| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: www.searchnu.com/406 wird bei jedem neuen Tab geöffnetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.02.2013, 20:23
| #1 |
 |  www.searchnu.com/406 wird bei jedem neuen Tab geöffnet Hallo liebes Forum, seit dem Wochenende schlage ich mich mit dem Search rum und werde ihn nicht los. Alle neuen Tabs starten auf dieser Seite, egal welchen Browser ich verwende. Beim Mozilla habe ich bei den Suchmaschinen alle entfernt und der ICQ-Search taucht im Handumdrehen immer wieder auf. Ich vermute das hängt auch mit dem serchnu zusammen.  In einem anderen Thread habe ich von Malwarebytes Anti-Malware gelesen und diesen mal durchlaufen und die gefundene Malware entfernen lassen. Jetzt läuft das Programm immer mit und verhindert dass „schädlich“ Tabs geöffnet werden. Ein 2ter vollständiger Scan hat keine schädliche Software mehr gefunden. Da ich das Problem allein nicht unter Kontrolle bekomme wende ich mich an euch Experten hier im Forum. Gmer, OTL und Defogger.exe habe ich herunter geladen und nach Anleitung ausgeführt. Gmer: GMER 2.0.18454 - GMER - Rootkit Detector and Remover Rootkit scan 2013-02-12 17:51:41 Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM080HI rev.AB100-16 74,53GB Running: gmer_2.0.18454.exe; Driver: C:\Users\Alex\AppData\Local\Temp\kxldrpog.sys ---- System - GMER 2.0 ---- SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x8AC6BB60] SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x8AC6BE28] SSDT \SystemRoot\system32\drivers\TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwTerminateProcess [0x8ADB1DC0] SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x8AC6C124] ---- Kernel code sections - GMER 2.0 ---- .text ntoskrnl.exe!KeInsertQueue + 3F9 858AEA30 8 Bytes [60, BB, C6, 8A, 28, BE, C6, ...] .text ntoskrnl.exe!KeInsertQueue + 811 858AEE48 4 Bytes [C0, 1D, DB, 8A] .text ntoskrnl.exe!KeInsertQueue + 8D5 858AEF0C 4 Bytes [24, C1, C6, 8A] ? \ArcName\multi(0)disk(0)rdisk(0)partition(1)\Windows\system32\drivers\PctWfpFilter.sys Das System kann den angegebenen Pfad nicht finden. ! ---- User code sections - GMER 2.0 ---- .text C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe[2100] kernel32.dll!CreateThread + 1A 75DBCB28 4 Bytes CALL 00450055 C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe (PC Tools Security Component/PC Tools) .text C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe[2752] kernel32.dll!CreateThread + 1A 75DBCB28 4 Bytes CALL 004508F9 C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe (PC Tools Security Component/PC Tools) ---- Registry - GMER 2.0 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9}@gajkeijknegeeg 0x61 0x63 0x68 0x6E ... ---- EOF - GMER 2.0 ---- Defogger: defogger_disable by jpshortstuff (23.02.10.1) Log created at 21:15 on 11/02/2013 (Alex) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL OTL logfile created on: 11.02.2013 21:26:09 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,75 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 48,85% Memory free 3,73 Gb Paging File | 2,49 Gb Available in Paging File | 66,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 39,06 Gb Total Space | 5,13 Gb Free Space | 13,13% Space Free | Partition Type: NTFS Drive D: | 35,47 Gb Total Space | 15,39 Gb Free Space | 43,40% Space Free | Partition Type: NTFS Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe PRC - [2013.02.07 13:19:12 | 001,683,456 | ---- | M] (Bandoo Media Inc) -- C:\Programme\Search Results Toolbar\Datamngr\datamngrUI.exe PRC - [2013.02.06 19:25:19 | 000,213,384 | ---- | M] (Google Inc.) -- C:\Programme\Google\Update\1.3.21.135\GoogleCrashHandler.exe PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.11.01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsSvc.exe PRC - [2012.11.01 15:34:28 | 002,717,816 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsGui.exe PRC - [2012.10.31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\pctsAuxs.exe PRC - [2012.10.31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) -- C:\Programme\PC Tools\PC Tools Security\TFEngine\TFService.exe PRC - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe PRC - [2011.03.07 14:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\d2\VirtualCloneDrive\VCDDaemon.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe ========== Modules (No Company Name) ========== MOD - [2007.01.18 23:54:48 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll ========== Services (SafeList) ========== SRV - [2013.02.09 14:29:53 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.02.09 14:23:53 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.11.01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\pctsSvc.exe -- (sdCoreService) SRV - [2012.10.31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\pctsAuxs.exe -- (sdAuxService) SRV - [2012.10.31 09:19:48 | 000,072,824 | ---- | M] (PC Tools) [On_Demand | Running] -- C:\Program Files\PC Tools\PC Tools Security\TFEngine\TFService.exe -- (ThreatFire) SRV - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe -- (Browser Defender Update Service) SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) SRV - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.11.01 15:35:20 | 000,068,272 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplsm.sys -- (pctplsm) DRV - [2012.11.01 15:35:18 | 000,071,752 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg) DRV - [2012.11.01 15:35:14 | 000,202,280 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\PCTSD.sys -- (PCTSD) DRV - [2012.10.31 14:21:28 | 000,260,760 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi) DRV - [2012.10.31 09:19:50 | 000,577,176 | --S- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TfSysMon.sys -- (TFSysMon) DRV - [2012.10.31 09:19:48 | 000,055,008 | --S- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TfFsMon.sys -- (TfFsMon) DRV - [2012.10.31 09:19:48 | 000,036,456 | --S- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TfNetMon.sys -- (TfNetMon) DRV - [2012.10.23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PCTBD.sys -- (PCTBD) DRV - [2012.10.22 16:38:28 | 000,368,616 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PCTCore.sys -- (PCTCore) DRV - [2012.02.28 11:43:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\System32\drivers\pctEFA.sys -- (pctEFA) DRV - [2012.02.28 11:43:00 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pctDS.sys -- (pctDS) DRV - [2011.05.17 15:44:44 | 000,035,776 | ---- | M] (libusb-Win32) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0) DRV - [2009.12.17 15:02:20 | 001,203,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb) DRV - [2008.02.22 14:33:02 | 000,114,304 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm) DRV - [2008.02.22 14:33:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl) DRV - [2008.02.22 14:33:00 | 000,087,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) DRV - [2007.01.19 00:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.11.28 20:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.11.28 10:30:10 | 000,341,632 | ---- | M] (Liteon) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ltn_stk7700pc.sys -- (Ltn_stk7700pc) DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2005.12.07 10:45:00 | 000,031,232 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbdtv.sys -- (usbdtv) DRV - [2005.12.07 10:13:00 | 000,022,016 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dtvfw.sys -- (DTVFW) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! Deutschland IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo! Suche IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Yahoo! Suche IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=8300259353924636&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Yahoo! Suche IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{440CF5EA-8546-4F9F-AC64-64313173BB5A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=05DFAD36-9F5F-4168-AF00-71A255E82C0A&apn_sauid=32751371-0662-4686-BCC8-96017E7D7992 IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{67C121FA-F5C8-4CC4-AA38-87BD6FC467B9}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=8300259353924636&q={searchTerms} IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb138/?search={searchTerms}&loc=IB_DS&a=6R8uKLa6Qm&i=26 IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledAddons: %7B1FD91A9C-410C-4090-BBCC-55D3450EF433%7D:1.0 FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33 FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0035-ABCDEFFEDCBA%7D:6.0.35 FF - prefs.js..extensions.enabledAddons: %7B1FD91A9C-410C-4090-BBCC-55D3450EF433%7D:1.0 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {fd048119-78ee-487f-8fb1-1668d3a6859b}:2.6.1 FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.6 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.25 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.foxtrick.prefs.module.YouthSkillHideUnknown.HideMaximalKeyWord.enabled: true FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=8300259353924636&o=APN10645&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: D:\Programme\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008.02.09 15:53:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\ [2013.02.11 19:09:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.09 14:29:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2013.01.18 17:15:25 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.09 14:29:41 | 000,000,000 | ---D | M] [2013.02.09 14:12:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Extensions [2013.02.10 11:22:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions [2012.11.18 16:06:26 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013.01.12 12:14:41 | 000,000,000 | ---D | M] (FoxTrick) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2012.12.09 21:30:50 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2008.08.22 07:56:25 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-13.xml [2008.08.22 08:21:29 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-14.xml [2008.08.22 10:17:23 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-15.xml [2008.08.22 19:53:53 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-16.xml [2008.02.11 22:01:13 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-2.xml [2008.03.04 22:40:11 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-3.xml [2008.03.04 23:50:27 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-4.xml [2008.03.06 11:37:26 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-5.xml [2008.03.22 05:52:10 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-6.xml [2008.03.27 10:17:32 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-7.xml [2008.06.05 08:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-8.xml [2008.06.19 13:32:31 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-9.xml [2009.03.01 13:02:44 | 000,000,944 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin.xml [2013.02.09 14:29:39 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.02.09 14:29:39 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.02.09 14:29:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.02.09 14:29:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.02.09 14:12:52 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCH RESULTS TOOLBAR\DATAMNGR\FIREFOXEXTENSION [2013.02.09 14:29:54 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.10.26 19:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll [2012.02.14 19:48:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.05.14 20:53:46 | 000,003,659 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml [2012.09.01 19:11:23 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.14 19:48:14 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.14 19:48:14 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2013.02.09 14:12:19 | 000,002,687 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml [2012.02.14 19:48:14 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.14 19:48:14 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: Google CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}, CHR - homepage: Google CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\pdf.dll CHR - plugin: Free Studio (Enabled) = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\np_dvs_plugin.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files\Garmin GPS Plugin\npGarmin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: Unity Player (Enabled) = C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\system32\npDeployJava1.dll CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = D:\Programme\npAmazonMP3DownloaderPlugin101753.dll CHR - Extension: Google Drive = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Super Monkey Ball = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjpneodhhegapgagpdeeahiomeiagidi\3_0\ CHR - Extension: Google Mail = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe (PC Tools) O4 - HKLM..\Run: [VirtualCloneDrive] D:\d2\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG) O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.13.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01535634-6163-473B-98D3-142D47E20654}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A0C9220-4183-4B3B-85A1-F4F6CF7D76BA}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (C:\PROGRA~2\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll () O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Programme\Search Results Toolbar\Datamngr\datamngr.dll (Bandoo Media Inc) O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Programme\Search Results Toolbar\Datamngr\IEBHO.dll (Bandoo Media Inc) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\SYSTEM32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp O24 - Desktop BackupWallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{2786ce3f-f3f0-11de-83e4-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup.exe O33 - MountPoints2\{284c4306-b2ff-11e1-9001-0013773bdcc7}\Shell - "" = AutoRun O33 - MountPoints2\{284c4306-b2ff-11e1-9001-0013773bdcc7}\Shell\AutoRun\command - "" = F:\SETUP.EXE O33 - MountPoints2\{cdc32c42-c3e3-11df-910a-0013773bdcc7}\Shell - "" = AutoRun O33 - MountPoints2\{cdc32c42-c3e3-11df-910a-0013773bdcc7}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.11 21:14:49 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe [2013.02.11 21:00:18 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\Malwarebytes [2013.02.11 20:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.02.11 20:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.02.11 20:59:53 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.02.11 20:59:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.02.11 20:59:08 | 010,156,344 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe [2013.02.11 20:09:13 | 000,577,176 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfSysMon.sys [2013.02.11 20:09:13 | 000,055,008 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfFsMon.sys [2013.02.11 20:09:13 | 000,036,456 | --S- | C] (PC Tools) -- C:\Windows\System32\drivers\TfNetMon.sys [2013.02.11 19:09:33 | 000,062,688 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTBD.sys [2013.02.11 19:09:32 | 000,150,648 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll [2013.02.11 19:09:31 | 002,280,568 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll [2013.02.11 19:09:31 | 001,690,744 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll [2013.02.11 19:06:24 | 000,260,760 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys [2013.02.11 19:06:24 | 000,178,584 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys [2013.02.11 19:06:14 | 000,019,464 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctBTFix.sys [2013.02.11 19:06:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security [2013.02.11 19:06:04 | 000,071,752 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys [2013.02.11 19:06:04 | 000,068,272 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsm.sys [2013.02.11 19:05:49 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools [2013.02.11 18:58:38 | 000,909,728 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctEFA.sys [2013.02.11 18:58:38 | 000,342,168 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctDS.sys [2013.02.11 18:58:35 | 000,368,616 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys [2013.02.11 18:58:35 | 000,163,288 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys [2013.02.11 18:58:32 | 000,202,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys [2013.02.11 18:58:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools [2013.02.11 18:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2013.02.11 18:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2013.02.11 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\TestApp [2013.02.11 18:57:25 | 004,125,336 | ---- | C] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe [2013.02.09 14:29:38 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.02.09 14:12:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert [2013.02.09 14:12:29 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess [2013.02.09 14:12:14 | 000,000,000 | ---D | C] -- C:\Program Files\Search Results Toolbar [2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2013.01.28 18:45:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2013.01.18 17:33:04 | 000,000,000 | ---D | C] -- C:\Users\Alex\Desktop\UNS [2010.03.12 03:28:59 | 001,100,664 | ---- | C] (Microsoft Corporation) -- C:\Users\Alex\setup.exe ========== Files - Modified Within 30 Days ========== [2013.02.11 21:30:02 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.11 21:24:58 | 000,002,623 | ---- | M] () -- C:\Users\Alex\Desktop\Microsoft Word.lnk [2013.02.11 21:24:42 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.02.11 21:24:42 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.02.11 21:24:42 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.02.11 21:24:42 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.02.11 21:23:10 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.11 21:21:26 | 003,416,140 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB [2013.02.11 21:18:11 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.11 21:18:09 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.11 21:18:09 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.11 21:17:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe [2013.02.11 21:14:36 | 000,050,477 | ---- | M] () -- C:\Users\Alex\Desktop\Defogger.exe [2013.02.11 20:59:56 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.02.11 20:59:19 | 010,156,344 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe [2013.02.11 20:36:15 | 000,000,000 | ---- | M] () -- C:\Users\Alex\defogger_reenable [2013.02.11 19:06:14 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk [2013.02.11 18:57:36 | 004,125,336 | ---- | M] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe [2013.01.18 17:34:59 | 000,014,663 | ---- | M] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf ========== Files Created - No Company Name ========== [2013.02.11 21:14:35 | 000,050,477 | ---- | C] () -- C:\Users\Alex\Desktop\Defogger.exe [2013.02.11 20:59:56 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.02.11 20:36:15 | 000,000,000 | ---- | C] () -- C:\Users\Alex\defogger_reenable [2013.02.11 19:09:32 | 000,769,144 | ---- | C] () -- C:\Windows\BDTSupport.dll [2013.02.11 19:09:32 | 000,003,488 | ---- | C] () -- C:\Windows\UDB.zip [2013.02.11 19:09:32 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml [2013.02.11 19:09:32 | 000,000,879 | ---- | C] () -- C:\Windows\RegISSImport.xml [2013.02.11 19:09:32 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip [2013.02.11 19:06:14 | 000,001,949 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk [2013.02.11 18:58:41 | 003,416,140 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB [2013.01.18 17:34:58 | 000,014,663 | ---- | C] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf [2012.06.10 14:22:50 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib [2012.05.28 16:32:14 | 000,003,861 | ---- | C] () -- C:\Users\Alex\.TransferManager.db [2012.05.14 21:00:09 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys [2012.04.26 08:29:48 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2012.04.26 08:29:48 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2012.04.24 12:21:09 | 000,010,639 | ---- | C] () -- C:\Users\Alex\Benjamin_elster_2048.pfx [2012.04.24 10:47:04 | 000,010,639 | ---- | C] () -- C:\Users\Alex\ReginaPf_elster_2048.pfx [2012.04.07 16:31:42 | 000,091,930 | ---- | C] () -- C:\Users\Alex\ESt2011_Pfarr_Regina.elfo [2012.03.16 21:56:36 | 000,047,104 | ---- | C] () -- C:\Windows\System32\AntUsbCIv2.dll [2011.12.25 18:33:05 | 000,000,040 | ---- | C] () -- C:\Users\Alex\AppData\Roaming\cdr.ini [2011.07.20 08:52:48 | 000,026,999 | ---- | C] () -- C:\Windows\DIIUnin.dat [2011.07.06 17:27:53 | 000,097,961 | ---- | C] () -- C:\Users\Alex\ESt2010 Regina Pfarr.elfo [2011.01.22 15:54:07 | 000,006,447 | -HS- | C] () -- C:\Users\Alex\Folder.jpg [2011.01.22 15:54:07 | 000,001,928 | -HS- | C] () -- C:\Users\Alex\AlbumArtSmall.jpg [2010.07.19 18:54:49 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.07.12 20:19:26 | 000,000,015 | ---- | C] () -- C:\Users\Alex\ho.dir [2008.04.21 20:08:41 | 000,007,484 | ---- | C] () -- C:\Users\Alex\AppData\Local\d3d9caps.dat [2008.02.23 11:39:36 | 000,021,504 | ---- | C] () -- C:\Users\Alex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011.01.22 15:49:17 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Amazon [2013.01.01 15:42:22 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\calibre [2012.11.26 21:04:25 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1 [2011.06.30 08:04:01 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Dropbox [2013.02.11 18:36:30 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\DVDVideoSoft [2012.04.07 15:40:51 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\elsterformular [2012.04.26 08:29:46 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\FreePDF [2012.05.14 20:46:22 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Garmin [2012.06.08 20:04:31 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\GetRightToGo [2013.02.11 18:37:36 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\GlarySoft [2008.02.09 16:21:28 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\ICQ Toolbar [2008.04.21 19:56:03 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\LiteOn [2012.05.14 20:51:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\OpenCandy [2010.07.19 13:27:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\OpenOffice.org [2012.05.14 21:16:16 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Samsung [2008.05.29 22:39:40 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\temp [2013.02.11 18:57:48 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\TestApp [2008.06.04 18:07:37 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Thinstall [2012.01.16 19:20:12 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\René's Homepage ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 24 bytes -> C:\Windows:EE5474176155704A @Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMP  FC5A2B2@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84 < End of report > OTL Extras logfile created on: 11.02.2013 21:26:09 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Alex\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,75 Gb Total Physical Memory | 0,85 Gb Available Physical Memory | 48,85% Memory free 3,73 Gb Paging File | 2,49 Gb Available in Paging File | 66,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 39,06 Gb Total Space | 5,13 Gb Free Space | 13,13% Space Free | Partition Type: NTFS Drive D: | 35,47 Gb Total Space | 15,39 Gb Free Space | 43,40% Space Free | Partition Type: NTFS Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- Reg Error: Key error. http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- () [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- () ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{32C34BAF-E482-49EE-9629-E7DB03659050}" = protocol=6 | dir=in | app=c:\program files\search results toolbar\datamngr\srtool~1\dtuser.exe | "{44FDBDD3-0242-4D3F-9B6A-5A4712F77B66}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{4C8234DE-EACA-4DF8-AA2C-962441AAD923}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{776F490A-F044-4667-BE7C-91BC469E49CF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{AA16EE69-A046-4503-B91A-16E2A80AD3A1}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | "{E90B8152-E4BE-40A9-ADE6-A016EAFDE5B7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | "{EB5D6008-CC9A-4147-AECC-DE50B704C017}" = protocol=17 | dir=in | app=c:\program files\search results toolbar\datamngr\srtool~1\dtuser.exe | "{FDDC9297-15BE-4E35-9A5E-77EFE11CEE1E}" = dir=in | app=c:\program files\skype\phone\skype.exe | "TCP Query User{11FE6EF0-F5C1-4E7A-9CFC-6D02BCAE3DA9}D:\diablo ii\game.exe" = protocol=6 | dir=in | app=d:\diablo ii\game.exe | "TCP Query User{14096228-7B2C-4AB9-9C95-46B4D2C0E152}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | "TCP Query User{4856B7E8-76AF-4FE3-ACCB-84FDACAB74C9}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "TCP Query User{4AE458A5-DC9F-48EB-9790-B1A8CAFF5758}D:\programme\kav7.0\german\setup.exe" = protocol=6 | dir=in | app=d:\programme\kav7.0\german\setup.exe | "TCP Query User{ACC23A67-DE2D-4817-9F0D-C6FEED007606}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "TCP Query User{DCA2FEDA-6D3D-4FB8-9D03-C75CC9BD3101}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | "TCP Query User{E1CFD2AE-899E-4A3A-9F93-7A04067908A2}D:\diablo ii\game.exe" = protocol=6 | dir=in | app=d:\diablo ii\game.exe | "TCP Query User{F3BE6F32-6674-474E-A99C-F91F53EB1820}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | "UDP Query User{23711B4D-C355-4D7B-9A6D-5C523510F55B}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | "UDP Query User{38282681-D9E9-40A1-A131-59EC548ACB79}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "UDP Query User{69E2E8AB-BB45-4D0A-9935-B0EFF5503485}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | "UDP Query User{6E006C96-8668-4D81-8F58-D83C08D666E3}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "UDP Query User{9BF37AB2-C4DE-4A5E-B8DC-6EC323DF270C}D:\diablo ii\game.exe" = protocol=17 | dir=in | app=d:\diablo ii\game.exe | "UDP Query User{AD876FC0-F41A-4647-8E6A-D3D9BE076868}D:\programme\kav7.0\german\setup.exe" = protocol=17 | dir=in | app=d:\programme\kav7.0\german\setup.exe | "UDP Query User{B6C638B5-2AA3-46C6-8D08-4B4336AFCE17}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | "UDP Query User{FC772F0E-AD2D-4D1B-937F-E36D8BAAA2F5}D:\diablo ii\game.exe" = protocol=17 | dir=in | app=d:\diablo ii\game.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{1752D07B-9BEB-414F-9B51-AA529101F0E5}" = calibre "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{251FE1B1-3227-4CC2-953E-B027BDD248F4}" = Tuner Driver "{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 35 "{26A24AE4-039D-4CA4-87B4-2F83217013FF}" = Java 7 Update 13 "{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in "{2E4EA28A-7F64-44E4-81C5-7BDF656E3B1D}" = Samsung PC Studio 3 "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component "{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1 "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7 "{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7A21C722-F259-4976-B7AA-6658E5FDEDAF}" = Google Drive "{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8ED02445-D491-414C-A56D-2ED6BBB7239A}" = Garmin Communicator Plugin "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage "{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Deutsch "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8 "{B6D17D97-44CE-402E-BBF2-B38492CBFED7}" = Garmin ANT Agent "{C491CA52-B4DA-2753-5B4F-0CC9F1C89E6C}" = myphotobook.de "{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3 "{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}" = WinZip 11.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR "24DA573F901348FFDFF7717497830D45BE0C362E" = Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) "49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) "8FBA55A78723E5046E54FECA5BAB62E8C99ACD3C" = Windows-Treiberpaket - LITEON (Ltn_stk7700pc) Media (11/28/2006 3.0.0.7) "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Agere Systems Soft Modem" = Agere Systems HDA Modem "Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17 "Browser Defender_is1" = Browser Guard 4.0 "de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de "Diablo II" = Diablo II "ElsterFormular für Privatanwender 12.2.2.6665p" = ElsterFormular für Privatanwender "FreePDF_XP" = FreePDF (Remove only) "Google Chrome" = Google Chrome "GPL Ghostscript 9.04" = GPL Ghostscript "Kalender-Excel_is1" = Kalender-Excel-8.7 "Kobo" = Kobo "Magic Workstation_is1" = Magic Workstation 0.94f "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100 "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "PDFTK Builder_is1" = PDFTK Builder 3.5.3 "Redirection Port Monitor" = RedMon - Redirection Port Monitor "RTPatch_is1" = RTPatch Update "SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "Spyware Doctor" = PC Tools Spyware Doctor 9.1 "VirtualCloneDrive" = VirtualCloneDrive "VLC media player" = VideoLAN VLC media player 0.8.6c "Winamp" = Winamp "WinRAR archiver" = WinRAR ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "UnityWebPlayer" = Unity Web Player "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 08.12.2012 04:38:20 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 08.12.2012 04:38:20 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 08.12.2012 04:38:21 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 01.01.2013 10:23:56 | Computer Name = Alex-PC | Source = Application Hang | ID = 1002 Description = Programm wmplayer.exe, Version 11.0.6002.18311 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: f64 Anfangszeit: 01cde82b95284b33 Zeitpunkt der Beendigung: 15 Error - 01.01.2013 10:42:24 | Computer Name = Alex-PC | Source = Windows Search Service | ID = 3013 Description = Error - 10.02.2013 06:29:56 | Computer Name = Alex-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung avguard.exe, Version 12.3.0.15, Zeitstempel 0x4fa05b53, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5, Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7, Prozess-ID 0x1d8, Anwendungsstartzeit 01ce0777f52da8bf. Error - 11.02.2013 16:21:34 | Computer Name = Alex-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung fpassist.exe, Version 3.20.0.95, Zeitstempel 0x4e5009ca, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x00000000, Prozess-ID 0xe68, Anwendungsstartzeit 01ce089532140e6d. [ System Events ] Error - 10.02.2013 06:56:59 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = Error - 10.02.2013 07:14:51 | Computer Name = Alex-PC | Source = Dhcp | ID = 1002 Description = Die IP-Adresslease 192.168.0.100 für die Netzwerkkarte mit der Netzwerkadresse 001B9E428C03 wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet). Error - 10.02.2013 14:08:01 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = Error - 10.02.2013 15:28:15 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = Error - 11.02.2013 11:59:10 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = Error - 11.02.2013 14:10:29 | Computer Name = Alex-PC | Source = PCTCore | ID = 327960 Description = The item store is corrupted: @5644. Error - 11.02.2013 14:10:29 | Computer Name = Alex-PC | Source = PCTCore | ID = 327960 Description = The item store is corrupted: @5644. Error - 11.02.2013 15:07:21 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = Error - 11.02.2013 15:09:17 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7030 Description = Error - 11.02.2013 16:19:17 | Computer Name = Alex-PC | Source = Service Control Manager | ID = 7000 Description = < End of report > Ich bin für jede Hilfe dankbar. Grüße Benni |
|
13.02.2013, 10:51
| #2 |
| /// Malware-holic   |  www.searchnu.com/406 wird bei jedem neuen Tab geöffnet hi
__________________und die Malwarebytes Funde sollen wir raten? http://www.trojaner-board.de/125889-...en-posten.html bitte poste das Log
__________________ |
|
13.02.2013, 16:40
| #3 | ||
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet Ich bin mir nicht schlüssig ob alle oder nur die neuesten, daher poste ich mal lieber mehr als zu wenig.
__________________Zitat:
Zitat:
|
|
13.02.2013, 18:03
| #4 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet das passt. Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.02.2013, 18:54
| #5 | |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet Hallo, es sieht ein kleinwenig anders aus als beschrieben, aber den Report (ist nehme ich an die Logfile) konnte ich direkt dem Programm entnehmen. Zitat:
|
|
13.02.2013, 19:38
| #6 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet Hi, passt. Scan mit Combofix
__________________ --> www.searchnu.com/406 wird bei jedem neuen Tab geöffnet |
|
13.02.2013, 20:11
| #7 | |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnetZitat:
ich habe Combofix.exe runter geladen und ausgeführt. Er hatte auch einen Fund, aber ich finde keine Logdatei. Ich habe die Suche laufen lassen, es gibt keine Combofix.txt. :/ Der Rechner ist neu gestartet. Ich hatte die Hoffnung dass erst dann die txt erstellt wird. |
|
13.02.2013, 20:12
| #8 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet auf c: entweder combofix bzw log.txt
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.02.2013, 20:14
| #9 | |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnetZitat:
|
|
13.02.2013, 20:15
| #10 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet ne geht automatisch. starte mal neu, drücke f8 wähle abgesicherter Modus, melde dich in deinem Konto an, führe combofix noch mal aus, speichere das Log und dann wieder in den normalen Modus, Log posten
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.02.2013, 20:46
| #11 |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet Hier die log.txt. Combofix Logfile: Code:
ATTFilter ComboFix 13-02-13.01 - Alex 13.02.2013 20:30:29.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.1789.1372 [GMT 1:00]
ausgeführt von:: c:\users\Alex\Desktop\ComboFix.exe
AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
SP: PC Tools Spyware Doctor *Enabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 24 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
D:\resycled
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-01-13 bis 2013-02-13 ))))))))))))))))))))))))))))))
.
.
2013-02-13 19:36 . 2013-02-13 19:36 -------- d-----w- c:\users\Alex\AppData\Local\temp
2013-02-12 19:25 . 2013-02-13 15:47 768 ----a-w- c:\windows\DeleteOnReboot.bat
2013-02-11 20:00 . 2013-02-11 20:00 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes
2013-02-11 19:59 . 2013-02-11 19:59 -------- d-----w- c:\programdata\Malwarebytes
2013-02-11 19:59 . 2013-02-11 20:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-02-11 19:59 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-02-11 19:09 . 2012-10-31 08:19 577176 --s---w- c:\windows\system32\drivers\TfSysMon.sys
2013-02-11 19:09 . 2012-10-31 08:19 55008 --s---w- c:\windows\system32\drivers\TfFsMon.sys
2013-02-11 19:09 . 2012-10-31 08:19 36456 --s---w- c:\windows\system32\drivers\TfNetMon.sys
2013-02-11 18:09 . 2012-10-23 16:40 62688 ----a-w- c:\windows\system32\drivers\PCTBD.sys
2013-02-11 18:09 . 2012-10-23 16:40 150648 ----a-w- c:\windows\SGDetectionTool.dll
2013-02-11 18:09 . 2012-10-23 16:40 769144 ----a-w- c:\windows\BDTSupport.dll
2013-02-11 17:58 . 2012-11-01 14:35 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys
2013-02-11 17:57 . 2013-02-11 19:09 -------- d-----w- c:\programdata\PC Tools
2013-02-11 17:57 . 2013-02-11 17:57 -------- d-----w- c:\users\Alex\AppData\Roaming\TestApp
2013-02-09 13:12 . 2013-02-09 13:12 -------- d-----w- c:\programdata\Wincert
2013-02-09 13:12 . 2013-02-12 19:25 -------- d-----w- c:\program files\Search Results Toolbar
2013-02-08 17:31 . 2013-01-08 04:57 6991832 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3316801B-907B-4A03-8068-F084FEB81212}\mpengine.dll
2013-02-06 20:12 . 2013-02-06 20:12 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-01-28 17:45 . 2013-01-28 17:45 -------- d-----w- c:\program files\Common Files\Skype
2013-01-28 17:45 . 2013-01-28 17:45 -------- d-----r- c:\program files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-09 13:23 . 2012-03-31 13:35 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-09 13:23 . 2011-09-25 18:58 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 20:12 . 2012-07-01 10:42 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-02-06 20:12 . 2010-06-07 15:27 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-01-17 00:28 . 2009-10-11 09:07 232336 ------w- c:\windows\system32\MpSigStub.exe
2012-12-16 13:12 . 2012-12-20 21:13 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-20 21:13 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-11-23 01:35 . 2013-01-09 20:41 2048000 ----a-w- c:\windows\system32\win32k.sys
2012-11-20 04:22 . 2013-01-09 20:40 204288 ----a-w- c:\windows\system32\ncrypt.dll
2013-02-09 13:29 . 2013-02-09 13:29 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-12-17 18:50 556648 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-12-17 18:50 556648 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-12-17 18:50 556648 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-12-17 18:50 556648 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"VirtualCloneDrive"="d:\d2\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"ISTray"="c:\program files\PC Tools\PC Tools Security\pctsGui.exe" [2012-11-01 2717816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= c:\progra~2\Wincert\WIN32C~1.DLL
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANT Agent]
2012-03-23 13:09 14749544 ----a-w- c:\program files\Garmin\ANT Agent\ANT Agent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 07:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-04 18:25 1607120 ----a-w- c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 13:23]
.
2013-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-22 11:31]
.
2013-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-22 11:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = hxxp://de.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*Yahoo! Suche
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\3osy0i74.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=350&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=8300259353924636&o=APN10645&q=
FF - ExtSQL: 2013-02-11 19:09; {cb84136f-9c44-433a-9048-c5cd9df1dc16}; c:\program files\PC Tools\PC Tools Security\BDT\Firefox
FF - ExtSQL: !HIDDEN! 2013-02-09 14:12; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\program files\Search Results Toolbar\Datamngr\FirefoxExtension
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8uKLa6Qm&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - cca26c2c000000000000001b9e428c03
FF - user.js: extensions.incredibar_i.instlDay - 15493
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.148:51
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8uKLa6Qm
FF - user.js: extensions.incredibar_i.upn2n - 92824464636505638
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10646
FF - user.js: extensions.incredibar_i.ppd -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-Garmin Lifetime Updater - c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe
MSConfigStartUp-PDFPrint - c:\program files\pdf24\pdf24.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-13 20:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1223423791-1231596254-678561435-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DAEF98CA-0290-A9AC-A86E-27C82EE4EDB9}*]
@Allowed: (Read) (RestrictedCode)
"gajkeijknegeeg"=hex:61,63,68,6e,65,65,61,6f,62,6f,6e,6c,62,6e,66,6d,6a,66,67,
63,66,66,6e,68,70,64,70,6b,70,6f,6c,6d,63,66,65,6e,63,6c,6c,6d,70,6e,6b,6b,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-02-13 20:39:27
ComboFix-quarantined-files.txt 2013-02-13 19:39
.
Vor Suchlauf: 5.352.558.592 Bytes frei
Nach Suchlauf: 5.146.796.032 Bytes frei
.
- - End Of File - - 49B2F835BAAFCB9E4BC583B547113D92
|
|
13.02.2013, 20:49
| #12 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet otl fix Fixen mit OTL
Code:
ATTFilter :OTL
O20 - AppInit_DLLs: (C:\PROGRA~2\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Programme\Search Results Toolbar\Datamngr\datamngr.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Programme\Search Results Toolbar\Datamngr\IEBHO.dll (Bandoo Media Inc)
:files
:Commands
[emptytemp]
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.02.2013, 20:49
| #13 |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet doppelpost |
|
13.02.2013, 20:50
| #14 |
| /// Malware-holic | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet hi das war jetzt 2x, sieh e meinen Post über deinem :-)
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.02.2013, 20:58
| #15 |
| | www.searchnu.com/406 wird bei jedem neuen Tab geöffnet doppelpost Geändert von DonBenni82 (13.02.2013 um 21:11 Uhr) |
|
| Themen zu www.searchnu.com/406 wird bei jedem neuen Tab geöffnet |
| 32 bit, bandoo, bho, browser, entfernen, error, excel, firefox, flash player, google, helper, home, hängt, install.exe, libusb0.sys, logfile, ntdll.dll, plug-in, problem, programm, remote control, rootkit, scan, search results toolbar, searchnu.com/406, security, software, spyware, starten, suchmaschine, super, svchost.exe, system, vista |
WARNUNG an die MITLESER: 
Textbox. 
Linear-Darstellung
