09

Windows 7 Service Pack 1 x64 FAT
Internet Explorer 9.0.8112.16421
Admin :: MATZENEU [Administrator]

04.12.2012 20:02:02
mbam-log-2012-12-04 (22-01-43).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 823753
Laufzeit: 1 Stunde(n), 38 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Matze\wgsdgsdgdsgsd.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.
C:\Users\Matze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk (Trojan.Ransom.SUGen) -> Keine Aktion durchgeführt.

(Ende)

und das sit die OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 04.12.2012 22:31:02 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,93 Gb Available Physical Memory | 73,36% Memory free
7,99 Gb Paging File | 6,75 Gb Available in Paging File | 84,43% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 292,87 Gb Total Space | 89,75 Gb Free Space | 30,65% Space Free | Partition Type: NTFS
Drive D: | 638,54 Gb Total Space | 4,10 Gb Free Space | 0,64% Space Free | Partition Type: NTFS
Drive F: | 120,23 Mb Total Space | 113,01 Mb Free Space | 93,99% Space Free | Partition Type: FAT
 
Computer Name: MATZENEU | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.12.04 22:25:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.06 18:48:13 | 001,564,368 | ---- | M] () -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
PRC - [2012.03.20 10:16:08 | 000,247,872 | ---- | M] () -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE
PRC - [2011.10.14 07:01:50 | 000,994,360 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2011.10.14 07:01:48 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2011.10.14 07:01:46 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.07.06 21:30:04 | 000,393,216 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
PRC - [2009.10.15 14:06:46 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009.10.15 14:06:42 | 000,375,000 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009.08.24 14:38:06 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.06 18:48:13 | 001,564,368 | ---- | M] () -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
MOD - [2009.06.27 10:11:12 | 000,503,202 | ---- | M] () -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - File not found [Disabled | Unknown] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV:64bit: - [2012.09.13 14:26:50 | 001,259,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dmwu.exe -- (WebOptimizer)
SRV:64bit: - [2012.06.11 18:19:14 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012.06.11 12:12:16 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2010.04.06 16:30:38 | 000,031,272 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2012.11.04 13:17:41 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.10.09 14:50:20 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.06 18:48:13 | 001,564,368 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2012.06.07 18:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.03.20 10:16:08 | 000,247,872 | ---- | M] () [Auto | Running] -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE -- (ICQ Service)
SRV - [2011.10.14 07:01:50 | 000,994,360 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011.10.14 07:01:48 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.11.29 10:42:56 | 000,058,944 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper)
SRV - [2010.10.22 02:00:00 | 000,376,832 | R--- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.09.21 13:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.10.15 14:06:46 | 000,223,464 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)
SRV - [2009.08.24 14:38:06 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.30 23:51:56 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.10.30 23:51:55 | 000,984,144 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.10.30 23:51:55 | 000,370,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.10.30 23:51:55 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.10.30 23:51:55 | 000,021,136 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2012.10.30 23:51:53 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.10.15 17:59:28 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.06.11 19:59:38 | 010,248,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.06.11 17:26:14 | 000,367,616 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.24 18:51:35 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010.12.24 18:51:35 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010.11.25 05:59:16 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RTL8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:49:51 | 000,146,432 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rmcast.sys -- (RMCAST)
DRV:64bit: - [2010.10.22 02:00:00 | 001,293,824 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fwlanusb4.sys -- (fwlanusb4)
DRV:64bit: - [2010.10.22 02:00:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.09.01 09:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2010.07.01 14:21:50 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2010.05.24 13:07:58 | 000,253,728 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
DRV:64bit: - [2010.04.27 11:56:38 | 000,021,544 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AppleCharger.sys -- (AppleCharger)
DRV:64bit: - [2010.03.22 10:57:20 | 000,347,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.02.18 08:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV - [2012.12.04 22:18:44 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2012.03.05 15:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 23 4B 29 69 31 D2 CD 01  [binary data]
IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {C65F1AC3-E152-4522-B0DF-9CA739B3E0BB}
IE - HKCU\..\SearchScopes\{C65F1AC3-E152-4522-B0DF-9CA739B3E0BB}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
IE - HKCU\..\SearchScopes\{D78EAB20-51AF-4e0a-9C34-3D9FDE9BC314}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@ei.VideoDownloadConverter_4z.com/Plugin: C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll (VideoDownloadConverter)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.10 16:32:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.09 19:49:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.12 07:26:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.04 13:17:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.12.04 16:39:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012.12.04 22:23:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\tzvk7ma0.default\extensions
[2012.10.10 12:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.09 19:22:29 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2009.10.26 14:53:52 | 000,102,400 | ---- | M] (Zylom) -- C:\Program Files (x86)\mozilla firefox\plugins\npzylomgamesplayer.dll
[2012.10.09 19:22:26 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.09 19:22:26 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.10.09 19:22:26 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.09 19:22:26 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.10.09 19:22:26 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.09 19:22:26 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.10.10 12:55:43 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - 10 - Reg Error: Value error. File not found
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F2649840-ACB0-47AB-8C8D-A09A91EB89C9}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.12.04 22:27:24 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.12.04 22:25:03 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Downloads
[2012.12.04 22:04:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Mozilla
[2012.12.04 19:48:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.12.04 17:53:50 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ElevatedDiagnostics
[2012.12.04 16:57:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Solveig Multimedia
[2012.12.04 16:47:29 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\HyperCam3
[2012.12.04 16:47:16 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\HyperCam
[2012.12.04 16:41:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Avnex
[2012.12.04 16:40:19 | 000,000,000 | ---D | C] -- C:\Users\Admin\Application Data
[2012.12.04 16:40:05 | 000,021,504 | ---- | C] (Avnex) -- C:\Windows\SysNative\drivers\vcsvad.sys
[2012.12.04 16:39:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ AV Vcs 7.0 GOLD
[2012.12.04 16:39:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mozilla
[2012.12.04 16:39:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Thunderbird
[2012.12.04 16:39:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Thunderbird
[2012.12.04 16:38:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\itecnix
[2012.12.04 16:38:08 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2012.12.04 15:15:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Audacity
[2012.12.04 15:14:15 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple Computer
[2012.12.04 15:12:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Adobe
[2012.12.04 15:12:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2012.12.04 15:10:34 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2012.12.04 15:06:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\vlc
[2012.12.04 15:05:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\AMD
[2012.12.04 15:05:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\ATI
[2012.12.04 15:05:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ATI
[2012.12.04 15:05:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe
[2012.12.04 15:05:05 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2012.12.04 15:04:50 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.12.04 15:04:50 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches
[2012.12.04 15:04:50 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.12.04 15:04:40 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities
[2012.12.04 15:04:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts
[2012.12.04 15:04:31 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Pictures
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop
[2012.12.04 15:04:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten
[2012.12.04 15:04:31 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten
[2012.12.04 15:04:31 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData
[2012.12.04 15:04:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\temp
[2012.12.04 15:04:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft
[2012.12.04 15:04:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2012.12.04 15:04:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Macromedia
[2012.12.03 18:45:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HyperCam 3
[2012.12.03 18:45:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Solveig Multimedia
[2012.12.03 18:45:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HyperCam 3
[2012.12.03 18:32:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HyperCam 2
[2012.12.01 17:45:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\BioWare
[2012.11.23 21:45:58 | 000,000,000 | ---D | C] -- C:\ProgramData\PlayFirst
[2012.11.19 13:53:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Schiff-Simulator 2012 - Demo
[2012.11.19 13:53:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)Schiff-Simulator 2012 - Demo
[2012.11.18 22:17:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bus-Simulator Demo
[2012.11.18 22:14:30 | 000,000,000 | ---D | C] -- C:\Program Files\astragon
[2012.11.18 16:50:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2013 Demo
[2012.11.18 16:50:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Landwirtschafts Simulator 2013 Demo
[2012.11.18 10:35:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.11.10 16:32:39 | 000,021,136 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswKbd.sys
[3 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.12.04 22:29:16 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.12.04 22:28:01 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.04 22:25:51 | 000,015,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.04 22:25:51 | 000,015,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.04 22:25:46 | 000,050,477 | ---- | M] () -- C:\Users\Admin\Desktop\Defogger.exe
[2012.12.04 22:25:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.12.04 22:18:53 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.04 22:18:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.12.04 22:18:13 | 3219,300,352 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.04 22:01:54 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.12.04 22:01:54 | 000,000,324 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012.12.04 19:59:09 | 001,497,698 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.12.04 19:59:09 | 000,902,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.12.04 19:59:09 | 000,400,510 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.12.04 19:59:09 | 000,346,862 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.12.04 19:59:09 | 000,006,470 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.12.04 19:52:33 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.12.04 16:57:42 | 000,003,584 | ---- | M] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.12.04 15:45:50 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.12.04 15:05:06 | 000,001,216 | ---- | M] () -- C:\Users\Admin\Desktop\Games.lnk
[2012.12.04 15:04:33 | 000,000,680 | RHS- | M] () -- C:\Users\Admin\ntuser.pol
[2012.12.04 11:05:47 | 000,043,520 | ---- | M] () -- C:\Windows\SysWow64\CmdLineExt03.dll
[2012.12.03 23:08:30 | 400,856,064 | ---- | M] () -- C:\Grundlagen zum Browser.avi
[2012.11.19 13:53:53 | 000,000,974 | ---- | M] () -- C:\Users\Public\Desktop\Schiff-Simulator 2012 - Demo.lnk
[2012.11.18 22:29:10 | 000,016,437 | ---- | M] () -- C:\Referat_Aldi-Marken.odp
[2012.11.18 11:17:29 | 000,339,761 | ---- | M] () -- C:\Dokument-4.sla
[2012.11.18 11:17:16 | 000,119,180 | ---- | M] () -- C:\Einladung.pdf
[2012.11.18 10:35:30 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.11.18 10:35:02 | 000,001,958 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.11.16 16:26:42 | 000,304,048 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.14 21:51:20 | 000,036,892 | ---- | M] () -- C:\Windows\SysWow64\bassmod.dll
[2012.11.11 15:13:43 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\000008DC.LCS
[2012.11.07 18:18:24 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00000F99.LCS
[3 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.12.04 22:29:16 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.12.04 22:27:21 | 000,050,477 | ---- | C] () -- C:\Users\Admin\Desktop\Defogger.exe
[2012.12.04 19:52:33 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.12.04 16:57:42 | 000,003,584 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.12.04 15:05:06 | 000,001,216 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Social Games.lnk
[2012.12.04 15:05:06 | 000,001,216 | ---- | C] () -- C:\Users\Admin\Desktop\Games.lnk
[2012.12.04 15:04:55 | 000,001,405 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.12.04 15:04:51 | 000,001,439 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.12.04 15:04:33 | 000,000,680 | RHS- | C] () -- C:\Users\Admin\ntuser.pol
[2012.12.04 14:17:24 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.12.03 23:08:07 | 400,856,064 | ---- | C] () -- C:\Grundlagen zum Browser.avi
[2012.11.19 13:53:53 | 000,000,974 | ---- | C] () -- C:\Users\Public\Desktop\Schiff-Simulator 2012 - Demo.lnk
[2012.11.18 22:29:10 | 000,016,437 | ---- | C] () -- C:\Referat_Aldi-Marken.odp
[2012.11.18 11:17:29 | 000,339,761 | ---- | C] () -- C:\Dokument-4.sla
[2012.11.18 11:17:15 | 000,119,180 | ---- | C] () -- C:\Einladung.pdf
[2012.11.18 10:35:02 | 000,001,958 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.11.15 22:13:48 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:07:13 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.10.19 18:43:46 | 000,000,010 | ---- | C] () -- C:\Program Files\Common Files\systemdate.dat
[2012.10.10 12:42:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.10.10 12:42:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.10.10 12:42:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.10.10 12:42:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.10.10 12:42:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.09.11 19:02:40 | 000,036,892 | ---- | C] () -- C:\Windows\SysWow64\bassmod.dll
[2012.06.11 17:50:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.06.11 17:50:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.05.22 15:04:47 | 000,679,936 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.05.22 15:04:47 | 000,155,648 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.05.10 15:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.04.29 07:31:24 | 000,006,452 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.17 21:01:17 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2011.12.26 17:08:36 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\redmonnt.dll
[2011.11.30 14:30:51 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2011.11.21 16:58:30 | 000,063,488 | R--- | C] () -- C:\Windows\xobglu16.dll
[2011.11.21 16:58:30 | 000,023,552 | R--- | C] () -- C:\Windows\xobglu32.dll
[2011.10.22 12:27:14 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.06 16:52:15 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.12.24 18:11:45 | 000,000,204 | ---- | C] () -- C:\Windows\SysWow64\secustat.dat
[2010.12.24 18:04:21 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.12.24 17:33:10 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.12.21 12:36:04 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.12.21 10:53:44 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\$Recycle.Bin\S-1-5-18\$172dbb1ed6d4704385d74104cb3c0c7c\n.
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.04 15:15:44 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Audacity
[2012.12.04 16:41:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Avnex
[2012.12.04 16:47:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\HyperCam
[2012.12.04 15:10:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org
[2012.12.04 16:57:42 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Solveig Multimedia
[2012.12.04 16:39:42 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Thunderbird
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:6B5A665E
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:0860D6D6
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:A0C7D68A
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:18897B1D

< End of report >

--- --- ---

t'john · 06.12.2012, 17:31

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

ATTFilter

:OTL
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX 
O3:64bit: - HKLM\..\Toolbar: (no name) - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - Reg Error: Value error. File not found 
O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - 10 - Reg Error: Value error. File not found 
O4 - HKLM..\Run: [] File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 

@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:6B5A665E 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\Temp:0860D6D6 
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:A0C7D68A 
@Alternate Data Stream - 101 bytes -> C:\ProgramData\Temp:18897B1D 
[2012.12.04 15:45:50 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad 

:Files
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\Admin\*.tmp
C:\Users\Admin\AppData\Local\Temp\*.exe
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

2. Schritt
Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Entpacke das Archiv auf deinem Desktop.
Im neu erstellten Ordner starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

danach:

3. Schritt
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

delrod · 06.12.2012, 23:46

Hallo t'john,

Alle Arbeitsschritte ließen sich problemlos durchführen.

Die Logs:

Code:

ATTFilter

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
ADS C:\ProgramData\Temp:6B5A665E deleted successfully.
ADS C:\ProgramData\Temp:0860D6D6 deleted successfully.
ADS C:\ProgramData\Temp:A0C7D68A deleted successfully.
ADS C:\ProgramData\Temp:18897B1D deleted successfully.
C:\ProgramData\dsgsdgdsgdsgw.pad moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\Admin\*.tmp not found.
File\Folder C:\Users\Admin\AppData\Local\Temp\*.exe not found.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Admin\Desktop\cmd.bat deleted successfully.
C:\Users\Admin\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 2680435 bytes
->Temporary Internet Files folder emptied: 1117625 bytes
->FireFox cache emptied: 18735978 bytes
->Flash cache emptied: 58224 bytes
 
User: All Users
 
User: AppData
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 29933 bytes
 
User: hedev
->Temp folder emptied: 43164427 bytes
 
User: Matze
->Temp folder emptied: 119311919 bytes
->Temporary Internet Files folder emptied: 122948510 bytes
->Java cache emptied: 19998214 bytes
->FireFox cache emptied: 161287471 bytes
->Flash cache emptied: 150038 bytes
 
User: Papa
->Temp folder emptied: 0 bytes
 
User: PTP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 339069 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 74584924 bytes
->Flash cache emptied: 71399 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 63936601 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3228080 bytes
RecycleBin emptied: 27172840 bytes
 
Total Files Cleaned = 629,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 12062012_193123

Files\Folders moved on Reboot...
C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Code:

ATTFilter

Malwarebytes Anti-Rootkit 1.1.0.1009
www.malwarebytes.org

Database version: v2012.11.03.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: MATZENEU [administrator]

06.12.2012 19:48:22
mbar-log-2012-12-06 (19-48-22).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: PUP | PUM | P2P
Objects scanned: 28145
Time elapsed: 9 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\$RECYCLE.BIN\S-1-5-18\$172dbb1ed6d4704385d74104cb3c0c7c\U (Trojan.Siredef.C) -> Delete on reboot. [37ca326247163cfa643f6f91e11f3cc4]
C:\$RECYCLE.BIN\S-1-5-21-3574828425-420266082-2440584776-1004\$172dbb1ed6d4704385d74104cb3c0c7c\U (Trojan.Siredef.C) -> Delete on reboot. [03fe5b392c31b97db3f087790df30000]
C:\$RECYCLE.BIN\S-1-5-18\$172dbb1ed6d4704385d74104cb3c0c7c\L (Trojan.Siredef.C) -> Delete on reboot. [56ab80144a13d264cdd8659bba469070]
C:\$RECYCLE.BIN\S-1-5-21-3574828425-420266082-2440584776-1004\$172dbb1ed6d4704385d74104cb3c0c7c\L (Trojan.Siredef.C) -> Delete on reboot. [837e187cb6a70c2a693c718fd42c6898]
C:\$RECYCLE.BIN\S-1-5-18\$172dbb1ed6d4704385d74104cb3c0c7c (Trojan.Siredef.C) -> Delete on reboot. [48b95c38b4a984b2931360a0837d0ff1]
C:\$RECYCLE.BIN\S-1-5-21-3574828425-420266082-2440584776-1004\$172dbb1ed6d4704385d74104cb3c0c7c (Trojan.Siredef.C) -> Delete on reboot. [34cd5d3783dab086c5e1d62a659b3ec2]

Files Detected: 2
C:\$RECYCLE.BIN\S-1-5-18\$172dbb1ed6d4704385d74104cb3c0c7c\@ (Trojan.Siredef.C) -> Delete on reboot. [d22f2f65fc6142f4534dd32d867a4bb5]
C:\$RECYCLE.BIN\S-1-5-21-3574828425-420266082-2440584776-1004\$172dbb1ed6d4704385d74104cb3c0c7c\@ (Trojan.Siredef.C) -> Delete on reboot. [8879ddb71c41989e435d0df328d8aa56]

(end)

Code:

ATTFilter

# AdwCleaner v2.011 - Datei am 06/12/2012 um 20:26:34 erstellt
# Aktualisiert am 02/12/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Admin - MATZENEU
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Admin\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : ICQ Service
Gestoppt & Gelöscht : WebOptimizer

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\searchplugins\icqplugin-3.xml
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
Ordner Gelöscht : C:\Windows\SysWOW64\WNLT

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16455

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0 (de)

Profilname : default 
Datei : C:\Users\Matze\AppData\Roaming\Mozilla\Firefox\Profiles\swso07a8.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default 
Datei : C:\Users\PTP\AppData\Roaming\Mozilla\Firefox\Profiles\y2f1ydln.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default 
Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tzvk7ma0.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default 
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\3rl4hngh.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [3639 octets] - [06/12/2012 20:24:05]
AdwCleaner[R2].txt - [3699 octets] - [06/12/2012 20:25:29]
AdwCleaner[R3].txt - [3759 octets] - [06/12/2012 20:25:52]
AdwCleaner[S2].txt - [3714 octets] - [06/12/2012 20:26:34]

########## EOF - C:\AdwCleaner[S2].txt - [3774 octets] ##########

Was wir hier tun bleibt für mich ein wenig unverständlich. Ich warte ehrfütchtig auf deinen nächsten Hinweis.

t'john · 07.12.2012, 07:26

Malware mit Combofix beseitigen

Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

Windows XP (nur 32-bit)
Windows Vista (32-bit/64-bit)
Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
Liste der zu deaktivierenden Programme.
Bei Unklarheiten bitte fragen.

ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
Teile uns das mit und warte auf unsere Anweisungen.

Starte die Combofix.exe mit Rechtsklick => Als Administrator ausführen und folge den Anweisungen.
Während des Laufs von Combofix nichts anderes am Computer machen!
Akzeptiere die Bedingungen (Disclaimer) mit "Ja".

Sollte Combofix eine aktuellere Version anbieten, Downlaod erlauben.
Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.
Es erscheint eine blaue Eingabeaufforderung, Combofix wird für den Suchlauf vorbereitet.
Bitte nicht in dieses Combofix-Fenster klicken.
Das könnte Dein System einfrieren oder hängen bleiben lassen.
Es wird ein Backup Deiner Registry erstellt.
Nun werden die einzelnen Stufen des Programms abgearbeitet, das kann eine Weile dauern.

Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

delrod · 08.12.2012, 17:53

So, jetzt kann's weiter gehen:

ComboFix.txt

Code:

ATTFilter

ComboFix 12-12-07.01 - Admin 08.12.2012  16:45:24.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4094.2848 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Matze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
c:\users\Matze\wgsdgsdgdsgsd.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-11-08 bis 2012-12-08  ))))))))))))))))))))))))))))))
.
.
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\Public\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\PTP\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\Papa\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\Matze\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\Gast\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\Default\AppData\Local\temp
2012-12-08 15:52 . 2012-12-08 15:52    --------    d-----w-    c:\users\AppData\AppData\Local\temp
2012-12-06 18:31 . 2012-12-06 18:31    --------    d-----w-    C:\_OTL
2012-12-04 15:40 . 2008-12-26 11:56    21504    ----a-w-    c:\windows\system32\drivers\vcsvad.sys
2012-12-04 15:39 . 2012-12-04 15:42    --------    d-----w-    c:\program files (x86)\ AV Vcs 7.0 GOLD
2012-12-04 15:38 . 2012-12-04 15:38    --------    d-----w-    c:\program files (x86)\itecnix
2012-12-04 15:38 . 2012-12-04 15:38    --------    d-----w-    c:\windows\Downloaded Installations
2012-12-04 14:04 . 2012-12-04 21:29    --------    d-----w-    c:\users\Admin
2012-12-03 17:46 . 2012-12-03 21:30    --------    d-----w-    c:\users\Matze\AppData\Roaming\Solveig Multimedia
2012-12-03 17:45 . 2012-12-03 17:45    --------    d-----w-    c:\users\Matze\AppData\Roaming\HyperCam
2012-12-03 17:45 . 2012-12-03 17:45    --------    d-----w-    c:\program files (x86)\Common Files\Solveig Multimedia
2012-12-03 17:45 . 2012-12-03 17:45    --------    d-----w-    c:\program files (x86)\HyperCam 3
2012-12-03 17:32 . 2012-12-03 17:32    --------    d-----w-    c:\program files (x86)\HyperCam 2
2012-12-01 16:45 . 2012-12-01 16:45    --------    d-----w-    c:\program files (x86)\Common Files\BioWare
2012-12-01 16:45 . 2012-12-01 16:45    --------    d-----w-    c:\users\hedev
2012-11-23 20:45 . 2012-11-23 20:45    --------    d-----w-    c:\users\Matze\AppData\Roaming\PlayFirst
2012-11-23 20:45 . 2012-11-23 20:45    --------    d-----w-    c:\programdata\PlayFirst
2012-11-19 12:53 . 2012-11-19 12:53    --------    d-----w-    C:\Program Files (x86)Schiff-Simulator 2012 - Demo
2012-11-18 21:29 . 2012-11-18 21:29    --------    d-----w-    c:\users\Matze\AppData\Local\Bus Simulator 2012 Demo
2012-11-18 21:14 . 2012-11-18 21:14    --------    d-----w-    c:\program files\astragon
2012-11-18 15:50 . 2012-11-18 15:50    --------    d-----w-    c:\program files (x86)\Landwirtschafts Simulator 2013 Demo
2012-11-18 15:49 . 2012-11-18 15:49    --------    d-----w-    c:\users\Matze\AppData\Local\Programs
2012-11-16 15:32 . 2012-10-12 07:19    9291768    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{46FFB140-EAD1-45A7-BD02-EAC15FC649F7}\mpengine.dll
2012-11-15 21:13 . 2012-07-26 07:46    2560    ----a-w-    c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-15 21:13 . 2012-07-26 04:55    785512    ----a-w-    c:\windows\system32\drivers\Wdf01000.sys
2012-11-15 21:13 . 2012-07-26 04:55    54376    ----a-w-    c:\windows\system32\drivers\WdfLdr.sys
2012-11-15 21:13 . 2012-07-26 02:36    9728    ----a-w-    c:\windows\system32\Wdfres.dll
2012-11-15 21:07 . 2012-07-26 02:26    198656    ----a-w-    c:\windows\system32\drivers\WUDFRd.sys
2012-11-15 21:07 . 2012-07-26 03:08    84992    ----a-w-    c:\windows\system32\WUDFSvc.dll
2012-11-15 21:07 . 2012-07-26 03:08    194048    ----a-w-    c:\windows\system32\WUDFPlatform.dll
2012-11-15 21:07 . 2012-07-26 02:26    87040    ----a-w-    c:\windows\system32\drivers\WUDFPf.sys
2012-11-15 21:07 . 2012-07-26 03:08    229888    ----a-w-    c:\windows\system32\WUDFHost.exe
2012-11-15 21:07 . 2012-07-26 03:08    45056    ----a-w-    c:\windows\system32\WUDFCoinstaller.dll
2012-11-15 21:07 . 2012-07-26 03:08    744448    ----a-w-    c:\windows\system32\WUDFx.dll
2012-11-10 15:32 . 2012-10-30 22:51    21136    ----a-w-    c:\windows\system32\drivers\aswKbd.sys
2012-11-09 15:04 . 2012-11-09 15:04    --------    d-----w-    c:\users\Matze\AppData\Roaming\Unity
2012-11-09 14:47 . 2012-11-09 14:47    --------    d-----w-    c:\users\Matze\AppData\Local\Unity
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-08 15:53 . 2010-12-21 10:02    25640    ----a-w-    c:\windows\gdrv.sys
2012-12-04 10:05 . 2011-08-06 15:52    43520    ----a-w-    c:\windows\SysWow64\CmdLineExt03.dll
2012-11-15 21:07 . 2010-12-21 13:21    66395536    ----a-w-    c:\windows\system32\MRT.exe
2012-10-30 22:51 . 2011-12-01 07:22    59728    ----a-w-    c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2011-12-01 07:22    370288    ----a-w-    c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2011-12-01 07:22    984144    ----a-w-    c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2011-12-01 07:22    71600    ----a-w-    c:\windows\system32\drivers\aswMonFlt.sys
2012-10-30 22:51 . 2011-12-01 07:22    25232    ----a-w-    c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2011-12-01 07:22    41224    ----a-w-    c:\windows\avastSS.scr
2012-10-30 22:50 . 2011-12-01 07:22    227648    ----a-w-    c:\windows\SysWow64\aswBoot.exe
2012-10-30 22:50 . 2011-12-01 07:22    285328    ----a-w-    c:\windows\system32\aswBoot.exe
2012-10-16 08:38 . 2012-11-28 16:04    135168    ----a-w-    c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 16:04    350208    ----a-w-    c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 16:04    561664    ----a-w-    c:\windows\apppatch\AcLayers.dll
2012-10-15 16:59 . 2012-03-11 06:47    54072    ----a-w-    c:\windows\system32\drivers\aswRdr2.sys
2012-10-09 19:07 . 2012-10-09 19:07    95208    ----a-w-    c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-10-09 19:07 . 2010-12-25 11:40    746984    ----a-w-    c:\windows\SysWow64\deployJava1.dll
2012-10-09 19:06 . 2012-10-09 19:06    108008    ----a-w-    c:\windows\system32\WindowsAccessBridge-64.dll
2012-10-09 19:06 . 2012-10-09 19:06    289768    ----a-w-    c:\windows\system32\javaws.exe
2012-10-09 19:06 . 2012-10-09 19:06    189416    ----a-w-    c:\windows\system32\javaw.exe
2012-10-09 19:06 . 2012-10-09 19:06    188904    ----a-w-    c:\windows\system32\java.exe
2012-10-09 19:06 . 2012-10-09 19:06    916456    ----a-w-    c:\windows\system32\deployJava1.dll
2012-10-09 19:06 . 2012-10-09 19:06    1034216    ----a-w-    c:\windows\system32\npDeployJava1.dll
2012-10-09 18:19 . 2012-10-09 18:19    477168    ----a-w-    c:\windows\SysWow64\npdeployJava1.dll
2012-10-09 13:50 . 2012-04-24 18:46    696760    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-09 13:50 . 2011-07-01 12:49    73656    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-09-29 18:54 . 2012-09-29 20:11    25928    ----a-w-    c:\windows\system32\drivers\mbam.sys
2012-09-14 19:19 . 2012-10-10 07:41    2048    ----a-w-    c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-10 07:41    2048    ----a-w-    c:\windows\SysWow64\tzres.dll
2012-09-13 13:26 . 2012-08-30 12:52    1259888    ----a-w-    c:\windows\system32\dmwu.exe
2012-09-13 13:25 . 2012-08-30 12:52    35328    ----a-w-    c:\windows\system32\ImHttpComm.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2010-07-06 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"Guard.Mail.ru.gui"="c:\program files (x86)\Guard-ICQ\GuardICQ.exe" [2012-07-06 1564368]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\Matze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-14 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 14120]
R3 fwlanusb4;FRITZ!WLAN N/G;c:\windows\system32\DRIVERS\fwlanusb4.sys [2010-10-22 1293824]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 694888]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 191616]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-11 239616]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-06-11 361984]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2012-07-06 1564368]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]
S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2010-07-01 38992]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 21504]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper    REG_MULTI_SZ       nosGetPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 13:50]
.
2012-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-29 21:10]
.
2012-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-29 21:10]
.
2012-12-08 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-12-13 20:02]
.
2011-09-30 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files (x86)\NCH Swift Sound\WavePad\wavepad.exe [2011-09-27 14:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50    133400    ----a-w-    c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2782096]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tzvk7ma0.default\
FF - ExtSQL: 2012-11-11 10:38; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
AddRemove-SBMWW - c:\windows\IsUn0407.exe
AddRemove-Virtual Voice_is1 - c:\program files (x86)\Virtual Voice\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\TrustedInstaller\Security]
@DACL=(02 0000)
@SACL=
"Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,34,00,00,00,02,
   00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02,00,00,00,00,00,05,20,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-12-08  17:40:06 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-12-08 16:40
ComboFix2.txt  2012-10-10 12:11
.
Vor Suchlauf: 20 Verzeichnis(se), 100.927.787.008 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 100.217.294.848 Bytes frei
.
- - End Of File - - C41237B61E620C19C94457F3DD9C74AA

Add-removePrograms.txt

Code:

ATTFilter

"S-Bahn Leipzig" -  2 CAB Edition ( V1.1B ) 1.1B
"S-Bahn Leipzig" -  2 CAB Edition ( V1.2B ) 1.2B
"S-Bahn Leipzig" -  Update 1.1A 1.1A
7-Zip 9.20
Abschleppwagen-Simulator 2010 Version 1.25
Adobe AIR
Adobe Download Manager
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4) - Deutsch
Adobe Shockwave Player 11.6
Adventskalender
Alabama Smith
Alarm für Cobra 11 - Das Syndikat
Alarm für Cobra 11 - Das Syndikat - DEMO
AMD VISION Engine Control Center
ANNO 1404
Anno 1701
Anno 1701 - Der Fluch des Drachen
ANNO 2070
ANNO 2070 DEMO
Apple Application Support
Apple Software Update
ArtMoney SE v7.39
Audacity 1.3.14 (Unicode)
AV Voice Changer Software GOLD 7.0
avast! Free Antivirus
AVM FRITZ!WLAN
Bagger-Simulator 2011
Bau-Simulator 2012 Version 1.0
Baumaschinen Simulator Demo (entfernen)
Browser Configuration Utility
Bus-Simulator 2009
Canon G.726 WMP-Decoder
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon My Printer
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC 8
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Cobra 11 - Burning Wheels (remove only)
Cobra 11 - Crash Time (remove only)
Cobra 11 - Highway Nights (remove only)
D3DX10
Der Planer 4 Version 1.3
Die Siedler II - Die nächste Generation
Die Sims™ 3
Disk Cleaner (remove only)
EasySaver B9.1214.1 
EBULA Schreiber 1.3
Emergency 2012
Emergency4
ERS Berlin
ERS Berlin 2 Beta
ESET Online Scanner v3
eSpeak version 1.45.05
Exact Audio Copy 1.0beta1
Feuer- und Notfallsimulation Wegberg Version 5.0
Feuerwache 1.16
Feuerwehr-Simulator 2010
FIFA 10
Franzis 3D-Eisenbahnplaner 11
Fritz und Fertig
Gabelstapler Simulator 2009 (entfernen)
Garbage Truck Simulator (remove only)
German Truck Simulator 1.00
GIMP 2.6.11
Google Chrome
Google Update Helper
Gourmania
GPL Ghostscript
Green Line 3 Sprachtrainer
Green Line 4 Sprachtrainer
Green Line 5 Sprachtrainer
Guard.ICQ
Harry Potter und der Halbblut-Prinz™
Harry Potter und der Orden des Phönix™
Hochseefischen - Die Simulation
HP Deskjet 3050 J610 series Hilfe
HP Photo Creations
HP Update
HydraVision
HyperCam 2
HyperCam 3
Installation Stellwerk Bremen
Installation Stellwerk Hamburg-Altona
Installation Stellwerk Hannover
Installation Stellwerk Köln-Deutz
Installation Stellwerk Kempten
Installation Stellwerk Neumünster
ix JinglePlayer
Java 7 Update 7
Java Auto Updater
Jäger des Geisterhauses
John Deere North American Farmer
Kids entdecken die Geschichte
L&H TTS3000 British English
L&H TTS3000 Deutsch
L&H TTS3000 Español
L&H TTS3000 Français
L&H TTS3000 Italiano
L&H TTS3000 Nederlands
L&H TTS3000 Português (Brasil)
L&H TTS3000 Russian
Löwenzahn 1
Löwenzahn 5
Lame ACM MP3 Codec
Landwirtschafts-Simulator 2009
Landwirtschafts Simulator 2011
Landwirtschafts Simulator 2011 Demo
Landwirtschafts Simulator 2013 Demo
Language Reader 2.01
Lemure
Lernout & Hauspie TruVoice American English TTS Engine
LesefixPRO
Loewenzahn 2
Loewenzahn 3
Loewenzahn 4
Loewenzahn 6
Müllabfuhr-Simulator 2008 DEMO
Malwarebytes Anti-Malware Version 1.65.1.1000
Microsoft .NET Framework 1.1
Microsoft Flight Simulator 2002
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft WSE 3.0 Runtime
Mozilla Firefox 16.0 (x86 de)
Mozilla Maintenance Service
Mozilla Thunderbird 16.0.2 (x86 de)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MuseScore 1.2 MuseScore score typesetter
Mysteriöse Kriminalfälle
Mystery Cookbook
Nürnberg - Bayreuth 1.0
NVIDIA PhysX
ON_OFF Charge B10.0427.1
OpenOffice.org 3.4.1
ProtectDisc Driver, Version 11
PTP
QuickTime
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
Rescue Helicopter
Rettungswagen Simulator 2012
Revo Uninstaller 1.94
River-Simulator 2012 - Demo version 1.22
RollerCoaster Tycoon 3
Schiff-Simulator 2008
Schiffe bauen mit Willy Werkel
Schiffsim 2006
Scribus 1.4.0
Secunia PSI (2.0.0.4003)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Simulationsprogramm Integrierte Leitstelle V4
Ski Region Simulator 2012 Demo
Skiregion Simulator 2012
Skiregion Simulator 2012 Demo
Skype™ 5.10
Sprachtrainer Fonts
Spreng- und Abriss-Simulator (Demo)
Sprill Bermuda
Star Wars: The Old Republic
swMSM
THW Simulator 2012 Demo
TKKG16
Treasure Masters, Inc.
Ubisoft Game Launcher
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Virtual Voice 1.5
VLC media player 2.0.2
WavePad Audiobearbeitungs-Software
Willi wills wissen - Feuerwehr im Einsatz
Willi wills wissen - Notruf - Retter im Einsatz
Willi wills wissen - SOS Rettung auf See
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Winterberg Configurator Version WEM Confi 8.5
World of Subways Vol.1
World of Subways Vol.2
World of Tanks
XviD MPEG-4 Video Codec
Youda Legend

t'john · 09.12.2012, 11:55

Sehr gut!

Wie laeuft der Rechner?

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

delrod · 09.12.2012, 12:28

Zitat:

Wie laeuft der Rechner?

Soweit ich das sehe, sehr gut!!!

Emsisoft-Log folgt bald.

delrod · 10.12.2012, 07:14

so, hier das Log; hat etwas länger gedauert:

Code:

ATTFilter

Emsisoft Anti-Malware - Version 7.0
Letztes Update: N/A

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn:    09.12.2012 21:02:24

C:\Program Files (x86)\eGames     gefunden: Trace.File.Bling-O (A)
C:\Qoobox\Quarantine\C\Users\Matze\wgsdgsdgdsgsd.exe.vir     gefunden: Trojan-Ransom.Win32.Reveton (A)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\68964380-6ca1e5bf -> test2.class     gefunden: Exploit.Java.CVE-2012-5076.D (B)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19ef2a54-1370b69b -> photo/Zoom.class     gefunden: Java.Exploit.CVE-2010-0840.Y (B)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\1a6011b4-518c129f -> json/Search.class     gefunden: Java.Exploit.CVE-2010-0840.Y (B)
C:\Users\Matze\Videos\Documents\Downloads\1278668442-PoliceDiePolizeiSimulationTrainerGGHZ.rar -> Police - Die Polizei Simulation Trainer - GGHZ.exe     gefunden: Trojan.Generic.6487257 (B)
C:\Users\Matze\Videos\Documents\Downloads\die_polizei_simulation_tr.zip -> Police - Die Polizei Simulation Trainer - GGHZ.exe     gefunden: Trojan.Generic.6487257 (B)
C:\Users\Matze\Videos\Documents\f0f5de_4bc84e8f61e93\Der Planer 4 Trainer +4 v1.1.exe     gefunden: Trojan.Generic.4643686 (B)
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-14 162111\Backup files 5.zip -> C\Users\Matze\Documents\Downloads\die_polizei_simulation_tr.zip -> Police - Die Polizei Simulation Trainer - GGHZ.exe     gefunden: Trojan.Generic.6487257 (B)
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-28 115051\Backup files 1.zip -> C\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19ef2a54-1370b69b -> photo/Zoom.class     gefunden: Java.Exploit.CVE-2010-0840.Y (B)
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-28 115051\Backup files 1.zip -> C\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\1a6011b4-518c129f -> json/Search.class     gefunden: Java.Exploit.CVE-2010-0840.Y (B)

Gescannt    816118
Gefunden    11

Scan Ende:    10.12.2012 06:51:28
Scan Zeit:    9:49:04

C:\Users\Matze\Videos\Documents\f0f5de_4bc84e8f61e93\Der Planer 4 Trainer +4 v1.1.exe    Quarantäne Trojan.Generic.4643686 (B)
C:\Users\Matze\Videos\Documents\Downloads\1278668442-PoliceDiePolizeiSimulationTrainerGGHZ.rar -> Police - Die Polizei Simulation Trainer - GGHZ.exe    Quarantäne Trojan.Generic.6487257 (B)
C:\Users\Matze\Videos\Documents\Downloads\die_polizei_simulation_tr.zip -> Police - Die Polizei Simulation Trainer - GGHZ.exe    Quarantäne Trojan.Generic.6487257 (B)
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-14 162111\Backup files 5.zip -> C\Users\Matze\Documents\Downloads\die_polizei_simulation_tr.zip -> Police - Die Polizei Simulation Trainer - GGHZ.exe    Quarantäne Trojan.Generic.6487257 (B)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19ef2a54-1370b69b -> photo/Zoom.class    Quarantäne Java.Exploit.CVE-2010-0840.Y (B)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\1a6011b4-518c129f -> json/Search.class    Quarantäne Java.Exploit.CVE-2010-0840.Y (B)
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-28 115051\Backup files 1.zip -> C\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19ef2a54-1370b69b -> photo/Zoom.class    Quarantäne Java.Exploit.CVE-2010-0840.Y (B)
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\68964380-6ca1e5bf -> test2.class    Quarantäne Exploit.Java.CVE-2012-5076.D (B)
C:\Qoobox\Quarantine\C\Users\Matze\wgsdgsdgdsgsd.exe.vir    Quarantäne Trojan-Ransom.Win32.Reveton (A)
C:\Program Files (x86)\eGames    Quarantäne Trace.File.Bling-O (A)

Quarantäne    10

Im Moment hat der Rechner keine Netzverbindung - wurde wohl durch Defogger abgeschaltet. Wann sollte ich das wieder herstellen und was mache ich am Schluss mit diesen Programmen (siehe Screenshot im Anhang)?

t'john · 10.12.2012, 13:44

Die Entfernen wir zum Schluss.

Sehr gut!

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

delrod · 11.12.2012, 17:17

mann, hat das lange gedauert.

Hier kommt dann endlich das Log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=81abd4a5654ecf4ea95f16de3ece1a74
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-10-12 09:37:07
# local_time=2012-10-12 11:37:07 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 253332 101653899 0 0
# compatibility_mode=8192 67108863 100 0 351 351 0 0
# scanned=442840
# found=8
# cleaned=0
# scan_time=10577
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll    Win32/Toolbar.MyWebSearch application (unable to clean)    00000000000000000000000000000000    I
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll    Win32/Toolbar.MyWebSearch.Q application (unable to clean)    00000000000000000000000000000000    I
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll    Win32/Toolbar.MyWebSearch application (unable to clean)    00000000000000000000000000000000    I
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19ef2a54-1370b69b    multiple threats (unable to clean)    00000000000000000000000000000000    I
C:\Users\Matze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\1a6011b4-518c129f    multiple threats (unable to clean)    00000000000000000000000000000000    I
C:\Users\Matze\Documents\Downloads\SweetImSetup(1).exe    a variant of Win32/SweetIM.B application (unable to clean)    00000000000000000000000000000000    I
C:\Users\Matze\Documents\Downloads\SweetImSetup.exe    a variant of Win32/SweetIM.B application (unable to clean)    00000000000000000000000000000000    I
C:\Users\Matze\Documents\Downloads\VeohWebPlayerSetup_eng.exe    Win32/Toolbar.Zugo application (unable to clean)    00000000000000000000000000000000    I
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6844
# api_version=3.0.2
# EOSSerial=81abd4a5654ecf4ea95f16de3ece1a74
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-12-11 03:45:25
# local_time=2012-12-11 04:45:25 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 100 94 2012996 131946997 0 0
# compatibility_mode=5893 16776573 100 94 2054816 106870575 0 0
# scanned=511355
# found=7
# cleaned=7
# scan_time=76297
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-10-16 191448\Backup files 1.zip    Java/Agent.DW trojan (deleted - quarantined)    1FBF33016FF9DD73A4FEAEAD53E12E0F05FB903D    C
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2011-11-06 190001\Backup files 3.zip    multiple threats (deleted - quarantined)    06168B2BEF96243448F7C69668A84F1B3CDC8855    C
D:\MATZENEU\Backup Set 2011-10-03 173126\Backup Files 2012-03-18 190007\Backup files 1.zip    a variant of Java/Exploit.Blacole.AN trojan (deleted - quarantined)    87FB2A417E40132E680811597C35E3D827570443    C
D:\MATZENEU\Backup Set 2012-05-06 190003\Backup Files 2012-05-06 190003\Backup files 2.zip    multiple threats (deleted - quarantined)    20CBDFBC315AC0E459013316122A0E231D652F85    C
D:\MATZENEU\Backup Set 2012-05-29 092750\Backup Files 2012-05-29 092750\Backup files 2.zip    multiple threats (deleted - quarantined)    5372613A3EE75868ECED08C4D15379C715B92DA1    C
D:\MATZENEU\Backup Set 2012-09-30 190003\Backup Files 2012-09-30 190003\Backup files 1.zip    multiple threats (deleted - quarantined)    101DF835E690102D72AB87CA30D4A2D6CBA181E2    C
D:\MATZENEU\Backup Set 2012-09-30 190003\Backup Files 2012-12-09 210730\Backup files 1.zip    a variant of Java/Exploit.CVE-2012-5076.Q trojan (deleted - quarantined)    EA4EA50DFD1890FFA315651FC8EC5A9034FC92E2    C

t'john · 12.12.2012, 06:13

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

delrod · 14.12.2012, 19:01

diesmal hat mein Sohn den Check selber durchgeführt und mir diese Daten gegeben:

Code:

ATTFilter

Schritt 1: Klicken Sie auf Update, um ein Plugin zu aktualisieren. Schritt 2: Führen Sie alle empfohlenen Updates durch, bevor Sie Ihren Browser neu starten. Plugin-Details Ergebnis Aktion Angreifbare Plugins: Plugin Icon QuickTime Plug-in 7.7.2 The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site. Angreifbar (weitere Informationen) Jetzt aktualisieren Plugin Icon Shockwave Flash Shockwave Flash 11.4 r402 Angreifbar (weitere Informationen) Jetzt aktualisieren Plugin Icon Silverlight Plug-In 5.1.10411.0 5.1.10411.0 Aktuell Plugin Icon VLC Web Plugin VLC media player Web Plugin 2.0.2 2.0.2.0 Aktuell Plugin Icon Adobe Acrobat Adobe PDF Plug-In For Firefox and Netscape 10.1.4 10.1.4.38 Aktuell Plugin Icon Shockwave for Director Adobe Shockwave for Director Netscape plug-in, version 11.6.7.637 11.6.7.637 Aktuell Plugin Icon NPCIG.dll CANON iMAGE GATEWAY Mycamera Plugin Unbekanntes Plugin Suchen Plugin Icon Zylom Plugin Zylom Plugin Unbekanntes Plugin Suchen Plugin Icon VideoDownloadConverter Installer Plugin Stub VideoDownloadConverter Installer Plugin Stub for 32-bit Windows Unbekanntes Plugin Suchen Plugin Icon Google Update Google Update Unbekanntes Plugin Suchen Plugin-Tipps Was ist ein Plugin? Warum sollte ich meine Plugins aktualisieren? Wie kann Firefox mir dabei helfen? Welche Plugins habe ich? Wie kann ich ein Plugin deaktivieren? Benötigen Sie Hilfe? Besuchen Sie support.mozilla.org Lesen Sie Hilfeartikel über Plugins

Der Rechner läuft zur Zeit einwandfrei.

Das sieht ja wüst aus - bringt der plugin-check immer solch unübersichtliche Logs oder ist da was schief gegangen?

t'john · 15.12.2012, 15:39

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

JAVA Plug-In deaktivieren

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

05.12.2012, 19:19	#2
t'john /// Helfer-Team	BKA Trojaner (Trojan.ransom) das MBAM-Logfile vollstaendig posten! Wo ist OTL.txt? __________________ __________________

15.12.2012, 15:39	#15
t'john /// Helfer-Team	BKA Trojaner (Trojan.ransom) Java deaktivieren Aufgrund derezeitigen Sicherheitsluecke: JAVA Plug-In deaktivieren Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck __________________ Mfg, t'john Das TB unterstützen

BKA Trojaner (Trojan.ransom)

Plagegeister aller Art und deren Bekämpfung: BKA Trojaner (Trojan.ransom)