| |
| |||||||
Log-Analyse und Auswertung: Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings ExtensionWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
10.02.2013, 14:24
| #16 | ||
| /// TB-Ausbilder   |  Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, Zitat:
 Zitat:
 Schritt 1
Schritt 2 Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
testsigning on:
end
Fahre den Computer herunter. Schritt 3
Startet dein Rechner mittlerweile wieder in den normalen Modus? Bitte poste mit deiner nächsten Antwort
|
|
10.02.2013, 15:16
| #17 |
 | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus Matthias,
__________________hier zunächst die Fixlog.txt Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-02-2013 Ran by SYSTEM at 2013-02-10 14:47:45 Run:1 Running from G:\ ============================================== The operation completed successfully. ==== End of Fixlog ==== Und hier die FRST.txt Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-02-2013 Ran by SYSTEM at 10-02-2013 14:53:12 Running from G:\ Windows Vista (TM) Home Premium (X86) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\...\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [167936 2008-07-18] (Acer Corp.) HKLM\...\Run: [TrayServer] C:\PROGRA~1\MAGIX\VIDEO_~2\TrayServer.exe [90112 2008-08-07] (MAGIX AG) HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2008-03-25] (Hewlett-Packard) HKLM\...\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [81920 2008-03-12] (Hewlett-Packard) HKLM\...\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x] HKLM\...\Run: [Skytel] Skytel.exe [x] HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated) HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.) HKLM\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1278648 2012-09-12] (McAfee, Inc.) HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-24] (Apple Inc.) HKLM\...\Run: [CorelCreatorClient] C:\Program Files\Corel\Corel PDF Fusion\CorelCreatorClient.exe [667648 2012-04-25] (Global Graphics Software Ltd.) HKLM\...\Run: [DivXMediaServer] C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] () HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1263512 2012-11-29] () HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.) HKU\Default\...\RunOnce: [AcerScrSav] C:\Windows\Acer\run_NB.exe [24576 2007-08-21] () HKU\Default User\...\RunOnce: [AcerScrSav] C:\Windows\Acer\run_NB.exe [24576 2007-08-21] () HKU\urflamingo\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [68856 2008-10-04] (Google Inc.) HKU\urflamingo\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation) HKU\urflamingo\...\Run: [SMASH] "C:\Program Files\SoftMaker Office Professional 2012 (Trial)\smash.exe" [233507 2012-05-07] (SoftMaker Software GmbH) HKU\urflamingo\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation) HKU\urflamingo\...\Run: [DriverScanner] "C:\PROGRA~1\Uniblue\DRIVER~1\launcher.exe" delay 20000 [338296 2011-10-20] (Uniblue Systems Limited) HKLM\...\RunOnce: [OTL] "C:\Users\urflamingo\Downloads\OTL.exe" [602112 2013-02-07] (OldTimer Tools) Winlogon\Notify\AWinNotifyVitaKey MC3000: C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [X] Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll [X] Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Lsa: [Notification Packages] scecli C:\Program Files\Acer\Acer Bio Protection\PwdFilter Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.313\SSScheduler.exe (McAfee, Inc.) ==================== Services (Whitelisted) =================== 2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) 2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [356352 2006-12-27] (AVM Berlin) 2 BUNAgentSvc; "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe" [16384 2008-03-03] (NewTech Infosystems, Inc.) 2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [81504 2008-01-16] () 2 CloudBerry Backup Service; "C:\Program Files\CloudBerryLab\CloudBerry Online Backup\CloudBerry.Backup.Scheduler.exe" [32256 2012-03-02] (CloudBerry Lab Inc.) 3 CorelCreatorMessages; "C:\Windows\system32\CorelCreatorMessages.exe" [73728 2012-04-25] (Global Graphics Software Ltd) 2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-06-01] () 2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe /DisableUI [1840128 2011-05-24] (MAGIX AG) 3 FirebirdServerMAGIXInstance; "C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe" [2702848 2011-04-26] (MAGIX®) 2 gupdate1ca6630c49e7455; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [133104 2009-11-15] (Google Inc.) 2 IGBASVC; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [3602432 2008-09-08] () 2 LanmanWorkstation; C:\Windows\System32\svchost.exe -k LocalService [21504 2008-01-20] (Microsoft Corporation) 2 MBAMScheduler; "C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe" [398184 2012-12-14] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [682344 2012-12-14] (Malwarebytes Corporation) 2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.0.313\McCHSvc.exe" [234776 2012-10-26] (McAfee, Inc.) 2 McMPFSvc; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 2 mcmscsvc; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 2 McNaiAnn; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 2 McNASvc; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 3 McODS; "C:\Program Files\McAfee\VirusScan\mcods.exe" [279048 2012-11-16] (McAfee, Inc.) 2 McProxy; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [203400 2012-11-08] (McAfee, Inc.) 2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [168880 2012-11-08] (McAfee, Inc.) 2 mfevtp; "C:\Windows\system32\mfevtps.exe" [167344 2012-11-08] (McAfee, Inc.) 2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe -p [110592 2007-12-06] () 2 MOBKbackup; "C:\Program Files\McAfee Online Backup\MOBKbackup.exe" [229688 2010-04-13] (McAfee, Inc.) 2 MSK80Service; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [167784 2012-08-31] (McAfee, Inc.) 2 NAUpdate; "C:\Program Files\Nero\Update\NASvc.exe" [769432 2012-07-13] (Nero AG) 2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-25] () 3 PDF Suite 2012 Helper Service; "C:\Program Files\PDF Suite 2012\HelperService.exe" [813960 2011-12-07] (Interactive Brands Inc.) 2 PDF Suite 2012 Service; "C:\Program Files\PDF Suite 2012\ConversionService.exe" [886664 2011-12-07] (Interactive Brands Inc.) 2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [233472 2008-01-10] (Acer Incorporated) 3 UPnPService; C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [544768 2006-12-14] (Magix AG) 2 PSI_SVC_2; "c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [x] ==================== Drivers (Whitelisted) ==================== 2 acedrv11; \??\C:\Windows\system32\drivers\acedrv11.sys [277544 2009-01-19] (Protect Software GmbH) 3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.) 0 AlfaFF; C:\Windows\System32\Drivers\AlfaFF.sys [42608 2008-09-08] (Alfa Corporation) 1 avgtp; \??\C:\Windows\system32\drivers\avgtpx86.sys [31576 2013-01-30] (AVG Technologies) 3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2006-12-27] (AVM Berlin) 3 cfwids; C:\Windows\System32\drivers\cfwids.sys [60480 2012-11-08] (McAfee, Inc.) 3 dfmirage; C:\Windows\System32\DRIVERS\dfmirage.sys [34128 2009-03-28] (DemoForge, LLC) 3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2006-12-27] (AVM GmbH) 3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [146872 2012-04-20] (McAfee, Inc.) 3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [100736 2009-06-22] (Huawei Technologies Co., Ltd.) 2 int15; \??\C:\Windows\system32\drivers\int15.sys [69632 2007-01-25] () 3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [47104 2008-05-19] (Atheros Communications, Inc.) 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation) 0 McPvDrv; C:\Windows\System32\drivers\McPvDrv.sys [64832 2012-09-14] (McAfee, Inc.) 3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [132912 2012-11-08] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [234824 2012-11-08] (McAfee, Inc.) 3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [65488 2012-11-08] (McAfee, Inc.) 3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [362640 2012-11-08] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [565352 2012-11-08] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [92192 2012-11-08] (McAfee, Inc.) 1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [210136 2012-11-08] (McAfee, Inc.) 1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [54776 2010-04-13] (Mozy, Inc.) 2 regi; \??\C:\Windows\system32\drivers\regi.sys [13880 2010-11-16] (InterVideo) 3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-27] (Winbond Electronics Corporation) 2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [61424 2008-07-18] (Cyberlink Corp.) 3 catchme; \??\C:\ComboFix\catchme.sys [x] 3 cpuz132; \??\C:\Users\URFLAM~1\AppData\Local\Temp\cpuz132\cpuz132_x32.sys [x] 3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x] 3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x] 3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-02-09 11:33 - 2013-02-09 11:33 - 00000000 ___DC C:\FRST 2013-02-09 09:57 - 2013-02-09 09:57 - 00042254 ____A C:\Users\urflamingo\Downloads\Aktivierungshinweise_Gold_Mitgliedschaft.zip 2013-02-09 07:43 - 2013-02-09 07:43 - 00000000 ___DC C:\_OTL 2013-02-09 03:32 - 2013-02-09 03:32 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\urflamingo\Downloads\tdsskiller (1).exe 2013-02-09 03:31 - 2013-02-09 03:31 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\urflamingo\Downloads\tdsskiller.exe 2013-02-09 03:26 - 2013-02-09 03:27 - 04732416 ____A (AVAST Software) C:\Users\urflamingo\Downloads\aswMBR.exe 2013-02-08 11:34 - 2013-02-08 11:34 - 00000000 ____D C:\Users\urflamingo\Downloads\covertplayer_pro 2013-02-08 05:40 - 2013-02-08 05:40 - 00026095 ___AC C:\ComboFix.txt 2013-02-08 04:54 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2013-02-08 04:54 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2013-02-08 04:54 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-02-08 04:54 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-02-08 04:54 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-02-08 04:54 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2013-02-08 04:54 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2013-02-08 04:54 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2013-02-08 04:43 - 2013-02-08 05:40 - 00000000 ___DC C:\Qoobox 2013-02-08 04:42 - 2013-02-08 05:38 - 00000000 ____D C:\Windows\erdnt 2013-02-08 04:41 - 2013-02-08 04:41 - 05030592 ___RA (Swearware) C:\Users\urflamingo\Downloads\ComboFix.exe 2013-02-07 15:02 - 2013-02-07 15:02 - 00001199 ___AC C:\AdwCleaner[R1].txt 2013-02-07 14:10 - 2013-02-07 14:10 - 00582209 ____A C:\Users\urflamingo\Downloads\adwcleaner.exe 2013-02-07 14:07 - 2013-02-07 14:07 - 28181408 ____A (TuneUp Software) C:\Users\urflamingo\Downloads\TuneUpUtilities2013_de-DE(1).exe 2013-02-07 14:06 - 2013-02-07 14:06 - 28181408 ____A (TuneUp Software) C:\Users\urflamingo\Downloads\TuneUpUtilities2013_de-DE.exe 2013-02-07 14:06 - 2013-02-07 14:06 - 00000000 __SHD C:\Users\All Users\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} 2013-02-07 13:54 - 2013-02-07 13:54 - 00060754 ____A C:\Users\urflamingo\Desktop\JRT.txt 2013-02-07 13:50 - 2013-02-07 13:50 - 00000000 ____D C:\Windows\ERUNT 2013-02-07 13:48 - 2013-02-07 13:48 - 00000000 ___DC C:\JRT 2013-02-07 13:47 - 2013-02-07 13:47 - 00547275 ____A (Oleg N. Scherbakov) C:\Users\urflamingo\Downloads\Nicht bestätigt 518278.crdownload 2013-02-07 13:46 - 2013-02-07 13:47 - 00547275 ____A (Oleg N. Scherbakov) C:\Users\urflamingo\Downloads\JRT.exe 2013-02-07 12:05 - 2013-02-07 12:05 - 00080828 ____A C:\Users\urflamingo\Downloads\OTLTeil1 (1).txt 2013-02-07 12:04 - 2013-02-07 12:04 - 00080828 ____A C:\Users\urflamingo\Downloads\OTLTeil1.txt 2013-02-07 05:57 - 2013-02-07 05:57 - 00097512 ____A C:\Users\urflamingo\Downloads\Extras.Txt 2013-02-07 05:56 - 2013-02-09 07:33 - 00157902 ____A C:\Users\urflamingo\Downloads\OTL.Txt 2013-02-07 05:40 - 2013-02-07 05:40 - 00365568 ____A C:\Users\urflamingo\Downloads\gmer_2.0.18454.exe 2013-02-07 05:19 - 2013-02-07 05:19 - 00602112 ____A (OldTimer Tools) C:\Users\urflamingo\Downloads\OTL.exe 2013-02-07 05:14 - 2013-02-07 05:15 - 00000482 ____A C:\Users\urflamingo\Downloads\defogger_disable.log 2013-02-07 05:14 - 2013-02-07 05:14 - 00000000 ____A C:\Users\urflamingo\defogger_reenable 2013-02-07 05:12 - 2013-02-07 05:13 - 00050477 ____A C:\Users\urflamingo\Downloads\Defogger.exe 2013-02-06 15:22 - 2013-02-06 15:22 - 00000870 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-02-06 15:21 - 2012-12-14 07:49 - 00021104 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2013-02-06 12:56 - 2013-02-06 15:22 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-02-06 12:56 - 2013-02-06 12:56 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Malwarebytes 2013-02-06 12:56 - 2013-02-06 12:56 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-02-06 12:54 - 2013-02-06 12:54 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\urflamingo\Downloads\mbam-setup-1.70.0.1100.exe 2013-02-06 09:51 - 2013-02-06 09:54 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-02-05 09:31 - 2013-02-05 09:31 - 00351281 ____A C:\Users\urflamingo\Downloads\covertplayer_pro.zip 2013-02-05 09:10 - 2013-02-05 09:11 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\vlc 2013-02-05 09:09 - 2013-02-05 09:09 - 00000823 ____A C:\Users\Public\Desktop\VLC media player.lnk 2013-02-05 09:08 - 2013-02-05 09:08 - 00000000 ____D C:\Program Files\VideoLAN 2013-02-05 09:07 - 2013-02-05 09:07 - 22916830 ____A C:\Users\urflamingo\Downloads\vlc-2.0.5-win32.exe 2013-02-03 03:05 - 2013-02-03 03:04 - 00262560 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe 2013-02-03 03:05 - 2013-02-03 03:04 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe 2013-02-03 03:05 - 2013-02-03 03:04 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe 2013-02-03 03:05 - 2013-02-03 03:04 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll 2013-01-31 08:39 - 2013-01-31 08:39 - 00001875 ____A C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2013-01-30 14:42 - 2013-01-30 14:42 - 00000840 ____A C:\Users\urflamingo\Desktop\CdCoverCreator.lnk 2013-01-30 14:42 - 2013-01-30 14:42 - 00000000 ____D C:\Program Files\CdCoverCreator 2013-01-30 14:41 - 2013-01-30 14:41 - 02831657 ____A C:\Users\urflamingo\Downloads\CdCoverCreator-Setup-2.5.3 (1).exe 2013-01-30 14:40 - 2013-01-30 14:41 - 02831657 ____A C:\Users\urflamingo\Downloads\CdCoverCreator-Setup-2.5.3.exe 2013-01-30 14:39 - 2013-01-30 14:39 - 00970480 ____A C:\Users\urflamingo\Downloads\setup (3).exe 2013-01-30 14:23 - 2013-01-30 14:23 - 00581184 ____A (www.download-sponsor.de) C:\Users\urflamingo\Downloads\Nicht bestätigt 154015.crdownload 2013-01-30 14:18 - 2013-01-30 14:18 - 00000756 ____A C:\Users\urflamingo\Desktop\MiPony.lnk 2013-01-30 14:18 - 2013-01-30 14:18 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\DSite 2013-01-30 14:17 - 2013-01-30 14:17 - 00663824 ____A C:\Users\urflamingo\Downloads\DownloadAcceleratorSetup.exe 2013-01-30 14:14 - 2013-01-30 14:14 - 00284064 ____A C:\Users\urflamingo\Downloads\zipper_V.6827832c.exe 2013-01-30 14:14 - 2013-01-30 14:14 - 00284064 ____A C:\Users\urflamingo\Downloads\zipper_V.6827832c (1).exe 2013-01-30 07:25 - 2013-01-30 07:25 - 00000000 ____D C:\Users\urflamingo\Corel 2013-01-30 07:19 - 2013-01-30 07:19 - 00000040 ___AH C:\Windows\System32\ivireg.ivr 2013-01-30 07:18 - 2013-01-30 07:18 - 00001734 ____A C:\Users\Public\Desktop\Corel WinDVD Pro 11.lnk 2013-01-30 07:18 - 2010-11-16 07:24 - 00013880 ____A (InterVideo) C:\Windows\System32\Drivers\regi.sys 2013-01-30 07:04 - 2013-01-30 07:06 - 123908088 ____A (Acresso Software Inc.) C:\Users\urflamingo\Downloads\WinDVD11_Pro_TBYB.exe 2013-01-28 10:05 - 2013-01-28 10:05 - 00000000 ____D C:\Users\urflamingo\Documents\Nero 2013-01-28 10:04 - 2013-01-30 10:29 - 00031576 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys 2013-01-28 10:01 - 2013-01-28 10:01 - 00000000 ____D C:\Program Files\Common Files\Nero 2013-01-28 10:00 - 2013-01-28 10:03 - 00000000 ____D C:\Users\All Users\Nero 2013-01-28 09:57 - 2013-01-28 10:03 - 00000000 ____D C:\Program Files\Nero 2013-01-28 04:29 - 2013-01-28 04:29 - 00803471 ____A C:\Users\urflamingo\Downloads\label.psd 2013-01-25 10:30 - 2013-01-25 10:32 - 00000000 ____D C:\Users\urflamingo\Downloads\WP Plugins Chrisler Azon 2013-01-25 04:52 - 2013-01-25 04:52 - 08507373 ____A C:\Users\urflamingo\Downloads\pitch_me_your_idea_2003_2493.zip 2013-01-22 12:21 - 2013-01-22 12:21 - 00000000 ____D C:\Users\urflamingo\Documents\Recordpad 2013-01-19 10:19 - 2013-01-19 10:22 - 90257957 ____A C:\Users\urflamingo\Downloads\LeadGenTsunami.mp4 2013-01-19 08:41 - 2013-01-19 08:41 - 03041739 ____A C:\Users\urflamingo\Downloads\quiz2.zip 2013-01-19 08:40 - 2013-02-05 09:31 - 00000000 ____D C:\Users\urflamingo\Downloads\JVZoo 2013-01-18 16:30 - 2013-01-18 16:30 - 01864128 ____A ( ) C:\Users\urflamingo\Downloads\MiracleSqueezePageBuilder.exe 2013-01-18 16:30 - 2013-01-18 16:30 - 00001799 ____A C:\Users\Public\Desktop\Miracle Squeeze Page Builder .lnk 2013-01-18 16:30 - 2013-01-18 16:30 - 00000000 ____D C:\Program Files\Miracle Squeeze Page Builder 2013-01-18 16:23 - 2013-01-18 16:23 - 00000841 ____A C:\Users\urflamingo\Desktop\PinDetective v1.2.lnk 2013-01-18 16:23 - 2013-01-18 16:23 - 00000000 ____D C:\Program Files\PinDetective 2013-01-18 16:22 - 2013-01-18 16:22 - 00422659 ____A ( ) C:\Users\urflamingo\Downloads\PinDetective-Setupv1-2(1).exe 2013-01-18 16:21 - 2013-01-18 16:21 - 00422659 ____A ( ) C:\Users\urflamingo\Downloads\PinDetective-Setupv1-2.exe 2013-01-18 16:13 - 2013-01-18 16:13 - 00001069 ____A C:\Users\urflamingo\Desktop\PinAutomation - Affiliate Robot v1.2.lnk 2013-01-18 16:13 - 2013-01-18 16:13 - 00000000 ____D C:\Program Files\PinAutomation - Affiliate Robot 2013-01-18 16:12 - 2013-01-18 16:12 - 00398725 ____A ( ) C:\Users\urflamingo\Downloads\AffiliateRobot-Setup.exe 2013-01-18 07:28 - 2013-01-18 07:28 - 00000000 ____D C:\Users\Public\Documents\MAGIX_Video_deluxe_15_Plus 2013-01-18 05:56 - 2013-01-18 05:56 - 00000970 ____A C:\Users\urflamingo\Desktop\AVS Video ReMaker.lnk 2013-01-18 05:21 - 2013-01-18 05:22 - 00004555 ____A C:\Windows\System32\jupdate-1.7.0_11-b21.log 2013-01-17 16:40 - 2013-01-17 16:40 - 00000000 ____D C:\Program Files\Citrix 2013-01-17 09:36 - 2013-01-17 09:36 - 00029053 ____A C:\Users\urflamingo\Documents\Versuch1.ffd 2013-01-17 07:33 - 2013-01-17 07:34 - 00000046 ____A C:\Windows\Speed.INI 2013-01-17 07:33 - 2013-01-17 07:34 - 00000000 ____D C:\Users\urflamingo\Documents\MAGIX Speed 2013-01-17 06:50 - 2013-01-17 06:50 - 00000024 ____A C:\Windows\System32\DKRNL.JAX 2013-01-17 06:50 - 2013-01-17 06:50 - 00000000 ____D C:\Users\urflamingo\Documents\Corel MotionStudio 3D 2013-01-14 14:21 - 2013-01-14 14:37 - 00024576 ____A C:\Users\urflamingo\Documents\verguetungssysteme.dsam 2013-01-14 14:13 - 2013-01-14 14:13 - 03818253 ____A C:\Users\urflamingo\Downloads\MarketSamurai.0.92.42 (1).air 2013-01-14 07:25 - 2013-01-14 09:24 - 00005132 ____A C:\Users\urflamingo\Downloads\sitescripts.php 2013-01-13 15:34 - 2013-01-13 15:34 - 00002269 ____R C:\Windows\E-MailVerifier_Uninstall.in 2013-01-13 15:34 - 2013-01-13 15:34 - 00000715 ____A C:\Users\urflamingo\Desktop\E-MailVerifier.lnk 2013-01-13 15:34 - 2013-01-13 15:34 - 00000000 ____D C:\Program Files\E-MailVerifier 2013-01-13 15:34 - 2010-02-02 03:30 - 00331136 ____A (Mirko Böer) C:\Windows\EMVUn.EXE 2013-01-13 15:33 - 2013-01-13 15:33 - 00003306 ____R C:\Windows\SuperMailer_Uninstall.in 2013-01-13 15:33 - 2013-01-13 15:33 - 00000695 ____A C:\Users\urflamingo\Desktop\SuperMailer.lnk 2013-01-13 15:33 - 2013-01-13 15:33 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\SuperMailer 2013-01-13 15:33 - 2013-01-13 15:33 - 00000000 ____D C:\Program Files\SuperMailer 2013-01-13 15:33 - 2010-03-17 01:45 - 00331136 ____A (Mirko Böer) C:\Windows\SMUn.EXE 2013-01-13 09:05 - 2013-01-13 09:05 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\MarketSamurai.6E37012E1CBD7F47B14488FCC715944F3EBDCEDC.1 2013-01-13 09:04 - 2013-01-13 09:04 - 00000776 ____A C:\Users\Public\Desktop\Market Samurai.lnk 2013-01-13 09:03 - 2013-01-13 09:03 - 00000000 ____D C:\Program Files\Market Samurai 2013-01-13 08:59 - 2013-01-13 08:59 - 03818253 ____A C:\Users\urflamingo\Downloads\MarketSamurai.0.92.42.air 2013-01-11 05:39 - 2013-01-11 05:40 - 01054871 ____A C:\Users\urflamingo\Downloads\MLMpro_D.zip ==================== One Month Modified Files and Folders ======== 2013-02-10 05:49 - 2008-01-20 18:47 - 20971970 ____A C:\Windows\PFRO.log 2013-02-10 05:43 - 2006-11-02 04:47 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-02-10 05:43 - 2006-11-02 04:47 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-02-10 05:42 - 2009-08-13 01:31 - 00143914 ____A C:\Users\All Users\nvModes.001 2013-02-10 05:42 - 2008-07-29 18:13 - 00000147 ____A C:\Windows\System32\agent.log 2013-02-10 05:42 - 2006-11-02 05:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-02-10 04:43 - 2013-02-10 04:43 - 00002034 ____A C:\Users\urflamingo\Documents\ACDaemon.txt 2013-02-10 04:25 - 2012-05-29 07:33 - 00001699 ____A C:\Users\Public\Desktop\McAfee Total Protection.lnk 2013-02-10 03:08 - 2008-09-08 18:07 - 00000000 ____A C:\Windows\System32\LogConfigTemp.xml 2013-02-09 13:18 - 2010-06-27 10:33 - 00008268 ____A C:\Users\urflamingo\AppData\Local\d3d9caps.dat 2013-02-09 12:49 - 2012-01-19 08:46 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\PDF Software 2013-02-09 11:33 - 2013-02-09 11:33 - 00000000 ___DC C:\FRST 2013-02-09 11:19 - 2009-11-15 12:28 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-02-09 09:57 - 2013-02-09 09:57 - 00042254 ____A C:\Users\urflamingo\Downloads\Aktivierungshinweise_Gold_Mitgliedschaft.zip 2013-02-09 07:43 - 2013-02-09 07:43 - 00000000 ___DC C:\_OTL 2013-02-09 07:33 - 2013-02-07 05:56 - 00157902 ____A C:\Users\urflamingo\Downloads\OTL.Txt 2013-02-09 04:17 - 2012-12-26 11:39 - 00000338 ____A C:\Windows\Tasks\DriverScanner.job 2013-02-09 04:17 - 2009-11-15 12:28 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-02-09 03:43 - 2008-10-04 13:22 - 00075264 ____A C:\Users\urflamingo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-02-09 03:32 - 2013-02-09 03:32 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\urflamingo\Downloads\tdsskiller (1).exe 2013-02-09 03:31 - 2013-02-09 03:31 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\urflamingo\Downloads\tdsskiller.exe 2013-02-09 03:27 - 2013-02-09 03:26 - 04732416 ____A (AVAST Software) C:\Users\urflamingo\Downloads\aswMBR.exe 2013-02-08 12:14 - 2010-02-21 19:07 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\FileZilla 2013-02-08 11:34 - 2013-02-08 11:34 - 00000000 ____D C:\Users\urflamingo\Downloads\covertplayer_pro 2013-02-08 05:40 - 2013-02-08 05:40 - 00026095 ___AC C:\ComboFix.txt 2013-02-08 05:40 - 2013-02-08 04:43 - 00000000 ___DC C:\Qoobox 2013-02-08 05:40 - 2006-11-02 03:18 - 00000000 ___RD C:\users\Public 2013-02-08 05:38 - 2013-02-08 04:42 - 00000000 ____D C:\Windows\erdnt 2013-02-08 05:32 - 2006-11-02 02:23 - 00000215 ___AC C:\Windows\system.ini 2013-02-08 05:21 - 2008-10-04 06:09 - 00000000 ____D C:\users\urflamingo 2013-02-08 04:41 - 2013-02-08 04:41 - 05030592 ___RA (Swearware) C:\Users\urflamingo\Downloads\ComboFix.exe 2013-02-07 15:02 - 2013-02-07 15:02 - 00001199 ___AC C:\AdwCleaner[R1].txt 2013-02-07 14:43 - 2012-07-31 04:10 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-02-07 14:10 - 2013-02-07 14:10 - 00582209 ____A C:\Users\urflamingo\Downloads\adwcleaner.exe 2013-02-07 14:07 - 2013-02-07 14:07 - 28181408 ____A (TuneUp Software) C:\Users\urflamingo\Downloads\TuneUpUtilities2013_de-DE(1).exe 2013-02-07 14:06 - 2013-02-07 14:06 - 28181408 ____A (TuneUp Software) C:\Users\urflamingo\Downloads\TuneUpUtilities2013_de-DE.exe 2013-02-07 14:06 - 2013-02-07 14:06 - 00000000 __SHD C:\Users\All Users\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} 2013-02-07 13:54 - 2013-02-07 13:54 - 00060754 ____A C:\Users\urflamingo\Desktop\JRT.txt 2013-02-07 13:50 - 2013-02-07 13:50 - 00000000 ____D C:\Windows\ERUNT 2013-02-07 13:48 - 2013-02-07 13:48 - 00000000 ___DC C:\JRT 2013-02-07 13:47 - 2013-02-07 13:47 - 00547275 ____A (Oleg N. Scherbakov) C:\Users\urflamingo\Downloads\Nicht bestätigt 518278.crdownload 2013-02-07 13:47 - 2013-02-07 13:46 - 00547275 ____A (Oleg N. Scherbakov) C:\Users\urflamingo\Downloads\JRT.exe 2013-02-07 12:25 - 2006-11-02 04:47 - 00634760 ____A C:\Windows\System32\FNTCACHE.DAT 2013-02-07 12:05 - 2013-02-07 12:05 - 00080828 ____A C:\Users\urflamingo\Downloads\OTLTeil1 (1).txt 2013-02-07 12:04 - 2013-02-07 12:04 - 00080828 ____A C:\Users\urflamingo\Downloads\OTLTeil1.txt 2013-02-07 05:57 - 2013-02-07 05:57 - 00097512 ____A C:\Users\urflamingo\Downloads\Extras.Txt 2013-02-07 05:40 - 2013-02-07 05:40 - 00365568 ____A C:\Users\urflamingo\Downloads\gmer_2.0.18454.exe 2013-02-07 05:19 - 2013-02-07 05:19 - 00602112 ____A (OldTimer Tools) C:\Users\urflamingo\Downloads\OTL.exe 2013-02-07 05:15 - 2013-02-07 05:14 - 00000482 ____A C:\Users\urflamingo\Downloads\defogger_disable.log 2013-02-07 05:14 - 2013-02-07 05:14 - 00000000 ____A C:\Users\urflamingo\defogger_reenable 2013-02-07 05:13 - 2013-02-07 05:12 - 00050477 ____A C:\Users\urflamingo\Downloads\Defogger.exe 2013-02-06 16:17 - 2008-09-08 17:52 - 01770546 ____A C:\Windows\WindowsUpdate.log 2013-02-06 16:17 - 2006-11-02 05:01 - 00032510 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2013-02-06 15:22 - 2013-02-06 15:22 - 00000870 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-02-06 15:22 - 2013-02-06 12:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-02-06 15:11 - 2012-12-13 12:32 - 00262144 ____A C:\Windows\System32\config\ELAM 2013-02-06 15:08 - 2012-12-12 03:50 - 00000000 ___RD C:\Users\urflamingo\Dropbox 2013-02-06 15:08 - 2012-12-12 03:45 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Dropbox 2013-02-06 14:37 - 2008-01-20 23:16 - 01673560 ____A C:\Windows\System32\PerfStringBackup.INI 2013-02-06 12:56 - 2013-02-06 12:56 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Malwarebytes 2013-02-06 12:56 - 2013-02-06 12:56 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-02-06 12:54 - 2013-02-06 12:54 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\urflamingo\Downloads\mbam-setup-1.70.0.1100.exe 2013-02-06 12:49 - 2012-05-02 07:13 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-02-06 10:19 - 2010-11-14 14:58 - 33997193 ____A C:\Users\urflamingo\Downloads\otopaket.zip 2013-02-06 09:54 - 2013-02-06 09:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-02-06 09:00 - 2010-10-23 05:56 - 00000304 ____A C:\Windows\Tasks\next.job 2013-02-06 09:00 - 2009-08-03 00:23 - 00000452 ____A C:\Windows\Tasks\ParetoLogic Registration.job 2013-02-05 11:06 - 2012-12-13 14:21 - 00000000 ____D C:\Users\urflamingo\AppData\Local\CrashDumps 2013-02-05 09:31 - 2013-02-05 09:31 - 00351281 ____A C:\Users\urflamingo\Downloads\covertplayer_pro.zip 2013-02-05 09:31 - 2013-01-19 08:40 - 00000000 ____D C:\Users\urflamingo\Downloads\JVZoo 2013-02-05 09:11 - 2013-02-05 09:10 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\vlc 2013-02-05 09:09 - 2013-02-05 09:09 - 00000823 ____A C:\Users\Public\Desktop\VLC media player.lnk 2013-02-05 09:08 - 2013-02-05 09:08 - 00000000 ____D C:\Program Files\VideoLAN 2013-02-05 09:07 - 2013-02-05 09:07 - 22916830 ____A C:\Users\urflamingo\Downloads\vlc-2.0.5-win32.exe 2013-02-04 14:03 - 2012-01-19 09:06 - 00000000 ____D C:\Users\urflamingo\Documents\PDF Suite 2012 Files 2013-02-04 12:14 - 2010-11-30 08:57 - 00000000 ____D C:\Program Files\Common Files\ArcSoft 2013-02-04 12:14 - 2008-07-29 17:22 - 00000000 ___HD C:\Program Files\InstallShield Installation Information 2013-02-03 03:04 - 2013-02-03 03:05 - 00262560 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe 2013-02-03 03:04 - 2013-02-03 03:05 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe 2013-02-03 03:04 - 2013-02-03 03:05 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe 2013-02-03 03:04 - 2013-02-03 03:05 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll 2013-02-03 03:04 - 2012-11-06 07:51 - 00861088 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll 2013-02-03 03:04 - 2011-07-11 02:52 - 00782240 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll 2013-02-03 02:56 - 2012-12-12 03:50 - 00000938 ____A C:\Users\urflamingo\Desktop\Dropbox.lnk 2013-02-03 02:55 - 2010-03-01 11:26 - 00047104 ____A C:\Users\urflamingo\AppData\Local\WebpageIcons.db 2013-01-31 08:39 - 2013-01-31 08:39 - 00001875 ____A C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2013-01-31 08:39 - 2012-11-09 07:18 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-01-30 15:37 - 2010-02-09 12:58 - 00004096 ____A C:\Users\Public\Documents\00000ED4.LCS 2013-01-30 14:42 - 2013-01-30 14:42 - 00000840 ____A C:\Users\urflamingo\Desktop\CdCoverCreator.lnk 2013-01-30 14:42 - 2013-01-30 14:42 - 00000000 ____D C:\Program Files\CdCoverCreator 2013-01-30 14:41 - 2013-01-30 14:41 - 02831657 ____A C:\Users\urflamingo\Downloads\CdCoverCreator-Setup-2.5.3 (1).exe 2013-01-30 14:41 - 2013-01-30 14:40 - 02831657 ____A C:\Users\urflamingo\Downloads\CdCoverCreator-Setup-2.5.3.exe 2013-01-30 14:39 - 2013-01-30 14:39 - 00970480 ____A C:\Users\urflamingo\Downloads\setup (3).exe 2013-01-30 14:23 - 2013-01-30 14:23 - 00581184 ____A (www.download-sponsor.de) C:\Users\urflamingo\Downloads\Nicht bestätigt 154015.crdownload 2013-01-30 14:18 - 2013-01-30 14:18 - 00000756 ____A C:\Users\urflamingo\Desktop\MiPony.lnk 2013-01-30 14:18 - 2013-01-30 14:18 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\DSite 2013-01-30 14:17 - 2013-01-30 14:17 - 00663824 ____A C:\Users\urflamingo\Downloads\DownloadAcceleratorSetup.exe 2013-01-30 14:14 - 2013-01-30 14:14 - 00284064 ____A C:\Users\urflamingo\Downloads\zipper_V.6827832c.exe 2013-01-30 14:14 - 2013-01-30 14:14 - 00284064 ____A C:\Users\urflamingo\Downloads\zipper_V.6827832c (1).exe 2013-01-30 10:29 - 2013-01-28 10:04 - 00031576 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys 2013-01-30 07:46 - 2012-01-02 14:38 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Corel 2013-01-30 07:25 - 2013-01-30 07:25 - 00000000 ____D C:\Users\urflamingo\Corel 2013-01-30 07:20 - 2012-12-12 12:09 - 00000000 ____D C:\Users\All Users\Corel 2013-01-30 07:19 - 2013-01-30 07:19 - 00000040 ___AH C:\Windows\System32\ivireg.ivr 2013-01-30 07:18 - 2013-01-30 07:18 - 00001734 ____A C:\Users\Public\Desktop\Corel WinDVD Pro 11.lnk 2013-01-30 07:17 - 2012-12-12 12:00 - 00000000 ____D C:\Program Files\Corel 2013-01-30 07:06 - 2013-01-30 07:04 - 123908088 ____A (Acresso Software Inc.) C:\Users\urflamingo\Downloads\WinDVD11_Pro_TBYB.exe 2013-01-30 03:38 - 2009-08-03 00:23 - 00000426 ____A C:\Windows\Tasks\ParetoLogic Update Version2.job 2013-01-28 10:05 - 2013-01-28 10:05 - 00000000 ____D C:\Users\urflamingo\Documents\Nero 2013-01-28 10:03 - 2013-01-28 10:00 - 00000000 ____D C:\Users\All Users\Nero 2013-01-28 10:03 - 2013-01-28 09:57 - 00000000 ____D C:\Program Files\Nero 2013-01-28 10:01 - 2013-01-28 10:01 - 00000000 ____D C:\Program Files\Common Files\Nero 2013-01-28 07:31 - 2012-02-16 08:39 - 00000000 ____D C:\Users\urflamingo\Documents\MAGIX 2013-01-28 04:29 - 2013-01-28 04:29 - 00803471 ____A C:\Users\urflamingo\Downloads\label.psd 2013-01-25 10:32 - 2013-01-25 10:30 - 00000000 ____D C:\Users\urflamingo\Downloads\WP Plugins Chrisler Azon 2013-01-25 04:52 - 2013-01-25 04:52 - 08507373 ____A C:\Users\urflamingo\Downloads\pitch_me_your_idea_2003_2493.zip 2013-01-22 14:10 - 2010-11-28 07:00 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Audacity 2013-01-22 12:21 - 2013-01-22 12:21 - 00000000 ____D C:\Users\urflamingo\Documents\Recordpad 2013-01-20 06:41 - 2012-12-12 12:22 - 00000000 ____D C:\Users\All Users\SmartSound Software Inc 2013-01-19 10:22 - 2013-01-19 10:19 - 90257957 ____A C:\Users\urflamingo\Downloads\LeadGenTsunami.mp4 2013-01-19 08:41 - 2013-01-19 08:41 - 03041739 ____A C:\Users\urflamingo\Downloads\quiz2.zip 2013-01-18 16:42 - 2010-05-31 08:08 - 00000206 ____A C:\Windows\EurekaLog.ini 2013-01-18 16:30 - 2013-01-18 16:30 - 01864128 ____A ( ) C:\Users\urflamingo\Downloads\MiracleSqueezePageBuilder.exe 2013-01-18 16:30 - 2013-01-18 16:30 - 00001799 ____A C:\Users\Public\Desktop\Miracle Squeeze Page Builder .lnk 2013-01-18 16:30 - 2013-01-18 16:30 - 00000000 ____D C:\Program Files\Miracle Squeeze Page Builder 2013-01-18 16:23 - 2013-01-18 16:23 - 00000841 ____A C:\Users\urflamingo\Desktop\PinDetective v1.2.lnk 2013-01-18 16:23 - 2013-01-18 16:23 - 00000000 ____D C:\Program Files\PinDetective 2013-01-18 16:22 - 2013-01-18 16:22 - 00422659 ____A ( ) C:\Users\urflamingo\Downloads\PinDetective-Setupv1-2(1).exe 2013-01-18 16:21 - 2013-01-18 16:21 - 00422659 ____A ( ) C:\Users\urflamingo\Downloads\PinDetective-Setupv1-2.exe 2013-01-18 16:13 - 2013-01-18 16:13 - 00001069 ____A C:\Users\urflamingo\Desktop\PinAutomation - Affiliate Robot v1.2.lnk 2013-01-18 16:13 - 2013-01-18 16:13 - 00000000 ____D C:\Program Files\PinAutomation - Affiliate Robot 2013-01-18 16:12 - 2013-01-18 16:12 - 00398725 ____A ( ) C:\Users\urflamingo\Downloads\AffiliateRobot-Setup.exe 2013-01-18 13:51 - 2009-08-06 12:00 - 00000000 ____D C:\Users\urflamingo\Documents\Camtasia Studio 2013-01-18 07:28 - 2013-01-18 07:28 - 00000000 ____D C:\Users\Public\Documents\MAGIX_Video_deluxe_15_Plus 2013-01-18 05:58 - 2008-10-19 11:55 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\AVS4YOU 2013-01-18 05:57 - 2008-10-19 11:51 - 00000000 ____D C:\Program Files\AVS4YOU 2013-01-18 05:56 - 2013-01-18 05:56 - 00000970 ____A C:\Users\urflamingo\Desktop\AVS Video ReMaker.lnk 2013-01-18 05:22 - 2013-01-18 05:21 - 00004555 ____A C:\Windows\System32\jupdate-1.7.0_11-b21.log 2013-01-18 05:22 - 2009-08-01 10:08 - 00000000 ____D C:\Program Files\Java 2013-01-17 16:40 - 2013-01-17 16:40 - 00000000 ____D C:\Program Files\Citrix 2013-01-17 09:36 - 2013-01-17 09:36 - 00029053 ____A C:\Users\urflamingo\Documents\Versuch1.ffd 2013-01-17 07:34 - 2013-01-17 07:33 - 00000046 ____A C:\Windows\Speed.INI 2013-01-17 07:34 - 2013-01-17 07:33 - 00000000 ____D C:\Users\urflamingo\Documents\MAGIX Speed 2013-01-17 06:50 - 2013-01-17 06:50 - 00000024 ____A C:\Windows\System32\DKRNL.JAX 2013-01-17 06:50 - 2013-01-17 06:50 - 00000000 ____D C:\Users\urflamingo\Documents\Corel MotionStudio 3D 2013-01-17 06:49 - 2012-12-12 14:03 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\Ulead Systems 2013-01-15 10:54 - 2012-03-19 03:57 - 00000000 ____D C:\Program Files\McAfee 2013-01-14 14:37 - 2013-01-14 14:21 - 00024576 ____A C:\Users\urflamingo\Documents\verguetungssysteme.dsam 2013-01-14 14:23 - 2010-05-05 08:28 - 00322760 ___AH C:\Windows\System32\mlfcache.dat 2013-01-14 14:13 - 2013-01-14 14:13 - 03818253 ____A C:\Users\urflamingo\Downloads\MarketSamurai.0.92.42 (1).air 2013-01-14 09:24 - 2013-01-14 07:25 - 00005132 ____A C:\Users\urflamingo\Downloads\sitescripts.php 2013-01-14 04:43 - 2009-08-12 23:14 - 00143914 ____A C:\Users\All Users\nvModes.dat 2013-01-13 15:34 - 2013-01-13 15:34 - 00002269 ____R C:\Windows\E-MailVerifier_Uninstall.in 2013-01-13 15:34 - 2013-01-13 15:34 - 00000715 ____A C:\Users\urflamingo\Desktop\E-MailVerifier.lnk 2013-01-13 15:34 - 2013-01-13 15:34 - 00000000 ____D C:\Program Files\E-MailVerifier 2013-01-13 15:33 - 2013-01-13 15:33 - 00003306 ____R C:\Windows\SuperMailer_Uninstall.in 2013-01-13 15:33 - 2013-01-13 15:33 - 00000695 ____A C:\Users\urflamingo\Desktop\SuperMailer.lnk 2013-01-13 15:33 - 2013-01-13 15:33 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\SuperMailer 2013-01-13 15:33 - 2013-01-13 15:33 - 00000000 ____D C:\Program Files\SuperMailer 2013-01-13 09:05 - 2013-01-13 09:05 - 00000000 ____D C:\Users\urflamingo\AppData\Roaming\MarketSamurai.6E37012E1CBD7F47B14488FCC715944F3EBDCEDC.1 2013-01-13 09:04 - 2013-01-13 09:04 - 00000776 ____A C:\Users\Public\Desktop\Market Samurai.lnk 2013-01-13 09:03 - 2013-01-13 09:03 - 00000000 ____D C:\Program Files\Market Samurai 2013-01-13 08:59 - 2013-01-13 08:59 - 03818253 ____A C:\Users\urflamingo\Downloads\MarketSamurai.0.92.42.air 2013-01-11 07:37 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-01-11 05:40 - 2013-01-11 05:39 - 01054871 ____A C:\Users\urflamingo\Downloads\MLMpro_D.zip ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2012-12-12 03:25] - [2012-08-21 03:47] - 0224640 ____A (Microsoft Corporation) 786DB5771F05EF300390399F626BF30A testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION! ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-02-03 03:02:33 Restore point made on: 2013-02-04 12:14:10 ==================== Memory info =========================== Percentage of memory in use: 9% Total physical RAM: 4090.07 MB Available physical RAM: 3721.94 MB Total Pagefile: 3955.55 MB Available Pagefile: 3808.5 MB Total Virtual: 2047.88 MB Available Virtual: 1982.33 MB ==================== Partitions ============================= 1 Drive c: (ACER) (Fixed) (Total:144.04 GB) (Free:35.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)] 2 Drive d: (DATA) (Fixed) (Total:178.85 GB) (Free:105.44 GB) NTFS 3 Drive e: (DATA) (Fixed) (Total:59.58 GB) (Free:59.49 GB) NTFS 4 Drive f: () (Removable) (Total:3.69 GB) (Free:3.23 GB) FAT32 5 Drive g: () (Removable) (Total:3.84 GB) (Free:1.67 GB) FAT32 6 Drive h: (DATA) (Fixed) (Total:140.5 GB) (Free:86.21 GB) NTFS 7 Drive i: (DATA) (Fixed) (Total:59.65 GB) (Free:55.37 GB) NTFS 9 Drive x: (PQSERVICE) (Fixed) (Total:10 GB) (Free:0.69 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ---------- ------- ------- --- --- Disk 0 Online 298 GB 0 B Disk 1 Online 298 GB 1563 KB Disk 2 Online 3782 MB 0 B Disk 3 Online 3935 MB 0 B Partitions of Disk 0: =============== ACTIVE - Mark the selected basic partition as active. ADD - Add a mirror to a simple volume. ASSIGN - Assign a drive letter or mount point to the selected volume. ATTRIBUTES - Manipulate volume attributes. AUTOMOUNT - Enable and disable automatic mounting of basic volumes. BREAK - Break a mirror set. CLEAN - Clear the configuration information, or all information, off the disk. CONVERT - Convert between different disk formats. CREATE - Create a volume or partition. DELETE - Delete an object. DETAIL - Provide details about an object. EXIT - Exit DiskPart. EXTEND - Extend a volume. FILESYSTEMS - Display current and supported file systems on the volume. FORMAT - Format the volume or partition. GPT - Assign attributes to the selected GPT partition. HELP - Display a list of commands. IMPORT - Import a disk group. INACTIVE - Mark the selected basic partition as inactive. LIST - Display a list of objects. ONLINE - Online a disk that is currently marked as offline. REM - Does nothing. This is used to comment scripts. REMOVE - Remove a drive letter or mount point assignment. REPAIR - Repair a RAID-5 volume with a failed member. RESCAN - Rescan the computer looking for disks and volumes. RETAIN - Place a retained partition under a simple volume. SELECT - Shift the focus to an object. SETID - Change the partition type. SHRINK - Reduce the size of the selected volume. ========================================================= Partitions of Disk 1: =============== ACTIVE - Mark the selected basic partition as active. ADD - Add a mirror to a simple volume. ASSIGN - Assign a drive letter or mount point to the selected volume. ATTRIBUTES - Manipulate volume attributes. AUTOMOUNT - Enable and disable automatic mounting of basic volumes. BREAK - Break a mirror set. CLEAN - Clear the configuration information, or all information, off the disk. CONVERT - Convert between different disk formats. CREATE - Create a volume or partition. DELETE - Delete an object. DETAIL - Provide details about an object. EXIT - Exit DiskPart. EXTEND - Extend a volume. FILESYSTEMS - Display current and supported file systems on the volume. FORMAT - Format the volume or partition. GPT - Assign attributes to the selected GPT partition. HELP - Display a list of commands. IMPORT - Import a disk group. INACTIVE - Mark the selected basic partition as inactive. LIST - Display a list of objects. ONLINE - Online a disk that is currently marked as offline. REM - Does nothing. This is used to comment scripts. REMOVE - Remove a drive letter or mount point assignment. REPAIR - Repair a RAID-5 volume with a failed member. RESCAN - Rescan the computer looking for disks and volumes. RETAIN - Place a retained partition under a simple volume. SELECT - Shift the focus to an object. SETID - Change the partition type. SHRINK - Reduce the size of the selected volume. ========================================================= Partitions of Disk 2: =============== ACTIVE - Mark the selected basic partition as active. ADD - Add a mirror to a simple volume. ASSIGN - Assign a drive letter or mount point to the selected volume. ATTRIBUTES - Manipulate volume attributes. AUTOMOUNT - Enable and disable automatic mounting of basic volumes. BREAK - Break a mirror set. CLEAN - Clear the configuration information, or all information, off the disk. CONVERT - Convert between different disk formats. CREATE - Create a volume or partition. DELETE - Delete an object. DETAIL - Provide details about an object. EXIT - Exit DiskPart. EXTEND - Extend a volume. FILESYSTEMS - Display current and supported file systems on the volume. FORMAT - Format the volume or partition. GPT - Assign attributes to the selected GPT partition. HELP - Display a list of commands. IMPORT - Import a disk group. INACTIVE - Mark the selected basic partition as inactive. LIST - Display a list of objects. ONLINE - Online a disk that is currently marked as offline. REM - Does nothing. This is used to comment scripts. REMOVE - Remove a drive letter or mount point assignment. REPAIR - Repair a RAID-5 volume with a failed member. RESCAN - Rescan the computer looking for disks and volumes. RETAIN - Place a retained partition under a simple volume. SELECT - Shift the focus to an object. SETID - Change the partition type. SHRINK - Reduce the size of the selected volume. ========================================================= Partitions of Disk 3: =============== ACTIVE - Mark the selected basic partition as active. ADD - Add a mirror to a simple volume. ASSIGN - Assign a drive letter or mount point to the selected volume. ATTRIBUTES - Manipulate volume attributes. AUTOMOUNT - Enable and disable automatic mounting of basic volumes. BREAK - Break a mirror set. CLEAN - Clear the configuration information, or all information, off the disk. CONVERT - Convert between different disk formats. CREATE - Create a volume or partition. DELETE - Delete an object. DETAIL - Provide details about an object. EXIT - Exit DiskPart. EXTEND - Extend a volume. FILESYSTEMS - Display current and supported file systems on the volume. FORMAT - Format the volume or partition. GPT - Assign attributes to the selected GPT partition. HELP - Display a list of commands. IMPORT - Import a disk group. INACTIVE - Mark the selected basic partition as inactive. LIST - Display a list of objects. ONLINE - Online a disk that is currently marked as offline. REM - Does nothing. This is used to comment scripts. REMOVE - Remove a drive letter or mount point assignment. REPAIR - Repair a RAID-5 volume with a failed member. RESCAN - Rescan the computer looking for disks and volumes. RETAIN - Place a retained partition under a simple volume. SELECT - Shift the focus to an object. SETID - Change the partition type. SHRINK - Reduce the size of the selected volume. ========================================================= Last Boot: 2013-02-10 04:39 ==================== End Of Log ============================ Zu den Fragen: 1. Der Normalstart funktioniert noch immer nicht. Nach "Willkommensbildschirm" kommt nach 2-3 Minuten ein völlig blanker Bildschirm, der sich nicht mehr verändert (maximale Wartezeit waren hier 15 Min.). 2. Meldung: Deinstallationen sind im abgesicherten Modus nicht möglich. Gruß urflamingo Ergänzung zu Frage 1: Eben kam zum 1. Mal nach dem Willkommensbildschirm zwar immer noch ein (fast) leerer Bildschirm, aber es gab diesmal immerhin 2 Elemente: Der Schriftzug "Microsoft Corporation" war oben mittig zu sehen und die Maus war erstmalig aktiv. Das bringt mich auf diese Frage: Kann etwas mit dem Gerätemanager sein? Ergänzung zu Frage 2: Die exakte Meldung beim Deinstallationsversuch von Java 6.x lautete: "Auf den indows Installerdienst konnte nicht zugegriffen werden." Gruß urflamingo Vom Stichwort Gerätemanager ist es nicht weit bis zum Thema Gerätetreiber. Auf der Acer-Seite wird empfohlen, die Gerätetreiber von Zeit zu Zeit zu erneuern. Dazu wird DriverFinder empfohlen. Alternative könnte DriverBoost.com sein. Soll ich das machen? |
|
11.02.2013, 13:50
| #18 | |
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus,
__________________Zitat:
Aber zuvor bitte dieses Tool noch im Abgesicherten Modus mit Netzwerkunterstützung ausführen: Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Warte auf deine Rückmeldung. |
|
11.02.2013, 14:19
| #19 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, das Ergebnis des Scans: Scan finished: No Malware found! Aber hier noch der Logfile: Malwarebytes Anti-Rootkit BETA 1.01.0.1020 www.malwarebytes.org Database version: v2013.02.11.04 Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 urflamingo :: MM-PC [administrator] 11.02.2013 14:14:01 mbar-log-2013-02-11 (14-14-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 33217 Time elapsed: 11 minute(s), 23 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) |
|
11.02.2013, 20:43
| #20 |
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, viel fällt mir nicht mehr ein. Wir könnten noch einen sog. "sauberen Neustart" versuchen, bei dem alle nicht notwendigen Dienste deaktiviert werden. Folge dazu dieser Anleitung. War das hilfreich? |
|
11.02.2013, 21:41
| #21 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus Matthias, vielen herzlichen Dank für die engagierte und kompetente Unterstützung. Die Malware scheint ja endgültig besiegt. Nun muss ich das System wieder hinkriegen , wobei A) Daten und Programm-Invest zu retten und B) die Arbeitsfähigkeit wieder hergestellt werden muss. Dir in jedem Falle vielen, vielen Dank! Gruß urflamingo |
|
11.02.2013, 21:48
| #22 |
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, eine Neuinstallation geht immer, käme sowas theoretisch für dich in Frage? Sei so nett und führ mal bitte die folgenden beiden Schritte aus (im abgesicherten Modus mit Netzwerkunterstützung): Schritt 1 ESET Online Scanner
Schritt 2 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
12.02.2013, 02:41
| #23 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus Matthias, Du gibst wohl nie auf, was? Ich war gefühlte 120% davon überzeugt, dass das Thema Virus durch ist und dass nur noch Acer (Treiber) und Vista in Frage kämen. Und dann kam Dein Marathon-Scan: Nach 1,5 Std und 280.000 gescannten Dateien war das Ergebnis: Infizierte Dateien 0 Und plötzlich ging es los: 1, 3, 9, am Ende 21 infizierte Dateien mit dem Muster PHP/Kryptik.AB trojan Hut ab!!! Hier die Log: ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=f150dcbb18204b4e93968f0be69c50ce # engine=13127 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-02-12 01:06:11 # local_time=2013-02-12 02:06:11 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=5122 16777214 100 100 5197753 110466330 0 0 # compatibility_mode=5892 16776574 100 100 42809106 198163900 0 0 # scanned=451382 # found=21 # cleaned=0 # scan_time=11782 sh=9F5E01985E86C572C9E30B32EECF31CE9ED0D2B5 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\ansiy.zip" sh=F80C0D14F9790C90201BE3C9611335848B430B28 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\BlueLines.zip" sh=506E5D9AB956F588FA648AF67821B82A8C35DD2F ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\business-trend.zip" sh=0CFC2151C0124970CB28BAF7986A97B0D7EFF39E ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\easybuddy.zip" sh=02AD3C0C0B5F3AEFB726C68FB65061761C48E9D0 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\edujournal.zip" sh=AD4509655EE7200F82B88A0F5B9E2C371719914A ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\greentech.zip" sh=5761FE996AF3141DD1AEA9F4DD872A8D024790F3 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\medicine.zip" sh=4E5008B9B649DA2183E60B4B16C4EBA2F91F9C7F ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\Metropolis.zip" sh=44C1C9199C3024BCBD09191557B48610EFE6C08B ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\mimbo2.2.zip" sh=EE88EB8555A884CAC3EA69AABE52B95C172CC9AD ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\ocean-mist-1_2_german.zip" sh=74BAC71DF95DCADB10DE16480430F1A91D01F8A8 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\OneRoom.zip" sh=53401C06D1DA9CE63F7214B79E752129F84DD465 ft=0 fh=0000000000000000 vn="probably a variant of Win32/PSW.IM.LXQIJPO trojan" ac=I fn="C:\Users\urflamingo\Downloads\otopaket.zip" sh=6748BC7DA348F30737705D2E2CA2BED7BD7EF9FA ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\seashore.zip" sh=73DC6CD9AC742568EC733E38FCE20BC0E117587C ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\sleekyellow-10.zip" sh=C10D2CCB7C580B32075869FD5F3B58DA9DA00110 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\Stripey.zip" sh=F62382222E195A33AB8DB86A0ADA189A06F06FC4 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\StudioPress.zip" sh=251D020A02DFF4DA60ACCAD0193C073443425C5E ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\StudioPress_Green.zip" sh=99A1A9A743B9C3C67F412A6F868C0AC916BB621D ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\StudioPress_Orange.zip" sh=2268433A12B77B6D7F48263A207A67F798784C2F ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\triplex.zip" sh=22FEA32810C5B3FF230F71881E33368523EE93DE ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\voodoo-dolly.zip" sh=3893BE3897A46610905C0D4C072D275A00B9CD79 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="C:\Users\urflamingo\Downloads\xtremeblogg.zip" Und hier die zweite Log-Datei (Security-Check): Results of screen317's Security Check version 0.99.57 Windows Vista Service Pack 2 x86 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! McAfee Anti-Virus und Anti-Spyware WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.70.0.1100 Java(TM) 6 Update 31 Java 7 Update 13 Java version out of Date! Adobe Flash Player 11.5.502.146 Adobe Reader 10.1.5 Adobe Reader out of Date! Mozilla Firefox (18.0.2) Google Chrome 24.0.1312.56 Google Chrome 24.0.1312.57 ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` Gruß urflamingo |
|
12.02.2013, 10:28
| #24 | ||
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, Zitat:
 Ich weiß nicht, wo du diese infizierten .zip Dateien her hast, aber bitte mit OTL im abgesicherten Modus löschen. Anschließend laden wir noch den MBR bei VirusTotal hoch und wir starten HitmanPro. Schritt 1 Fixen mit OTL
Code:
ATTFilter :files
C:\Users\urflamingo\Downloads\ansiy.zip
C:\Users\urflamingo\Downloads\BlueLines.zip
C:\Users\urflamingo\Downloads\business-trend.zip
C:\Users\urflamingo\Downloads\easybuddy.zip
C:\Users\urflamingo\Downloads\edujournal.zip
C:\Users\urflamingo\Downloads\greentech.zip
C:\Users\urflamingo\Downloads\medicine.zip
C:\Users\urflamingo\Downloads\Metropolis.zip
C:\Users\urflamingo\Downloads\mimbo2.2.zip
C:\Users\urflamingo\Downloads\ocean-mist-1_2_german.zip
C:\Users\urflamingo\Downloads\OneRoom.zip
C:\Users\urflamingo\Downloads\otopaket.zip
C:\Users\urflamingo\Downloads\seashore.zip
C:\Users\urflamingo\Downloads\sleekyellow-10.zip
C:\Users\urflamingo\Downloads\Stripey.zip
C:\Users\urflamingo\Downloads\StudioPress.zip
C:\Users\urflamingo\Downloads\StudioPress_Green.zip
C:\Users\urflamingo\Downloads\StudioPress_Orange.zip
C:\Users\urflamingo\Downloads\triplex.zip
C:\Users\urflamingo\Downloads\voodoo-dolly.zip
C:\Users\urflamingo\Downloads\xtremeblogg.zip
:Commands
[emptytemp]
Schritt 2 Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
Zitat:
Warte bis unter Current status: Finished steht. Kopiere den Link aus deiner Adresszeile und poste ihn hier. Schritt 3 Downloade dir HitmanPro (32 Bit) auf deinen Desktop.
Bitte poste mit deiner nächsten Antwort
|
|
12.02.2013, 11:33
| #25 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus Matthias, diese Dateien habe ich überwiegend schon 2 bis 3 Jahre und es handelt sich im Wesentlichen um unverdächtige Wordpress-Themes. Kann es sein, dass die erst später - auf meinem Computer - "unterwandert" worden sind? Ich kann mir schlecht vorstellen, dass die - wenn sie wirklich schlecht sind - das schon von Anfang an gewesen sind. Konnte OTL nicht ausführen (öffnet sich nicht mehr!). Gruß urflamingo Und noch etwas: Unaufgefordert erhielt ich via Editor folgende Meldung (von Windows?): Files\Folders moved on Reboot... C:\Users\urflamingo\AppData\Roaming\mozilla\Firefox\Profiles\4zz1pslt.default\extensions\support@predictad.com folder moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... Überschrift: 02092013 - 164354 - Editor |
|
12.02.2013, 11:59
| #26 |
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, die Meldung von OTL mit dem Fenster ist nicht überraschend. Wenn du die Dateien kennst, dann belassen wir sie auf dem Rechner. Kannst du bitte noch Schritt 2 und 3 ausführen? Welche Meldung erhälst du, wenn du OTL starten möchtest? |
|
12.02.2013, 12:29
| #27 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension OTL hat nach Neustart geklappt. Hier die Log: All processes killed ========== FILES ========== C:\Users\urflamingo\Downloads\ansiy.zip moved successfully. C:\Users\urflamingo\Downloads\BlueLines.zip moved successfully. C:\Users\urflamingo\Downloads\business-trend.zip moved successfully. C:\Users\urflamingo\Downloads\easybuddy.zip moved successfully. C:\Users\urflamingo\Downloads\edujournal.zip moved successfully. C:\Users\urflamingo\Downloads\greentech.zip moved successfully. C:\Users\urflamingo\Downloads\medicine.zip moved successfully. C:\Users\urflamingo\Downloads\Metropolis.zip moved successfully. C:\Users\urflamingo\Downloads\mimbo2.2.zip moved successfully. C:\Users\urflamingo\Downloads\ocean-mist-1_2_german.zip moved successfully. C:\Users\urflamingo\Downloads\OneRoom.zip moved successfully. C:\Users\urflamingo\Downloads\otopaket.zip moved successfully. C:\Users\urflamingo\Downloads\seashore.zip moved successfully. C:\Users\urflamingo\Downloads\sleekyellow-10.zip moved successfully. C:\Users\urflamingo\Downloads\Stripey.zip moved successfully. C:\Users\urflamingo\Downloads\StudioPress.zip moved successfully. C:\Users\urflamingo\Downloads\StudioPress_Green.zip moved successfully. C:\Users\urflamingo\Downloads\StudioPress_Orange.zip moved successfully. C:\Users\urflamingo\Downloads\triplex.zip moved successfully. C:\Users\urflamingo\Downloads\voodoo-dolly.zip moved successfully. C:\Users\urflamingo\Downloads\xtremeblogg.zip moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: urflamingo ->Temp folder emptied: 51677 bytes ->Temporary Internet Files folder emptied: 228289351 bytes ->Java cache emptied: 6259875 bytes ->FireFox cache emptied: 73336287 bytes ->Google Chrome cache emptied: 44875733 bytes ->Flash cache emptied: 861 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 268914 bytes RecycleBin emptied: 49017049 bytes Total Files Cleaned = 383,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 02122013_114932 Jetzt sind die Dateien weg, aber das ist nicht tragisch. Die Themes gehörten nicht zu meinen Favoriten. Schritt 2 konnte ich nicht ausführen, weil die Datei D:\MBR.dat nicht gefunden wird. Sie wird im D-Verzeichnis nicht angezeigt und dort will VirusTotal sie abholen. Meldung "Datei wird nicht gefunden. Überprüfen Sie den Dateinamen. Ich mache jetzt Schritt 3, da ich annehme, dass er nicht von Schritt 2 abhängt. |
|
12.02.2013, 12:32
| #28 | ||
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, Zitat:
Zitat:
|
|
12.02.2013, 13:15
| #29 |
| | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Hallo und Servus hier nun die Log-datei von Hitman Code:
ATTFilter HitmanPro 3.7.2.188
www.hitmanpro.com
Computer name . . . . : MM-PC
Windows . . . . . . . : 6.0.2.6002.X86/2
Safe Mode Boot . . . : NETWORK
User name . . . . . . : MM-PC\urflamingo
UAC . . . . . . . . . : Disabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2013-02-12 12:52:47
Scan mode . . . . . . : Normal
Scan duration . . . . : 4m 15s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 1
Traces . . . . . . . : 27
Objects scanned . . . : 2.711.853
Files scanned . . . . : 60.571
Remnants scanned . . : 1.003.451 files / 1.647.831 keys
Malware _____________________________________________________________________
C:\Users\urflamingo\Downloads\MusicConverterSetup.exe -> Quarantined
Size . . . . . . . : 1.115.544 bytes
Age . . . . . . . : 63.9 days (2012-12-10 15:55:59)
Entropy . . . . . : 6.7
SHA-256 . . . . . : 9AE35851C8F62E0FCCFE5E2905BA5F2BB3C4B73EE38FAD83136DE43815B3B4BC
> G Data . . . . . . : Adware.Generic.358727 (Engine A)
Fuzzy . . . . . . : 106.0
Potential Unwanted Programs _________________________________________________
HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1\ (Babylon)
HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr\ (Babylon)
Cookies _____________________________________________________________________
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.12mnkys.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.ad-srv.net
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.adnet.de
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.movad.net
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:c1.atdmt.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:eas.apm.emediate.eu
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww251.smartadserver.com
C:\Users\urflamingo\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com
C:\Users\urflamingo\AppData\Roaming\Mozilla\Firefox\Profiles\4zz1pslt.default\cookies.sqlite:stats.paypal.com
Als ich das letzte Mal eine Paypal-Zahlung durchgeführt habe, erhielt ich ein wenig später eine EMail (angeblich von Paypal Hannover) mit Link auf eine angebliche Paypal-Webseite zur "Identitätsüberprüfung" und Aufforderung zum Log-In. Die Webseite zeigte das Original-Impressum von Paypal.com. Der Hover-Text verriet aber eine in Frankreich gehostete Berater-Webseite. Ich habe nichts eingegeben und die E-Mail gelöscht. Aber: könnte sich hier evtl. ein "Spion" verstecken, der meldet, wenn ich versuche, mich bei Paypal einzuloggen? Gruß urflamingo So, hier nun noch der Link zu AntiVirus, nachdem ich die Datei gefunden habe. Ich hatte sie inzwischen in einen Ordner verschoben. https://www.virustotal.com/file/47dc724cff8596a205037fb63834df302da85dc58c4396f9b82250150a4cf43d/analysis/1360671698/ |
|
12.02.2013, 14:11
| #30 | |
| /// TB-Ausbilder | Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension Servus, Zitat:
Ich möchte gerne, dass wir den MBR fixen, weil mir das Ergebnis auf VT nicht wirklich gefällt. Es schlägt zwar nur ein Scanner an, aber trotzdem kann es sein, dass der Master Boot Record infiziert ist. Sichere dazu alle privaten Daten, Fotos, Videos, Dokumente etc. auf einem externen Datenträger und führe anschließend den folgenden Schritt aus:
Starte deinen Rechner neu auf und führe einen neuen Suchlauf mit aswMBr durch und poste die Logdatei. |
|
| Themen zu Unerwünschte Werbe-Links zu de.clickcompare.info über Programm Giant Savings Extension |
| 32 bit, 7-zip, adware.funmoods, anti-malware, anwendungen, appdata, audacity, avg secure search, becker, bildschirm, bla, booten, computer, dateien, einloggen, entfernen, ergebnis, folge, gmer, google, infiziert, infiziert., install.exe, kunde, launch, log-datei, malwarebytes, maus, microsoft office 2003, mipony, nicht mehr, ordner, policyagent, problem, programm, recycle.bin, robot, scan, secure search, startbildschirm, trojaner-board, vista, visual studio, windows, windows vista, winload toolbar |
Textbox. 
Linear-Darstellung
