| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Kampf gegen den claro-Trojaner aufgenommenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
18.12.2012, 15:05
| #1 |
| |  Kampf gegen den claro-Trojaner aufgenommen Hallo liebes Forum, schon vor geraumer Zeit (irgendwann im November, da die Chronik im Oktober noch frei ist von claro) ist mir aufgefallen, dass sich die Startseite des Firefoxbrowsers und auch die Suche bei meinem Laptop (Fujitsu Lifebook mit Win 7 32 bit) verändert hat. Ich habe zunächst die claro-suchengine entfernt und die Seite wieder zurückgestellt. Da ich den Laptop nicht häufig benutze habe ich erst kürzlich festgestellt, dass sich die Suche eigenständig wieder umgestellt hat. Nach googeln bin ich dann auf diesen Beitrag hier im Forum gestoßen: http://www.trojaner-board.de/127281-...ntfernen.html. Bislang habe ich den adwcleaner laufen lassen, die automatischen Updates aktiviert (ich weiß, reichlich spät) und Windows auf den neusten Stand gebracht, Stand war Sept.2012. (letztes Update), und OTL suchen lassen, einmal vor und dreimal nach den Updates. Ich poste hier die adwcleaner logfile: # AdwCleaner v2.101 - Datei am 17/12/2012 um 17:56:45 erstellt # Aktualisiert am 16/12/2012 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits) # Benutzer : user - NB03 # Bootmodus : Normal # Ausgeführt unter : D:\Downloads\adwcleaner.exe # Option [Löschen] **** [Dienste] **** Gestoppt & Gelöscht : Browser Manager Gestoppt & Gelöscht : DefaultTabSearch Gestoppt & Gelöscht : DefaultTabUpdate ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml Gelöscht mit Neustart : C:\ProgramData\Browser Manager Ordner Gelöscht : C:\Program Files\Claro LTD Ordner Gelöscht : C:\Program Files\DefaultTab Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc ***** [Registrierungsdatenbank] ***** Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\25911~1.18\{c16c1~1\mngr.dll Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\25976~1.107\{c16c1~1\mngr.dll Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DefaultTab Schlüssel Gelöscht : HKCU\Software\Claro LTD Schlüssel Gelöscht : HKCU\Software\DataMngr Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar Schlüssel Gelöscht : HKCU\Software\Default Tab Schlüssel Gelöscht : HKCU\Software\DefaultTab Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\Claro LTD Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{000F18F2-09EB-4A59-82B2-5AE4184C39C3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{05340575-7D2A-4266-9A84-7EEBDC476884} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97C47A30-3CFB-474B-94E3-6019A7EE0610} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9E131A93-EED7-4BEB-B015-A0ADB30B5646} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE4FC43F-84CE-4E20-88C2-2188525B47FB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Schlüssel Gelöscht : HKLM\Software\DataMngr Schlüssel Gelöscht : HKLM\Software\Default Tab Schlüssel Gelöscht : HKLM\Software\DefaultTab Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{60295942-9E5F-4EE8-B785-3A655904D24F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000F18F2-09EB-4A59-82B2-5AE4184C39C3} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\claro Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope] Wert Gelöscht : HKCU\Software\Mozilla\Firefox\extensions [{58BD07EB-0EE0-4DF0-8121-DC9B693373DF}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{9E131A93-EED7-4BEB-B015-A0ADB30B5646}] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16450 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v17.0.1 (de) -\\ Google Chrome v23.0.1271.97 ************************* AdwCleaner[S1].txt - [4945 octets] - [17/12/2012 17:56:45] ########## EOF - C:\AdwCleaner[S1].txt - [5005 octets] ########## und den letzten OTL-Scan, ein Qucikscan, bei dem ich allerdings das Dateialter auf 60 Tage hochgesetzt habe, da die Infektion schon länger als 30 Tage her ist (was aber scheinbar nicht funktioniert): OTL logfile created on: 18.12.2012 14:49:08 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = D:\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,95 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 43,44% Memory free 3,91 Gb Paging File | 2,61 Gb Available in Paging File | 66,73% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 75,34 Gb Total Space | 54,68 Gb Free Space | 72,58% Space Free | Partition Type: NTFS Drive D: | 73,61 Gb Total Space | 55,90 Gb Free Space | 75,94% Space Free | Partition Type: NTFS Drive E: | 2,62 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: NB03 | User Name: user | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.17 17:52:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Desktop\OTL.exe PRC - [2012.12.16 10:54:41 | 000,916,960 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- D:\avast\AvastUI.exe PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- D:\avast\AvastSvc.exe PRC - [2012.08.27 05:21:12 | 026,924,984 | ---- | M] (Dropbox, Inc.) -- C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.03.21 15:17:54 | 000,094,064 | ---- | M] (SMART Technologies) -- C:\Programme\SMART Technologies\Education Software\SMARTInk.exe PRC - [2012.03.21 14:26:04 | 000,580,976 | ---- | M] (SMART Technologies) -- C:\Programme\SMART Technologies\Education Software\SMARTHelperService.exe PRC - [2012.03.21 14:25:28 | 002,186,096 | ---- | M] (SMART Technologies) -- C:\Programme\SMART Technologies\Education Software\SMARTBoardService.exe PRC - [2012.03.09 08:14:50 | 010,132,336 | ---- | M] (SMART Technologies ULC) -- C:\Programme\SMART Technologies\Education Software\SMARTBoardTools.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.11.06 00:00:00 | 000,057,344 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\fjmnuico.exe PRC - [2009.11.06 00:00:00 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjEvents.exe PRC - [2009.10.09 00:00:00 | 002,792,232 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe PRC - [2009.10.09 00:00:00 | 000,186,664 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Pen_TabletUser.exe PRC - [2009.07.14 02:14:42 | 000,181,760 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\TabTip.exe PRC - [2009.07.14 02:14:21 | 000,294,400 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe PRC - [2009.06.04 12:48:00 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2008.05.06 16:15:44 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjDspMon.exe PRC - [2007.11.19 15:32:32 | 000,717,312 | ---- | M] (Dr. Kaiser Systemhaus GmbH) -- C:\Programme\DKS\Drive\DksStatus.exe ========== Modules (No Company Name) ========== MOD - [2012.12.18 14:11:25 | 018,002,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\c881e2d2ec912499834feb85c4c2e483\PresentationFramework.ni.dll MOD - [2012.12.18 14:11:11 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\58f50a891bafb8fd7149e6eebc2b7b52\PresentationCore.ni.dll MOD - [2012.12.18 14:11:01 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\05ebffcb5aac31412fea8c38cbac8df8\WindowsBase.ni.dll MOD - [2012.12.18 14:10:58 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\cbb227c0a77a5b15a1255220984239f2\PresentationFramework.Aero.ni.dll MOD - [2012.12.18 14:08:53 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\cb0c00757e89f0b1fe282913ed667212\System.Xml.ni.dll MOD - [2012.12.18 14:08:49 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ed886fb71addf400705481dcf8de12da\System.Configuration.ni.dll MOD - [2012.12.18 14:08:41 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\752225ca2585aa8f1c46b489e172e920\System.Core.ni.dll MOD - [2012.12.18 14:08:23 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\9422d0c052186760a4645e10995487f5\System.Drawing.ni.dll MOD - [2012.12.18 14:08:22 | 009,093,632 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\811a7bc79f8f0a5be8065292a320819e\System.ni.dll MOD - [2012.12.18 14:08:15 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\16126cae96ea2422253ae06eeb672abc\mscorlib.ni.dll MOD - [2012.12.16 10:54:41 | 002,397,152 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.09.23 20:52:15 | 000,054,184 | ---- | M] () -- C:\Windows\winsxs\x86_smarttech.boost_thread.vc100.1.44_9ca15c999435ee05_1.0.1.0_none_472b4edec4bf8550\boost_thread-vc100-mt-1_44.dll MOD - [2012.09.23 20:51:45 | 000,051,120 | ---- | M] () -- C:\Windows\winsxs\x86_smarttech.boost_date_time.vc100.1.44_9ca15c999435ee05_1.0.1.0_none_50d6b3902c95d15a\boost_date_time-vc100-mt-1_44.dll MOD - [2007.05.25 14:18:08 | 000,081,920 | ---- | M] () -- C:\Windows\System32\dksio.dll ========== Services (SafeList) ========== SRV - [2012.12.16 10:54:41 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.12.15 13:14:29 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2012.09.23 20:51:43 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.03.21 14:26:04 | 000,580,976 | ---- | M] (SMART Technologies) [Auto | Running] -- C:\Programme\SMART Technologies\Education Software\SMARTHelperService.exe -- (SMARTHelperService) SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.09.09 09:30:29 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2009.10.09 00:00:00 | 002,792,232 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen) SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.06.04 12:48:00 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2006.10.26 18:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr) DRV - [2012.10.07 11:37:50 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2012.07.26 15:49:24 | 000,132,608 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2plx86) DRV - [2012.03.21 14:26:40 | 000,011,632 | ---- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SMARTMouseFilterx86.sys -- (SMARTMouseFilterx86) DRV - [2012.03.21 14:26:34 | 000,021,872 | ---- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SMARTVTabletPCx86.sys -- (SMARTVTabletPCx86) DRV - [2012.03.21 14:26:30 | 000,014,704 | ---- | M] (SMART Technologies ULC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys -- (SMARTVHidMini2000x86) DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.03.23 10:26:00 | 000,005,888 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02b1.sys -- (FUJ02B1) DRV - [2010.03.23 08:52:59 | 000,273,448 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\k57nd60x.sys -- (k57nd60x) DRV - [2009.12.03 16:48:44 | 000,625,224 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF) DRV - [2009.10.09 00:00:00 | 000,036,648 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wisdpen.sys -- (WISDPen) DRV - [2009.10.09 00:00:00 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid) DRV - [2009.10.09 00:00:00 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter) DRV - [2009.10.05 16:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009.09.01 00:00:00 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) DRV - [2009.07.14 00:45:20 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\acpials.sys -- (acpials) DRV - [2007.12.21 12:28:10 | 000,135,200 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\dksdrv2k.sys -- (Waechter) DRV - [2005.11.14 13:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR) DRV - [2004.01.18 04:15:00 | 000,004,864 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02e3.sys -- (FUJ02E3) DRV - [2003.06.20 14:30:48 | 000,011,392 | ---- | M] (Fujitsu PC Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FjBtndrv.sys -- (Fjbtndrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 23 5B A6 22 60 CA CA 01 [binary data] IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2742214133-713429895-2984856512-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Claro Search" FF - prefs.js..browser.search.order.1: "Claro Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledAddons: %7B338e0b96-2285-4424-b4c8-e25560750fa3%7D:3 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - prefs.js..keyword.URL: "hxxp://www.claro-search.com/?affID=117452&tt=4712_7&babsrc=KW_ss&mntrId=7e27bd090000000000008c736e7796d7&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.16 10:54:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.10 22:56:59 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.12.16 10:54:41 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.10 22:56:59 | 000,000,000 | ---D | M] [2010.09.09 09:58:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions [2012.11.24 15:02:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\x6s7ah3p.default\extensions [2012.11.22 06:53:40 | 000,000,000 | ---D | M] (Default Tab) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\x6s7ah3p.default\extensions\addon@defaulttab.com [2012.11.22 06:53:40 | 000,022,390 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\x6s7ah3p.default\extensions\addon@defaulttab.com.xpi [2012.09.29 09:11:49 | 000,003,145 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\x6s7ah3p.default\extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2012.11.10 22:56:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.12.16 10:54:41 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.09.06 03:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 03:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.09.06 03:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 03:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.09.06 03:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 03:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.claro-search.com/?affID=117452&tt=4712_7&babsrc=HP_ss&mntrId=7e27bd090000000000008c736e7796d7 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\22.0.1229.79\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (SMART Notebook Download Utility) - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Programme\SMART Technologies\Education Software\Win32\NotebookPlugin.dll (SMART Technologies ULC.) O2 - BHO: (DefaultTab Browser Helper) - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\user\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avast] D:\avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [DksStatus.exe] C:\Programme\DKS\Drive\DksStatus.exe (Dr. Kaiser Systemhaus GmbH) O4 - HKLM..\Run: [FjStrtAp] C:\Programme\Fujitsu\Utils\fjstrtap.exe (Fujitsu Computer Systems Corp.) O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\Education Software\SMARTBoardService.exe (SMART Technologies) O4 - HKLM..\Run: [SMART Board Tools] C:\Program Files\SMART Technologies\Education Software\SMARTBoardTools.exe (SMART Technologies ULC) O4 - HKLM..\Run: [SMART Ink] C:\Program Files\SMART Technologies\Education Software\SMARTInk.exe (SMART Technologies) O4 - HKU\S-1-5-21-2742214133-713429895-2984856512-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Encarta Suchleiste - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Common Files\microsoft shared\Encarta Search Bar\ENCSBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FC28BAA-5E2A-4718-9525-37FE636069B8}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A97ABAB-6B98-482F-A258-0FE71E07BDF8}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{15bc6163-ea98-11df-b5ec-e839df06b3b0}\Shell - "" = AutoRun O33 - MountPoints2\{15bc6163-ea98-11df-b5ec-e839df06b3b0}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{6c18bee1-69ab-11e0-8eca-8c736e7796d7}\Shell - "" = AutoRun O33 - MountPoints2\{6c18bee1-69ab-11e0-8eca-8c736e7796d7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{9858e4c8-35cb-11df-93df-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{9858e4c8-35cb-11df-93df-806e6f6e6963}\Shell\AutoRun\command - "" = E:\bootcd\wintools\autorun.exe O33 - MountPoints2\{9858e4c8-35cb-11df-93df-806e6f6e6963}\Shell\Option1\Command - "" = E:\bootcd\wintools\autorun.exe O33 - MountPoints2\{a77674e2-9134-11e0-b4c7-8c736e7796d7}\Shell - "" = AutoRun O33 - MountPoints2\{a77674e2-9134-11e0-b4c7-8c736e7796d7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{cf4a3962-5544-11e0-af67-8c736e7796d7}\Shell - "" = AutoRun O33 - MountPoints2\{cf4a3962-5544-11e0-af67-8c736e7796d7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.18 14:27:28 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM [2012.12.18 14:27:10 | 001,784,352 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll [2012.12.18 14:27:10 | 000,339,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll [2012.12.18 14:27:10 | 000,185,776 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll [2012.12.18 14:27:10 | 000,167,936 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll [2012.12.18 14:27:10 | 000,135,168 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll [2012.12.18 14:27:08 | 001,933,312 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll [2012.12.18 14:27:08 | 000,290,304 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll [2012.12.18 14:27:08 | 000,290,304 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll [2012.12.18 14:27:08 | 000,159,744 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll [2012.12.18 14:27:08 | 000,126,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll [2012.12.18 14:27:07 | 000,266,240 | ---- | C] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll [2012.12.18 14:27:07 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.12.18 14:27:03 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp [2012.12.18 14:13:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- D:\Desktop\OTL.exe [2012.12.18 14:07:00 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.12.17 14:40:39 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Skype [2012.12.17 14:40:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.12.17 14:40:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.12.17 14:40:29 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.12.17 14:40:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.12.15 20:08:55 | 000,000,000 | ---D | C] -- C:\Program Files\GOG.com [2012.12.15 13:16:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Programs [2012.12.15 12:33:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com [2012.12.15 12:33:49 | 000,000,000 | ---D | C] -- C:\GOG Games [2012.11.22 06:56:17 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\vlc [2012.11.22 06:53:40 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\DefaultTab [2012.11.22 06:53:38 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\SwvUpdater [2012.11.22 06:53:20 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Claro [2012.11.22 06:52:54 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Babylon [2012.11.22 06:52:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2012.11.22 06:52:37 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.12.18 14:47:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.12.18 14:38:51 | 000,020,640 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.18 14:38:51 | 000,020,640 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.18 14:32:24 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job [2012.12.18 14:31:19 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.12.18 14:30:10 | 000,195,584 | -HS- | M] () -- C:\dksimage.bin [2012.12.18 14:25:18 | 001,784,352 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll [2012.12.18 14:25:18 | 000,339,968 | ---- | M] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll [2012.12.18 14:25:18 | 000,185,776 | ---- | M] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll [2012.12.18 14:25:18 | 000,167,936 | ---- | M] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll [2012.12.18 14:25:18 | 000,135,168 | ---- | M] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll [2012.12.18 14:25:15 | 000,290,304 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll [2012.12.18 14:25:15 | 000,290,304 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll [2012.12.18 14:25:14 | 001,933,312 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll [2012.12.18 14:25:14 | 000,159,744 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll [2012.12.18 14:25:14 | 000,126,976 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll [2012.12.18 14:25:10 | 000,266,240 | ---- | M] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll [2012.12.18 14:22:50 | 000,489,728 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.12.18 14:14:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.18 14:10:27 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.18 14:10:27 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.18 14:10:27 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.18 14:10:26 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.17 17:52:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Desktop\OTL.exe [2012.12.17 17:52:44 | 000,547,175 | ---- | M] () -- D:\Desktop\adwcleaner.exe [2012.12.17 14:40:30 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.12.17 07:15:21 | 000,003,540 | ---- | M] () -- C:\Users\user\AppData\Roaming\FjMenu1.XML [2012.12.15 20:09:58 | 000,002,660 | ---- | M] () -- C:\Users\Public\Desktop\The Incredible Machine - Even More Contraptions.lnk [2012.12.15 20:09:58 | 000,002,469 | ---- | M] () -- C:\Users\Public\Desktop\The Even More Incredible Machine.lnk [2012.12.15 20:09:58 | 000,002,441 | ---- | M] () -- C:\Users\Public\Desktop\The Incredible Machine 3.lnk [2012.12.15 20:09:57 | 000,002,662 | ---- | M] () -- C:\Users\Public\Desktop\Return of the Incredible Machine Contraptions.lnk [2012.12.15 13:16:50 | 000,001,669 | ---- | M] () -- C:\Users\Public\Desktop\Hotline Miami.lnk [2012.12.15 12:33:57 | 000,002,014 | ---- | M] () -- C:\Users\Public\Desktop\Duke Nukem 3D.lnk [2012.11.22 06:52:33 | 000,170,190 | ---- | M] () -- C:\Windows\unins000.dat [2012.11.22 06:52:16 | 000,723,230 | ---- | M] () -- C:\Windows\unins000.exe [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.12.18 14:13:57 | 000,547,175 | ---- | C] () -- D:\Desktop\adwcleaner.exe [2012.12.17 14:40:30 | 000,002,505 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.12.15 20:09:58 | 000,002,660 | ---- | C] () -- C:\Users\Public\Desktop\The Incredible Machine - Even More Contraptions.lnk [2012.12.15 20:09:58 | 000,002,469 | ---- | C] () -- C:\Users\Public\Desktop\The Even More Incredible Machine.lnk [2012.12.15 20:09:58 | 000,002,441 | ---- | C] () -- C:\Users\Public\Desktop\The Incredible Machine 3.lnk [2012.12.15 20:09:57 | 000,002,662 | ---- | C] () -- C:\Users\Public\Desktop\Return of the Incredible Machine Contraptions.lnk [2012.12.15 13:16:50 | 000,001,669 | ---- | C] () -- C:\Users\Public\Desktop\Hotline Miami.lnk [2012.12.15 12:33:57 | 000,002,014 | ---- | C] () -- C:\Users\Public\Desktop\Duke Nukem 3D.lnk [2012.11.22 06:53:38 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\AmiUpdXp.job [2012.11.22 06:52:32 | 000,723,230 | ---- | C] () -- C:\Windows\unins000.exe [2012.11.22 06:52:32 | 000,170,190 | ---- | C] () -- C:\Windows\unins000.dat [2012.09.23 21:56:11 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2010.09.09 12:52:05 | 000,003,540 | ---- | C] () -- C:\Users\user\AppData\Roaming\FjMenu1.XML ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.11.22 06:52:54 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Babylon [2012.11.22 06:53:20 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Claro [2012.10.07 11:38:17 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DAEMON Tools Lite [2012.11.22 06:53:40 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DefaultTab [2012.12.18 14:32:39 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Dropbox [2012.11.17 00:52:34 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\MediaMonkey [2012.09.23 21:37:56 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\SMART Technologies [2010.09.20 08:24:42 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\SMART Technologies Inc ========== Purity Check ========== < End of report > Nun habe ich festgestellt, dass es hier im Board gewünscht ist, immer einen eigenen Thread zu erstellen, also will ich das hiermit tun. Hinzu kommt, dass Firefox nach wie vor gehackt ist. Wenn ich neue Tabs öffne lande ich auf der Claro-Seite, auch wenn ich in der url-Zeile einen suchbegriff eingebe. Kurz: ich komme alleine auch gar nicht weiter. Ich hoffe, dass ich mich ansonsten einigermaßen an die Regeln im Board gehalten habe und hoffe auf eine gute Zusammenarbeit. Grüße beckmatt |
| Themen zu Kampf gegen den claro-Trojaner aufgenommen |
| 32 bit, adobe, adobe flash player, antivirus, appdatalow, autorun, avast, bho, defender, education, error, explorer, flash player, format, google, helper, internet, internet browser, internet explorer, logfile, löschen, mozilla, neue tabs, neustart, notebook, programme, registrierungsdatenbank, registry, software, updates, windows |
Baum-Darstellung