| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Unbekannte Datei auf USB-Stick - Virus?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.02.2013, 15:03
| #1 |
 |  Unbekannte Datei auf USB-Stick - Virus? Hallo, ich hatte vor einiger Zeit einen Virus auf dem PC, der mir per Skype gesendet wurde. Ich glaube es war eine Art Keylogger, zumindest hatte er am Ende meine Daten, die ich auf einem Forum benutzte. Nun ja, ich wollte gestern für die Schule etwas auf einen meiner USB-Sticks kopieren und vorher die restlichen Daten auf dem USB-Stick entfernen. Dabei handelte es sich um einige Ordner, die aber alle leer waren. Ich markierte alle und löschte sie, da kam die Meldung, dass eine der Dateien eine Anwendungsdatei sei und ich wurde gefragt, ob ich diese wirklich entfernen möchte. Leider war ich zu blöd um mir den Namen der Datei genau durchzulesen. Ich bin mir nicht sicher, aber entweder war es eine ".crownd"-Datei oder sowas, oder sie hieß "crownd.dat" (ungefähr so). Ich war mir nicht sicher, ob ich den USB-Stick einsteckte, als ich den Virus auf meinem PC hatte, daher weiß ich nicht, ob das vielleicht ein Virus war oder nicht. Ich formatierte den USB-Stick indem ich im Arbeitsplatz Rechtsklick machte und auf formatieren klickte. Was glaubt ihr, war das ein Virus? Wenn es einer war, ist er jetzt weg oder hat er sich beim Einstecken wieder auf meinen PC übertragen? (Avira AntiVir sagte nichts, Avira DE Cleaner fand auch keinen Virus) Wo wir gerade dabei sind: Kann jemand die Datei, die mir geschickt wurde "analysieren" und mir sagen, was das für ein Virus ist, was er bewirkt, ob er sich im Netzwerk verbreitet hat etc. ? Downloadlink (den, der mir geschickt wurde) würde ich euch dann senden. Ich weiß aber nicht, ob ihr dann auch "infiziert" seid, daher keine Garantie, wenn ihr annehmt, ich habe keine Ahnung davon! Kann ich meinen PC vielleicht noch irgendwie nach Viren durchsuchen etc? MfG Besser gesagt es ist eine kleine Speicherkarte für mein Handy mit dem dazugehörigen Adapter, ich benutze es aber als USB-Stick. |
|
14.02.2013, 07:50
| #2 |
| /// Helfer-Team  | Unbekannte Datei auf USB-Stick - Virus? du kannst mir den Link per PM senden. Downloade Dir bitte  Malwarebytes Anti-Malware
danach: Systemscan mit OTL (bebilderte Anleitung) Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
__________________ |
|
14.02.2013, 12:15
| #3 | |||
| | Unbekannte Datei auf USB-Stick - Virus?Zitat:
Allerdings bin ich ein Anfänger in Sachen PC und weiß nicht, was ich alles alleine schaffe. Ich gucke mal, was ich alles alleine schaffe, dann melde ich mich nochmal. Die PM kommt. MfG Edit: [QUOTE=otl.txt]OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.02.2013 12:15:44 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Maik\Downloads 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 15,97 Gb Total Physical Memory | 13,80 Gb Available Physical Memory | 86,43% Memory free 31,94 Gb Paging File | 29,25 Gb Available in Paging File | 91,59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 55,80 Gb Total Space | 10,16 Gb Free Space | 18,21% Space Free | Partition Type: NTFS Drive D: | 931,51 Gb Total Space | 914,63 Gb Free Space | 98,19% Space Free | Partition Type: NTFS Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.14 12:14:17 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Maik\Downloads\OTL.exe PRC - [2013.02.12 16:15:07 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Avira\AntiVir Desktop\sched.exe PRC - [2013.02.12 16:14:17 | 000,285,408 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Avira\AntiVir Desktop\avnotify.exe PRC - [2013.02.12 16:14:15 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Avira\AntiVir Desktop\avguard.exe PRC - [2013.02.12 16:14:14 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.01.24 05:46:48 | 005,399,888 | ---- | M] (ManyCam LLC) -- C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe PRC - [2012.12.19 22:50:52 | 001,645,856 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe PRC - [2012.12.17 18:20:29 | 001,199,576 | ---- | M] (Spotify Ltd) -- C:\Users\Maik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2012.09.10 16:06:26 | 000,372,736 | ---- | M] (Secure Banking) -- C:\Program Files (x86)\Secure Banking\SecureBanking.exe PRC - [2012.09.07 17:30:34 | 000,002,560 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\sbservice.exe PRC - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe ========== Modules (No Company Name) ========== MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM35D5.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM35B4.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3593.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3562.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3541.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3520.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM34FF.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM34DD.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM34BC.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM343D.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM341C.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM33FB.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM33CA.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM33A9.tmp MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3388.tmp MOD - [2013.02.14 12:12:44 | 000,086,016 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM364D.tmp MOD - [2013.02.14 12:12:44 | 000,086,016 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM364B.tmp MOD - [2013.02.14 12:12:44 | 000,086,016 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3639.tmp MOD - [2013.02.14 12:12:44 | 000,086,016 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3627.tmp MOD - [2013.02.14 12:12:43 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3376.tmp MOD - [2013.02.14 12:12:43 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3355.tmp MOD - [2013.02.14 12:12:43 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3334.tmp MOD - [2013.02.14 12:12:43 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3313.tmp MOD - [2013.02.14 12:12:43 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM32F0.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3250.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM324E.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM322B.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3219.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3217.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM31F4.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM31E2.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM31D1.tmp MOD - [2013.02.14 12:12:43 | 000,075,776 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM316B.tmp MOD - [2013.02.14 12:12:43 | 000,072,704 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM32AC.tmp MOD - [2013.02.14 12:12:43 | 000,072,192 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM32CF.tmp MOD - [2013.02.14 12:12:43 | 000,072,192 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM32BE.tmp MOD - [2013.02.14 12:12:43 | 000,072,192 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3298.tmp MOD - [2013.02.14 12:12:43 | 000,068,608 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM31BF.tmp MOD - [2013.02.14 12:12:43 | 000,064,000 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3273.tmp MOD - [2013.02.14 12:12:43 | 000,057,344 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3287.tmp MOD - [2013.02.14 12:12:43 | 000,056,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3206.tmp MOD - [2013.02.14 12:12:43 | 000,056,320 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM323C.tmp MOD - [2013.02.14 12:12:43 | 000,056,320 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM318C.tmp MOD - [2013.02.14 12:12:43 | 000,055,296 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM31AE.tmp MOD - [2013.02.14 12:12:43 | 000,053,760 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3275.tmp MOD - [2013.02.14 12:12:43 | 000,053,760 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3262.tmp MOD - [2013.02.14 12:12:43 | 000,033,792 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\YTMP7MC8AA\TAA329A.tmp MOD - [2013.02.13 14:55:32 | 012,638,576 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll MOD - [2013.01.26 03:35:06 | 000,460,240 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll MOD - [2013.01.26 03:35:04 | 004,012,496 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll MOD - [2013.01.26 03:34:19 | 000,597,968 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll MOD - [2013.01.26 03:34:18 | 000,124,368 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll MOD - [2013.01.26 03:34:16 | 001,552,848 | ---- | M] () -- C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll MOD - [2013.01.24 05:42:22 | 002,010,624 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\opencv_core220.dll MOD - [2013.01.24 05:42:22 | 001,241,088 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\opencv_imgproc220.dll MOD - [2013.01.24 05:42:22 | 000,775,680 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\opencv_highgui220.dll MOD - [2013.01.24 05:42:22 | 000,241,152 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\opencv_objdetect220.dll MOD - [2013.01.24 05:42:22 | 000,201,216 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\opencv_video220.dll MOD - [2012.09.07 17:30:34 | 000,002,560 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\sbservice.exe MOD - [2012.09.07 17:30:22 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\SecureBanking.dll MOD - [2012.09.05 20:49:54 | 000,008,704 | ---- | M] () -- C:\Program Files (x86)\Secure Banking\funcs.dll ========== Services (SafeList) ========== SRV:64bit: - [2012.09.28 15:43:40 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV:64bit: - [2012.09.28 02:38:16 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2013.02.12 16:15:07 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.02.12 16:14:15 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.02.08 18:15:47 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.01.19 11:43:27 | 000,541,608 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013.01.16 21:09:27 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.05.20 15:26:28 | 000,199,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.12.03 15:36:36 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.12.03 15:36:35 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.11.16 20:17:15 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.10.11 04:08:10 | 000,044,928 | ---- | M] (ManyCam LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcvidrv_x64.sys -- (ManyCam) DRV:64bit: - [2012.10.11 04:08:08 | 000,029,696 | ---- | M] (ManyCam LLC) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcaudrv_x64.sys -- (mcaudrv_simple) DRV:64bit: - [2012.09.28 03:21:20 | 010,697,216 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.09.28 02:12:52 | 000,460,288 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.05.14 07:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.06.10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.04.15 07:37:50 | 000,079,488 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata) DRV:64bit: - [2011.04.15 07:37:50 | 000,040,064 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.04 16:00:14 | 000,390,632 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:64bit: - [2011.03.04 16:00:14 | 000,126,952 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:64bit: - [2010.11.28 21:50:38 | 000,044,672 | R--- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.09.30 20:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.09.30 20:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.05.20 15:26:28 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo) DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2009.11.24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012.04.09 10:13:58 | 000,057,472 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2) DRV - [2012.04.09 10:13:58 | 000,057,472 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}: "URL" = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Maik\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Maik\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.30 11:56:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.30 11:56:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Extensions [2013.02.11 19:35:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\zw3ks7kf.default\extensions [2013.02.11 19:35:08 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Maik\AppData\Roaming\mozilla\Firefox\Profiles\zw3ks7kf.default\extensions\toolbar@ask.com [2013.01.30 11:56:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.01.16 21:10:14 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2013.01.17 01:11:04 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.01.17 01:11:04 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013.01.17 01:11:04 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2013.01.17 01:11:04 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2013.01.17 01:11:04 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2013.01.17 01:11:04 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - homepage: CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Maik\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll CHR - Extension: Google Drive = C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google Mail = C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] D:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [ManyCam] C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe (ManyCam LLC) O4 - HKCU..\Run: [SecureBanking] C:\Program Files (x86)\Secure Banking\SecureBanking.exe (Secure Banking) O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Maik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E0D77BA-7EEA-4C04-A5C1-E46F29442A7B}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{fa69d5ca-485b-11e2-af32-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{fa69d5ca-485b-11e2-af32-806e6f6e6963}\Shell\AutoRun\command - "" = E:\DVDSetup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.13 15:09:40 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013.02.13 15:09:40 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013.02.13 15:09:39 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.02.13 15:09:39 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013.02.13 15:09:39 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013.02.13 15:09:39 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.02.13 15:09:39 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013.02.13 15:09:39 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013.02.13 15:09:39 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.02.13 15:09:39 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013.02.13 15:09:39 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013.02.13 15:09:38 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.02.13 15:09:38 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.02.13 15:09:38 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.02.13 15:09:38 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013.02.13 14:56:00 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013.02.13 14:56:00 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013.02.13 14:55:59 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013.02.13 14:55:57 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll [2013.02.13 14:55:57 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2013.02.13 14:55:57 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2013.02.13 14:55:57 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2013.02.13 14:55:57 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2013.02.13 14:55:56 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS [2013.02.13 14:55:56 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2013.02.11 19:35:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com [2013.02.11 19:35:04 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\APN [2013.02.11 19:34:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask [2013.02.11 19:34:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManyCam [2013.02.11 19:34:46 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Roaming\ManyCam [2013.02.11 19:34:46 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\ManyCam [2013.02.11 19:34:46 | 000,000,000 | ---D | C] -- C:\ProgramData\ManyCam [2013.02.11 19:34:44 | 000,044,928 | ---- | C] (ManyCam LLC) -- C:\Windows\SysNative\drivers\mcvidrv_x64.sys [2013.02.11 19:34:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp [2013.02.11 19:34:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ManyCam [2013.01.30 12:37:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secure Banking [2013.01.30 12:37:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secure Banking [2013.01.30 11:57:51 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Roaming\QFX Software [2013.01.30 11:57:51 | 000,000,000 | ---D | C] -- C:\ProgramData\QFX Software [2013.01.30 11:56:57 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Macromedia [2013.01.30 11:56:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Roaming\Mozilla [2013.01.30 11:56:10 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Mozilla [2013.01.30 11:56:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.01.30 11:56:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2013.01.30 11:56:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.01.29 15:04:11 | 000,000,000 | ---D | C] -- C:\Users\Maik\Desktop\Daten [2013.01.29 01:09:28 | 000,356,520 | ---- | C] (Ask.com) -- C:\Users\Maik\Documents\ApnStub.exe [2013.01.26 12:29:12 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Roaming\TS3Client [2013.01.21 21:27:49 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Programs [2013.01.21 21:23:38 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\Gameforge4d [2013.01.18 21:32:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya [2013.01.18 21:31:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya [2013.01.18 18:11:43 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll [2013.01.18 18:11:43 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll [2013.01.18 18:11:43 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll [2013.01.18 13:48:40 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Local\PMB Files [2013.01.18 13:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2013.01.18 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks [2013.01.18 13:48:04 | 000,000,000 | ---D | C] -- C:\Users\Maik\.swt [2013.01.16 17:29:54 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat [2013.01.16 17:29:54 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat [2013.01.15 21:23:11 | 000,000,000 | ---D | C] -- C:\Users\Maik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2013.01.15 21:23:04 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2013.01.15 21:23:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT [2013.01.15 21:23:00 | 000,000,000 | ---D | C] -- C:\Program Files\AMD [2013.01.15 21:23:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD [2013.01.15 21:22:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2013.01.15 21:22:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2013.01.15 21:22:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2013.01.15 21:21:24 | 000,000,000 | ---D | C] -- C:\AMD ========== Files - Modified Within 30 Days ========== [2013.02.14 12:15:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.14 12:12:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.14 12:12:35 | 4271,484,926 | -HS- | M] () -- C:\hiberfil.sys [2013.02.13 17:29:45 | 000,026,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.13 17:29:45 | 000,026,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.13 17:28:27 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.02.13 17:28:27 | 000,698,688 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.02.13 17:28:27 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.02.13 17:28:27 | 000,148,828 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.02.13 17:28:27 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.02.13 16:07:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-82340316-3250680590-1900150454-1000UA.job [2013.02.13 16:04:02 | 000,294,168 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.02.12 19:07:22 | 000,008,384 | ---- | M] () -- C:\Users\Maik\AppData\Local\recently-used.xbel [2013.02.10 13:07:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-82340316-3250680590-1900150454-1000Core.job [2013.02.08 18:15:47 | 000,697,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.02.08 18:15:47 | 000,074,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.02.04 23:07:48 | 000,223,767 | ---- | M] () -- C:\Users\Maik\Desktop\Tomke.jpg [2013.02.04 22:55:58 | 000,100,080 | ---- | M] () -- C:\Users\Maik\Desktop\beckmann_header.png [2013.02.04 13:36:25 | 000,096,991 | ---- | M] () -- C:\Users\Maik\Desktop\VBT Splash.jpg [2013.01.31 13:05:38 | 000,002,358 | ---- | M] () -- C:\Users\Maik\Desktop\Google Chrome.lnk [2013.01.30 12:04:33 | 001,591,896 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.01.30 11:56:07 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.01.30 11:25:51 | 000,001,985 | ---- | M] () -- C:\Users\Maik\Desktop\Avira DE-Cleaner.lnk [2013.01.29 15:04:06 | 003,778,614 | ---- | M] () -- C:\Users\Maik\Desktop\3.bmp [2013.01.29 15:03:46 | 003,778,614 | ---- | M] () -- C:\Users\Maik\Desktop\2.bmp [2013.01.29 15:03:17 | 003,778,614 | ---- | M] () -- C:\Users\Maik\Desktop\1.bmp [2013.01.29 01:09:28 | 000,356,520 | ---- | M] (Ask.com) -- C:\Users\Maik\Documents\ApnStub.exe ========== Files Created - No Company Name ========== [2013.02.12 19:07:22 | 000,008,384 | ---- | C] () -- C:\Users\Maik\AppData\Local\recently-used.xbel [2013.02.04 23:07:48 | 000,223,767 | ---- | C] () -- C:\Users\Maik\Desktop\Tomke.jpg [2013.02.04 22:55:57 | 000,100,080 | ---- | C] () -- C:\Users\Maik\Desktop\beckmann_header.png [2013.02.03 22:43:46 | 000,096,991 | ---- | C] () -- C:\Users\Maik\Desktop\VBT Splash.jpg [2013.01.30 11:56:07 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013.01.30 11:56:07 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2013.01.30 11:25:51 | 000,001,985 | ---- | C] () -- C:\Users\Maik\Desktop\Avira DE-Cleaner.lnk [2013.01.29 15:03:58 | 003,778,614 | ---- | C] () -- C:\Users\Maik\Desktop\3.bmp [2013.01.29 15:03:38 | 003,778,614 | ---- | C] () -- C:\Users\Maik\Desktop\2.bmp [2013.01.29 15:03:06 | 003,778,614 | ---- | C] () -- C:\Users\Maik\Desktop\1.bmp [2012.12.20 16:53:17 | 000,005,120 | ---- | C] () -- C:\Users\Maik\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.12.20 16:17:43 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.12.20 16:15:23 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.12.20 16:15:23 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.12.20 16:15:23 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2012.12.17 22:17:02 | 001,591,896 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > [QUOTEExtras.txt]OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 14.02.2013 12:15:44 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Maik\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
15,97 Gb Total Physical Memory | 13,80 Gb Available Physical Memory | 86,43% Memory free
31,94 Gb Paging File | 29,25 Gb Available in Paging File | 91,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55,80 Gb Total Space | 10,16 Gb Free Space | 18,21% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 914,63 Gb Free Space | 98,19% Space Free | Partition Type: NTFS
Computer Name: MAIK-PC | User Name: Maik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07E6ABEB-3B1A-4512-8488-E4860743C56D}" = lport=137 | protocol=17 | dir=in | app=system |
"{087EE17F-069B-49DF-A32E-EDA42B24BF87}" = rport=10243 | protocol=6 | dir=out | app=system |
"{27B3E3FC-6570-4F52-A6CE-FD8007B27E8C}" = rport=445 | protocol=6 | dir=out | app=system |
"{572B669C-FD71-44D0-AA16-04AA13A3670E}" = lport=57573 | protocol=6 | dir=in | name=pando media booster |
"{5CF0A241-6A8C-4CA2-855D-996131074252}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{660F5B17-906F-435A-9301-51018BD4F12D}" = rport=138 | protocol=17 | dir=out | app=system |
"{6C22089F-2E3F-49DC-9B4D-40C3FAE52E3A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6D6E3187-E7E6-46BF-BB51-58585F2E2BE6}" = lport=57573 | protocol=6 | dir=in | name=pando media booster |
"{7B7928EF-0CF7-40DE-A7FE-810B3964C7EF}" = lport=57573 | protocol=17 | dir=in | name=pando media booster |
"{7C36740F-2A1C-4E65-8C3E-6B6D0F5637A1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9D9620CF-9C7A-415E-B41A-103A2B28BD3E}" = lport=57573 | protocol=17 | dir=in | name=pando media booster |
"{AC95AF5A-0058-4197-BDD4-CFDEDC97A7A9}" = lport=138 | protocol=17 | dir=in | app=system |
"{B92F4F6A-FA5D-49D2-8D39-4D7EC60B5E28}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B98F5E35-FABF-49B9-87DB-EF17C7BB80D2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BE73A66A-8890-4202-86D6-F36362040B28}" = rport=137 | protocol=17 | dir=out | app=system |
"{BF5EE7BB-2FD7-4E0A-8AEE-47343AE5DAF3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BFFFD9D2-927C-4E3A-869F-F80FC305049B}" = rport=139 | protocol=6 | dir=out | app=system |
"{C32F189D-3088-4C45-B80E-B604E3FFB9B5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D2EBC6C7-7258-4973-B337-E92AE9A34868}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D9E30E3E-673B-49E6-B9BC-DAA058D90772}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E2CEFF9F-D85E-4FD3-A061-CF5E659ADD20}" = lport=445 | protocol=6 | dir=in | app=system |
"{E68B441E-E227-4002-9889-E338CC43B873}" = lport=139 | protocol=6 | dir=in | app=system |
"{EA4A1A6A-1692-4382-BD21-E5B321888826}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F5986ADE-E370-468A-A2A1-F49BCF82DEE4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F70E7B29-F3E8-46F4-B454-227D189E2243}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01282D89-E2E5-4986-B14E-876AF7749D8D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe |
"{03885CB1-9E4D-4569-B8AB-34753A987B47}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{06FB058A-547F-453D-BD48-F5FE75490271}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe |
"{09487347-A869-4F2D-8023-76A2C0300A16}" = protocol=17 | dir=in | app=c:\users\maik\appdata\roaming\icqm\icq.exe |
"{192564F4-16D7-405C-9CB0-138A443D262A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{192FB264-5019-46B7-B073-E5B114193964}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2CC43C79-B592-42C9-831B-FC82CF7FDBA7}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{2D413E25-415E-4BB8-8DD0-7D33510A97F1}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{3BF79CEA-DB81-497F-9762-882C402CFA4B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3C15E41A-CC8F-4354-A0DA-E8DE3E605C17}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3D50E2D3-5CE4-412F-9623-C1587880ACB4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{407E8FCD-0F3C-4C6C-8F2B-C4BCEE763587}" = protocol=6 | dir=in | app=d:\spiele\steam.exe |
"{446568FD-8AF3-4E50-A268-729F4F306F4D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{58FAAB59-F008-45E4-9420-0822F6819A21}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\supercratebox\supercratebox.exe |
"{59DBF52B-4879-412A-8F75-91360D285615}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6BADBB58-51FD-4372-8060-4693BB166A7A}" = protocol=17 | dir=in | app=c:\users\maik\appdata\roaming\spotify\spotify.exe |
"{6C152F16-74AF-45FE-A7B9-807290C371A4}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe |
"{6C289F26-B85C-4EA3-8999-8E257E1B3C26}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{71A1716B-FB73-4479-A2A9-D24C2C35B22C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{79A33A20-308B-4B99-812E-70F15FE2E326}" = protocol=6 | dir=in | app=c:\users\maik\appdata\roaming\icqm\icq.exe |
"{79D89AD0-B47B-415B-87B1-DF58F9DBFA1A}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe |
"{7D1AF74C-E930-421C-A697-0AE16DBF20F1}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7E7AD7CD-621E-4A4A-BD5C-D409838EC66B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8235BEE9-AC03-4B43-B08B-65D7585BEBD5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8ADCDF32-DB5C-4D3F-9C62-9A008DC6D7A1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{8EB9FD2E-5240-4EC8-8A22-31190712571A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{900FB68B-FA83-4E94-8180-34077736AECE}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{93DFD0CC-AB0D-4EC1-807F-35BC7AD60B40}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe |
"{9620A4FF-9928-48F8-8617-A63848FE7C06}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe |
"{97B66603-3C6A-4F47-B3F2-6C4FE3C7CE4D}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{9BA3D49B-4F27-450B-97C3-ABD2D780BCDC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9FCE6212-670A-4F00-9E58-A6924C36D2D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A501462D-02B9-417A-8629-6B05E976BA6C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{ABC765A9-6834-4FD3-8AEE-87BC966D3B1E}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{AD23376E-EC0C-46AE-A2B4-A51BC72A8B2D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe |
"{AF71D93D-9352-4125-9707-6C9A6D20CD2A}" = protocol=17 | dir=in | app=d:\spiele\steam.exe |
"{BA93198E-9CD4-43ED-9FC4-CB424BC6EE89}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C2DA3C5D-FD33-4286-BF99-CA3DA265B490}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C5CD81AC-7218-42CE-A8B8-7276BCC143D8}" = protocol=6 | dir=out | app=system |
"{CEA5AEBC-251F-4E43-8456-E349C57DC484}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe |
"{CF16A286-6E63-4459-9464-C296F87117AC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{E326C7A0-7A45-4EF7-9723-DD4AEE471962}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DDB0EE-AF9E-4832-A5FE-383EC79AB291}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\supercratebox\supercratebox.exe |
"{FF205234-CAB4-41B3-BB01-63838135E08E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FF54BBA4-7CBF-4991-84D5-36ABD7228621}" = protocol=6 | dir=in | app=c:\users\maik\appdata\roaming\spotify\spotify.exe |
"TCP Query User{C3F59FA3-0415-4F5E-B50C-29CDBFF5038D}C:\users\maik\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\maik\appdata\roaming\spotify\spotify.exe |
"UDP Query User{943448CD-CC32-4A8D-9A9F-0DC207702C09}C:\users\maik\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\maik\appdata\roaming\spotify\spotify.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{042B10AA-8233-A9E0-4DEB-B7253C686DBB}" = AMD Fuel
"{0DCAB5DD-CC69-271A-CF03-F2BD6B60BD8A}" = AMD Media Foundation Decoders
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1AFC919D-751B-A5D7-B17D-7C0067A65D2E}" = AMD Drag and Drop Transcoding
"{338CE2A1-7BD6-AC18-0069-4A90F7C3D836}" = AMD Steady Video Plug-In
"{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}" = AMD Catalyst Install Manager
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{504184A2-1B0E-5D93-603A-517E93E7EDB3}" = AMD Accelerated Video Transcoding
"{57580625-C673-7FEA-8791-E84B7AAF5069}" = ccc-utility64
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{6965A8D2-465D-4F98-9FAA-0E9E2348F329}" = Microsoft LifeCam
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"GIMP-2_is1" = GIMP 2.8.2
"Logitech Gaming Software" = Logitech Gaming Software 8.40
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0F7A6FD0-87F5-FB5D-973C-CF604DE1BC6B}" = CCC Help Polish
"{1A9BE3D6-4D53-2C9D-B77D-562D85936B91}" = CCC Help Norwegian
"{207E9B74-F4D3-4FD7-8142-16FF41825BC4}_is1" = Secure Banking Version 1.5.1
"{210DFA65-F805-1A2B-4F83-8E27279AE385}" = Catalyst Control Center Graphics Previews Common
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{29822CAD-C76A-0BEE-55F5-AAA524DA814F}" = CCC Help Greek
"{3A1293DF-7D09-BB0F-9576-EC47EE4A9362}" = CCC Help Italian
"{47416F0B-6589-591E-C6F8-4235D2230B14}" = Catalyst Control Center InstallProxy
"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
"{625FC7D1-656D-1BEC-F86F-3EACAFDAA8FE}" = CCC Help English
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7351EEF8-9D6C-5F46-5A19-F2C7456CE132}" = CCC Help German
"{7F172E34-4107-8964-6AEA-5051FFD265FF}" = CCC Help Portuguese
"{86095E92-1959-8364-920E-82E81F64F8FB}" = AMD VISION Engine Control Center
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89D05F35-933A-89C0-B935-C92BEE4229BD}" = CCC Help French
"{959E4378-CCA1-E4E4-2425-793DA92E8D95}" = CCC Help Czech
"{96BB3C67-4EB4-9757-E0C2-C0D2FE9053B1}" = CCC Help Turkish
"{974F4B73-2017-E174-9070-3F58F01B341F}" = CCC Help Danish
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98E20A18-3C29-86FA-50B4-918C2B34A082}" = CCC Help Hungarian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9BE6533D-DFBE-40B8-9722-F32B63A9ABEA}" = S4 League_EU
"{9E2E5EB3-DC6E-9277-E9DB-13175E7DDA39}" = CCC Help Dutch
"{AAACC0A5-4382-04D0-C75E-0669C7B949B6}" = CCC Help Japanese
"{ACEF4078-9B86-2455-E18D-34D52D37D9D5}" = CCC Help Chinese Standard
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B55FB422-B803-11F5-5582-B3666EA1B9AC}" = Catalyst Control Center Localization All
"{B8010864-15F8-613B-20EF-AC35B14B3E0D}" = CCC Help Russian
"{C1342411-5A98-DE8A-5629-D0C518E1C280}" = CCC Help Finnish
"{C7AF3B4F-F959-49AE-A845-8199AC8A32F1}" = S4 League_EU
"{D08B4177-5160-6B66-8934-2F9012134D61}" = CCC Help Thai
"{D34A6029-FB1A-9EA8-A938-5393F82A3A00}" = CCC Help Korean
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3A09D13-4D40-3CF8-7D32-8BD55F8D1533}" = CCC Help Spanish
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2C35491-9323-3AE7-6023-6B4128045153}" = CCC Help Swedish
"{FC66A32F-1A57-AC5C-4F12-DAC2F4CB77A0}" = CCC Help Chinese Traditional
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Afterburner" = MSI Afterburner 2.1.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"HyperCam 3" = HyperCam 3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"ManyCam" = ManyCam 3.1.41
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Revo Uninstaller" = Revo Uninstaller 1.94
"Steam App 212800" = Super Crate Box
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Google Chrome" = Google Chrome
"ICQ" = ICQ 8.0 (build 5977, für aktuellen Benutzer)
"Spotify" = Spotify
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 11.02.2013 12:33:24 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 11.02.2013 16:38:07 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.02.2013 11:14:50 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.02.2013 14:51:23 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 02:00:13 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 08:19:30 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 09:50:57 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 11:05:50 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 13.02.2013 12:24:24 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
Error - 14.02.2013 07:14:30 | Computer Name = Maik-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 13.02.2013 08:17:40 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 08:17:49 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 09:49:06 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 09:49:15 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 11:04:04 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 11:04:11 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 12:22:33 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.02.2013 12:22:42 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.02.2013 07:12:39 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.02.2013 07:12:48 | Computer Name = Maik-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
< End of report >
Zitat:
Zitat:
Geändert von Barney' (14.02.2013 um 12:58 Uhr) |
|
15.02.2013, 12:07
| #4 |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus? Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen. Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen. Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte. 1. Schritt Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
MOD - [2013.02.14 12:12:44 | 000,120,832 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM35D5.tmp
MOD - [2013.02.14 12:12:43 | 000,057,344 | ---- | M] () -- C:\Users\Maik\AppData\Local\Temp\XTMP1MC3VE\DEM3287.tmp
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
[2013.01.29 01:09:28 | 000,356,520 | ---- | C] (Ask.com) -- C:\Users\Maik\Documents\ApnStub.exe
:Files
C:\Users\Maik\AppData\Local\Temp\*.tmp
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\Maik\*.tmp
C:\Users\Maik\AppData\Local\Temp\*.exe
C:\Users\Maik\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! 2. Schritt Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers danach: 3. Schritt Downloade Dir bitte  AdwCleaner auf deinen Desktop.
|
|
15.02.2013, 13:17
| #5 |
| | Unbekannte Datei auf USB-Stick - Virus? Ich habe doch schon viele Logs gepostet?  |
|
15.02.2013, 13:27
| #6 |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus? Bitte unterlasse es meine Anweisungen mitzuzitieren.
__________________ --> Unbekannte Datei auf USB-Stick - Virus? |
|
15.02.2013, 13:50
| #7 | |
| | Unbekannte Datei auf USB-Stick - Virus?Zitat:
Aber ich habe doch bereits die Logs gepostet von insgesamt 3 Programmen? :S |
|
16.02.2013, 01:00
| #8 | |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus? Naja, ich dachte du wolltest auch sichergehen, dass auf deinem Rechner keine Keylogger laufen. Alles klar. Die Datei ist Malware: MD5: e2f2d22be0289b38300cb8cd75f2fe65 SHA1: ae8f31a0080245c0cea0ed75a39bb31a879105d9 Detect: 25 / 46 Trojan.Generic.8703407 (MicroWorld-eScan) Trojan.Generic.8703407 (nProtect) Artemis!E2F2D22BE028 (McAfee) Backdoor (K7AntiVirus) Trojan/Bublik.tal (TheHacker) Trojan.Win32.DarkKomet.bctqen (NANO-Antivirus) WS.Reputation.1 (Symantec) TROJ_GEN.RFFCDLV (TrendMicro-HouseCall) Trojan.Win32.Inject.faax (Kaspersky) Trojan.Generic.8703407 (BitDefender) Trojan.Generic.8703407 (F-Secure) BackDoor.Poison.686 (DrWeb) Trojan.Win32.Generic!BT (VIPRE) BDS/Fynloski.A.8181 (AntiVir) TROJ_GEN.RFFCDLV (TrendMicro) Artemis!E2F2D22BE028 (McAfee-GW-Edition) Trojan/Win32.Chifrax.gen (Antiy-AVL) Backdoor:Win32/Fynloski.A (Microsoft) Trojan.Generic.8703407 (GData) W32/GenBl.E2F2D22B!Olympus (Commtouch) a variant of Win32/Injector.Autoit.DR (ESET-NOD32) Trojan.Win32.Llac (Ikarus) W32/DarkKomet.CK!tr.bdr (Fortinet) Crypt_c.XUI (AVG) Trj/CI.A (Panda) Der Angreifer kann folgendes mit deinem PC machen: Zitat:
|
|
16.02.2013, 10:07
| #9 | ||
| | Unbekannte Datei auf USB-Stick - Virus? Verbreitet der Virus sich auf andere PCs im Netzwerk und/oder auf Datenträger, die man einsteckt/einlegt? Und lässt er sich mit einem Formatieren einfach so entfernen bzw. ist er schon weg von meinem PC? Hier ndoch noch die Logs vom adwcleaner: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.112 - Datei am 16/02/2013 um 10:10:16 erstellt
# Aktualisiert am 10/02/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Maik - MAIK-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Maik\Downloads\adwcleaner_2.112.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gefunden : C:\END
Ordner Gefunden : C:\Program Files (x86)\Ask.com
Ordner Gefunden : C:\ProgramData\Ask
Ordner Gefunden : C:\Users\Maik\AppData\Local\APN
Ordner Gefunden : C:\Users\Maik\AppData\Local\Temp\AskSearch
Ordner Gefunden : C:\Users\Maik\AppData\LocalLow\AskToolbar
Ordner Gefunden : C:\Users\Maik\AppData\Roaming\Mozilla\Firefox\Profiles\zw3ks7kf.default\extensions\toolbar@ask.com
Ordner Gefunden : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\APN
Schlüssel Gefunden : HKCU\Software\APN PIP
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gefunden : HKCU\Software\Ask.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\APN
Schlüssel Gefunden : HKLM\Software\AskToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gefunden : HKLM\Software\PIP
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16464
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v18.0.1 (de)
Datei : C:\Users\Maik\AppData\Roaming\Mozilla\Firefox\Profiles\zw3ks7kf.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v24.0.1312.57
Datei : C:\Users\Maik\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [4300 octets] - [16/02/2013 10:10:16]
########## EOF - C:\AdwCleaner[R1].txt - [4360 octets] ##########
und die vom Malwarebytes AntiRootkit: Zitat:
Zitat:
MfG Geändert von Barney' (16.02.2013 um 10:20 Uhr) |
|
16.02.2013, 20:56
| #10 |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus? Sehr gut!  Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). danach: ESET Online Scanner
danach: Downloade Dir bitte  SecurityCheck und:
|
|
16.02.2013, 22:57
| #11 | |
| | Unbekannte Datei auf USB-Stick - Virus? Erst mal vom aswMBR: Zitat:
Und wie sieht das jetzt aus: 1. Ist der Virus weg? :S 2. hat sich der Virus bzw. kann sich der Virus im Netzwerk verbreiten? MfG |
|
18.02.2013, 02:14
| #12 |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus? Wo sind denn die anderen beiden Logfiles? |
|
18.02.2013, 12:59
| #13 | ||
| | Unbekannte Datei auf USB-Stick - Virus? Die postete ich erstmal noch nicht, weil mein PC abstürzte und ich dachte, es könne vielleicht mit einem der Programme zusammenhängen.. Ich werde sie hier gleich posten.. ESET: Zitat:
Zitat:
Können sich Viren, wie ich ihn hatte, im Netzwerk verbreiten? Also kannst du/können Sie sicher sagen, ob oder ob nicht? MfG Geändert von Barney' (18.02.2013 um 13:57 Uhr) |
|
18.02.2013, 18:55
| #14 | |
| /// Helfer-Team | Unbekannte Datei auf USB-Stick - Virus?Zitat:
Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html http://www.trojaner-board.de/109844-...ren-seite.html PC wird immer langsamer - was tun? |
|
18.02.2013, 19:53
| #15 |
| | Unbekannte Datei auf USB-Stick - Virus? Vielen vielen Dank für deine Geduld und deine sehr schnelle und ausführliche Hilfe! |
|
| Themen zu Unbekannte Datei auf USB-Stick - Virus? |
| antivir, arbeitsplatz, avira, avira antivir, blöd, cleaner, datei, dateien, formatieren, forum, gesendet, infiziert, keylogger, kopieren, leer, meldung, namen, netzwerk, nichts, ordner, rechtsklick, schule, unbekannte, virus, virus? |
Linear-Darstellung
