| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: T-Online Virus/Wurm durch mms E-MailWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
14.02.2013, 13:02
| #1 |
| |  T-Online Virus/Wurm durch mms E-Mail Hallo ihr Lieben, habe leider folgendes Problem: Von "t-online" kam eine E-Mail mit einer MMS als zip-Datei, ein Kollege hatte diese geöffnet und wie zu erwarten versteckte sich dahinter keine MMS sondern ein Virus oder Wurm. Der PC wurde mehrfach neugestartet, damit dürfte die Malware schon ins System eingedrungen sein...Eine Virensuche mit dem installierten Virenprogramm brachte keinen Erfolg, Antivir lies sich nicht installieren (Windows Update wird ausgeführt) Ich nehme an, dass die Malware die Installation verhindert... Ich möchte den Pc nur äußerst ungern komplett formatieren und neu aufsetzen, da wichtige Programme und Daten darauf sind und hoffe nun auf euere Hilfe. Eine Log Datei mit OTL habe ich schon gemacht, folgend die Auswertung. Ich danke euch schonmal im Voraus für euere Unterstützung.  OTL Logfile:Code:
ATTFilter OTL logfile created on: 14.02.2013 11:34:53 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1015,43 Mb Total Physical Memory | 224,45 Mb Available Physical Memory | 22,10% Memory free 2,39 Gb Paging File | 1,73 Gb Available in Paging File | 72,57% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37,26 Gb Total Space | 17,17 Gb Free Space | 46,09% Space Free | Partition Type: NTFS Drive D: | 173,39 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive N: | 136,22 Gb Total Space | 25,31 Gb Free Space | 18,58% Space Free | Partition Type: NTFS Drive S: | 136,22 Gb Total Space | 46,21 Gb Free Space | 33,92% Space Free | Partition Type: NTFS Drive Z: | 136,22 Gb Total Space | 46,21 Gb Free Space | 33,92% Space Free | Partition Type: NTFS Computer Name: WSW00 | User Name: bernhard | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.14 11:33:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Eigene Dateien\Downloads\OTL.exe PRC - [2013.02.06 10:36:59 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.12.14 16:49:28 | 000,824,232 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe PRC - [2012.09.17 11:41:54 | 000,254,896 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2011.11.24 14:24:20 | 000,131,584 | ---- | M] (Infomedia Ltd) -- C:\Programme\Infomedia\Infomedia DMSi\InfomediaDMSi.exe PRC - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe PRC - [2010.01.05 17:25:48 | 000,348,672 | ---- | M] (Tobit.Software) -- C:\Programme\Tobit.ViProtect\TAVFDSrv.exe PRC - [2009.12.17 11:15:13 | 000,977,672 | ---- | M] (Tobit.Software) -- C:\Programme\Tobit.ViProtect\TAVfD.exe PRC - [2009.10.22 19:07:00 | 000,070,728 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe PRC - [2009.10.22 19:07:00 | 000,066,896 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe PRC - [2009.10.22 19:07:00 | 000,021,256 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe PRC - [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.12.27 18:27:52 | 001,228,800 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\hardcopy\hardcopy.exe PRC - [2005.06.23 19:33:00 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe PRC - [2003.11.19 15:47:08 | 002,588,761 | ---- | M] (Alcatel) -- C:\Programme\Deutsche_Telekom\Octopus_CTI\aocphone.exe PRC - [2003.11.19 15:29:20 | 000,172,032 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\vmbserver.exe PRC - [2003.07.30 09:08:58 | 000,143,360 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMTray.exe PRC - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe ========== Modules (No Company Name) ========== MOD - [2013.02.06 10:36:58 | 003,023,256 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2013.01.09 03:49:43 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\96b7a0136e9e72e8f4eb0230c20766d2\System.Configuration.ni.dll MOD - [2013.01.09 03:48:16 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\cbee94ec6a0fe649e3b4643cea6e1259\Accessibility.ni.dll MOD - [2013.01.09 03:46:40 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll MOD - [2013.01.09 03:46:29 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\4c91371e83d124ecb39664613e7e0417\System.Windows.Forms.ni.dll MOD - [2013.01.09 03:46:01 | 001,593,856 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7782f356a838c403b4a8e9c80df5a577\System.Drawing.ni.dll MOD - [2013.01.09 03:45:27 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\8462c03b4f10c4624feb95790d6d1e30\System.Data.ni.dll MOD - [2013.01.09 03:43:24 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll MOD - [2013.01.09 03:43:10 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll MOD - [2013.01.09 03:41:05 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2012.08.16 11:16:54 | 009,465,032 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll MOD - [2011.03.21 10:49:38 | 000,315,392 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2011.03.21 10:49:32 | 000,430,080 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe MOD - [2010.05.03 10:58:51 | 006,502,912 | ---- | M] () -- C:\WINDOWS\TOBITCLT.DLL MOD - [2009.08.10 08:07:46 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\ssp7ml3.dll MOD - [2008.05.17 10:22:04 | 000,208,896 | ---- | M] () -- C:\Programme\Infomedia\Infomedia DMSi\Janus.Windows.Common.v3.dll MOD - [2008.05.17 10:20:52 | 000,221,184 | ---- | M] () -- C:\Programme\Infomedia\Infomedia DMSi\Janus.Data.v3.dll MOD - [2008.04.14 03:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll MOD - [2007.01.20 20:07:32 | 000,032,768 | ---- | M] () -- C:\Programme\Ematek\MetaWeb\MetaBHO.dll MOD - [2006.12.22 12:09:54 | 000,434,176 | ---- | M] () -- C:\hardcopy\HcDllS.dll MOD - [2006.12.21 10:44:56 | 000,065,536 | ---- | M] () -- C:\hardcopy\HcDLL2_J_Win32.dll MOD - [2006.07.20 16:06:24 | 000,086,016 | ---- | M] () -- C:\WINDOWS\system32\IMGMSGMO.dll MOD - [2004.09.08 12:45:58 | 000,368,128 | ---- | M] () -- C:\Programme\Filzip\fzshext.dll MOD - [2003.11.20 12:18:06 | 000,045,056 | ---- | M] () -- C:\hardcopy\hardcopy.dll MOD - [2003.11.19 15:32:40 | 000,040,960 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\aocmapi.dll MOD - [2003.11.19 15:31:20 | 000,077,824 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\vmb_watchdog.dll MOD - [2003.11.19 15:30:04 | 000,040,960 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\audibit.dll MOD - [2003.11.19 15:29:20 | 000,172,032 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\vmbserver.exe MOD - [2003.11.19 15:29:00 | 000,143,360 | ---- | M] () -- C:\Programme\Deutsche_Telekom\Octopus_CTI\VMBAPI.dll ========== Services (SafeList) ========== SRV - [2013.02.06 10:36:58 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2010.01.05 17:25:48 | 000,348,672 | ---- | M] (Tobit.Software) [Auto | Running] -- C:\Programme\Tobit.ViProtect\TAVFDSrv.exe -- (TAVFDService) SRV - [2009.10.22 19:07:00 | 000,146,448 | ---- | M] (McAfee, Inc.) [Auto | Start_Pending] -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe -- (Mcshield) SRV - [2009.10.22 19:07:00 | 000,070,728 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp) SRV - [2009.10.22 19:07:00 | 000,066,896 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager) SRV - [2009.10.22 19:07:00 | 000,021,256 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe -- (McAfeeEngineService) SRV - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2013.02.14 11:24:56 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2009.10.22 19:07:00 | 000,343,664 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009.10.22 19:07:00 | 000,091,672 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009.10.22 19:07:00 | 000,065,448 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet) DRV - [2009.10.22 19:07:00 | 000,063,728 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik) DRV - [2006.10.25 09:34:44 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt) DRV - [2006.04.04 22:20:00 | 000,009,344 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK) DRV - [2005.07.28 07:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (hardlock) DRV - [2005.07.20 17:08:28 | 000,100,096 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aksusb.sys -- (aksusb) DRV - [2005.07.20 17:08:26 | 000,327,808 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshasp.sys -- (akshasp) DRV - [2004.11.16 14:46:38 | 000,190,592 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2004.08.03 17:29:50 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wVchNTxx.sys -- (iAimFP4) DRV - [2004.08.03 17:29:48 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wSiINTxx.sys -- (iAimFP3) DRV - [2004.08.03 17:29:46 | 000,025,471 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV10nt.sys -- (iAimTV5) DRV - [2004.08.03 17:29:46 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wCh7xxNT.sys -- (iAimTV4) DRV - [2004.08.03 17:29:46 | 000,022,271 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV06nt.sys -- (iAimTV6) DRV - [2004.08.03 17:29:44 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV04nt.sys -- (iAimTV3) DRV - [2004.08.03 17:29:44 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV02NT.sys -- (iAimTV1) DRV - [2004.08.03 17:29:42 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV01nt.sys -- (iAimTV0) DRV - [2004.08.03 17:29:42 | 000,011,871 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV09NT.sys -- (iAimFP7) DRV - [2004.08.03 17:29:40 | 000,011,807 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV07nt.sys -- (iAimFP5) DRV - [2004.08.03 17:29:40 | 000,011,295 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV08NT.sys -- (iAimFP6) DRV - [2004.08.03 17:29:38 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x) DRV - [2004.08.03 17:29:38 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV01nt.sys -- (iAimFP0) DRV - [2004.08.03 17:29:38 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV02NT.sys -- (iAimFP1) DRV - [2004.08.03 17:29:38 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV05NT.sys -- (iAimFP2) DRV - [2004.02.04 11:34:16 | 000,051,584 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp) DRV - [2002.04.04 07:32:06 | 000,028,416 | R--- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\symmpi.sys -- (Symmpi) DRV - [1998.03.03 12:55:58 | 000,040,480 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mgnt.sys -- (MicroGuard) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hp.com IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hp.com IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hp.com IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hp.com IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\SOFTWARE\Microsoft\Internet Explorer\Main,Default Font Size = 01 00 00 00 [binary data] IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-792417951-1796162981-618671499-1013\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@macromedia.com/FlashPlayer8: File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@macromedia.com/FlashPlayer8: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.05.31 08:05:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.02.06 10:36:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.02.06 10:36:48 | 000,000,000 | ---D | M] [2009.03.24 11:31:40 | 000,000,000 | ---D | M] (No name found) -- C:\Anwendungsdaten\Mozilla\Extensions [2013.02.14 09:40:02 | 000,000,000 | ---D | M] (No name found) -- C:\Anwendungsdaten\Mozilla\Firefox\Profiles\fusm5qcw.default-1356620211927\extensions [2013.02.14 09:40:02 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Anwendungsdaten\Mozilla\Firefox\Profiles\fusm5qcw.default-1356620211927\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2013.02.06 10:36:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.02.06 10:36:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.02.06 10:36:59 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2004.11.04 10:15:00 | 000,073,789 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\npjwp.dll [2012.07.03 13:36:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 08:37:18 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.07.03 13:36:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.07.03 13:36:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.03 13:36:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.03 13:36:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2013.02.14 10:58:26 | 000,000,822 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (CGMFragment Class) - {0695F52A-89A2-4246-81B5-AFAD2D3B865F} - C:\Programme\Ematek\MetaWeb\MetaBHO.dll () O2 - BHO: (WebCGMHlprObj Class) - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll (CGM Open Consortium, Inc.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O2 - BHO: (sname) - {F68F0B92-59F4-40DF-A61B-60A04A1B00D7} - Reg Error: Value error. File not found O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKU\S-1-5-21-792417951-1796162981-618671499-1013\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation) O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Tobit AntiVirus for Desktops] C:\Programme\Tobit.ViProtect\TAVfD.exe (Tobit.Software) O4 - HKU\S-1-5-21-792417951-1796162981-618671499-1013..\Run: [{0D6C8D54-F3A1-CA09-18B4-F0A0B48DB465}] C:\Anwendungsdaten\Itzi\omutaf.exe () O4 - HKU\S-1-5-21-792417951-1796162981-618671499-1013..\Run: [KB00892515.exe] C:\Anwendungsdaten\KB00892515.exe (Exiland Software) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\CARLO Schnittstellen Version Checker.lnk = \\De1456n2\carlo\WSVersionChecker.exe (HP Mid-market Solutions GmbH) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Infomedia DMSi.lnk = C:\Programme\Infomedia\Infomedia DMSi\InfomediaDMSi.exe (Infomedia Ltd) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\SDASSIST.LNK = S:\SDII\D\D\EXE.W95\SDASSIST.exe (Deutsche Automobil Treuhand GmbH) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\T-Octopus CTI.lnk = C:\Programme\Deutsche_Telekom\Octopus_CTI\aocphone.exe (Alcatel) O4 - Startup: C:\Dokumente und Einstellungen\bernhard\Startmenü\Programme\Autostart\Hardcopy.LNK = C:\hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 32483 = C:\DOKUME~1\ALLUSE~1\LOCALS~1\Temp\msmucrft.com () O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-792417951-1796162981-618671499-1013\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O15 - HKU\S-1-5-21-792417951-1796162981-618671499-1013\..Trusted Domains: gm.com ([intouch.rit] https in Trusted sites) O16 - DPF: {02564A7C-B8FB-4323-BCCD-E213676AC746} hxxp://gwms.kiacdn.com/cab/xProPrint.CAB (xPrint Control) O16 - DPF: {1A000B1F-B285-4FBF-B3CD-B50845003EBB} hxxp://edos.mobiseurope.com/EDMOS/miplatform/install/MiPlatform_Updater321.cab (CyMiInstaller321 Class) O16 - DPF: {1E81B1B9-0245-4E6F-AAA7-0BCA975F7B4C} hxxp://www.kia-hotline.com/Namo/NamoWec.cab (NamoWeCtl 6.0 for hmc-kia_ecbank) O16 - DPF: {4E8D5CC1-8CA2-4BAA-BFA8-A020E36E8AC8} file:///C:/Dokumente%20und%20Einstellungen/bernhard/Lokale%20Einstellungen/Anwendungsdaten/TOBESOFT/MiPlatform320U/Setup/Win32U_3.2/AutoInsTall.cab (AutoInsTaller Control) O16 - DPF: {55369874-02F5-47E2-A0F7-AC67E1B1866E} hxxp://www.centrodigital.de/smart/setup.ocx (InstallShield Setup Player V18) O16 - DPF: {77AB1CE3-41B3-49B5-8836-1FBC07FE452D} hxxp://www.kia-hotline.com/ocx/mlreport.cab (MLReport Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {A8104DA4-B6DB-41BD-B2C9-5CE2FE7A7F12} file:///C:/Dokumente%20und%20Einstellungen/bernhard/Lokale%20Einstellungen/Anwendungsdaten/TOBESOFT/MiPlatform320U/Setup/Win32U_3.2/MiPlatform_InstallBase320.cab (MiPlatformBase Control) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_03) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0) O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = de1456.autoconnect.de O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4C821402-6B5B-4EFC-8E5A-FC1158F0BE8B}: NameServer = 205.249.170.93 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop Components:1 () - hxxp://partner-net.int.rit.gm.com/opel/extern/partnernet.nsf/Frameset_Start_D?readForm&Login O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O27 - HKLM IFEO\userinit.exe: Debugger - File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.10.04 09:14:10 | 000,000,031 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{b23d9fbd-1d02-11e2-a043-0014c2cb5a67}\Shell - "" = AutoRun O33 - MountPoints2\{b23d9fbd-1d02-11e2-a043-0014c2cb5a67}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{b23d9fbd-1d02-11e2-a043-0014c2cb5a67}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O33 - MountPoints2\{f98e3e2d-527a-11da-9a5d-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{f98e3e2d-527a-11da-9a5d-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f98e3e2d-527a-11da-9a5d-806d6172696f}\Shell\AutoRun\command - "" = D:\LTSSystem.exe -- [2007.10.31 05:50:29 | 000,651,264 | R--- | M] (aano_soft) O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.14 11:24:56 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2013.02.14 11:23:09 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\Malwarebytes [2013.02.14 11:22:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2013.02.14 11:22:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2013.02.14 11:22:25 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2013.02.14 11:22:25 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2013.02.14 11:21:45 | 000,103,065 | ---- | C] (Exiland Software) -- C:\Anwendungsdaten\KB00892515.exe [2013.02.14 10:46:32 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\bernhard\Recent [2013.02.14 10:42:59 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF [2013.02.14 10:39:18 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro [2013.02.14 10:39:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HijackThis [2013.02.14 10:37:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner [2013.02.14 10:37:52 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2013.02.14 09:40:08 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\QuickScan [2013.02.14 09:19:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bernhard\Lokale Einstellungen\Anwendungsdaten\PCHealth [2013.02.13 09:10:29 | 000,000,000 | -H-D | C] -- C:\Anwendungsdaten\0B0AB1FB [2013.02.13 09:03:34 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\Xau [2013.02.13 09:03:34 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\Hopo [2013.02.13 09:03:21 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\Opm [2013.02.13 09:03:21 | 000,000,000 | ---D | C] -- C:\Anwendungsdaten\Itzi [2013.02.13 09:03:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Local Settings [2013.02.06 10:36:44 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2013.02.14 11:24:56 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2013.02.14 11:20:31 | 000,103,065 | ---- | M] (Exiland Software) -- C:\Anwendungsdaten\KB00892515.exe [2013.02.14 10:59:09 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini [2013.02.14 10:58:26 | 000,000,822 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2013.02.14 10:45:33 | 000,097,970 | ---- | M] () -- C:\Eigene Dateien\cc_20130214_104524.reg [2013.02.14 10:39:18 | 000,001,735 | ---- | M] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\HijackThis.lnk [2013.02.14 10:32:56 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.02.14 10:32:42 | 000,000,000 | ---- | M] () -- C:\WINDOWS\TempFile [2013.02.14 10:32:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.02.14 10:32:39 | 1064,833,024 | -HS- | M] () -- C:\hiberfil.sys [2013.02.14 10:17:55 | 000,001,137 | ---- | M] () -- C:\WINDOWS\Tobit.ini [2013.02.14 09:51:52 | 000,000,036 | ---- | M] () -- C:\Dokumente und Einstellungen\bernhard\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache [2013.02.14 08:07:56 | 000,002,475 | ---- | M] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\Carlo.lnk [2013.02.14 07:58:05 | 002,408,448 | ---- | M] () -- C:\Anwendungsdaten\fin.zup [2013.02.13 09:04:10 | 000,008,212 | ---- | M] () -- C:\WINDOWS\mfebcdata [2013.02.08 15:00:52 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan.job [2013.02.08 12:00:02 | 000,001,880 | -H-- | M] () -- C:\Eigene Dateien\Default.rdp [2013.02.07 10:09:17 | 000,025,922 | ---- | M] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\IMG-001.JPG [2013.02.06 15:35:25 | 000,000,257 | ---- | M] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\GM GlobalConnect.url ========== Files Created - No Company Name ========== [2013.02.14 10:45:27 | 000,097,970 | ---- | C] () -- C:\Eigene Dateien\cc_20130214_104524.reg [2013.02.14 10:39:18 | 000,001,735 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\HijackThis.lnk [2013.02.14 10:32:39 | 1064,833,024 | -HS- | C] () -- C:\hiberfil.sys [2013.02.14 09:51:52 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache [2013.02.13 09:04:10 | 000,008,212 | ---- | C] () -- C:\WINDOWS\mfebcdata [2013.02.07 11:10:44 | 000,025,922 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Desktop\IMG-001.JPG [2012.10.24 14:53:28 | 000,000,471 | ---- | C] () -- C:\WINDOWS\System32\NamoWec6_hmc-kia_ecbank_43619147.ini [2012.10.12 10:45:44 | 000,000,098 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.400.32.bc [2012.08.24 15:39:04 | 000,238,421 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\neu filzip datai.zip [2012.08.24 15:28:38 | 000,305,076 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\hartmann.zip [2012.08.24 15:11:27 | 004,113,318 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Hartmann Sorento 2012.zip [2012.08.24 15:09:00 | 004,113,318 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Hartmann Sorento Zip.zip [2012.08.24 15:00:56 | 000,305,076 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\.zip [2012.02.15 06:09:48 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.09.29 23:25:34 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.08.26 07:36:21 | 000,000,202 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\.dlcstate [2011.08.19 08:10:45 | 000,482,408 | ---- | C] () -- C:\WINDOWS\ssndii.exe [2011.08.19 08:10:08 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssp7ml3.dll [2011.08.05 09:16:24 | 000,004,608 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.01.12 08:49:32 | 002,408,448 | ---- | C] () -- C:\Anwendungsdaten\fin.zup [2009.11.18 07:28:44 | 000,002,412 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol [2007.06.04 14:29:55 | 000,090,004 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\ssfile.png [2005.11.11 15:29:44 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\bernhard\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat ========== ZeroAccess Check ========== [2005.11.03 19:34:28 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2011.06.21 19:18:34 | 001,510,400 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.03.22 08:41:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\T-Octopus CTI [2013.02.14 09:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Tobit [2006.10.25 09:42:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.DE1456\Anwendungsdaten\T-Octopus CTI [2012.03.20 23:16:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.WSW00\Anwendungsdaten\T-Octopus CTI [2011.12.15 08:54:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask [2007.06.27 14:00:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FRISK Software [2011.08.25 14:54:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MCADMIN [2012.12.11 13:32:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung [2011.03.22 16:46:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Snap-On Business Solutions [2010.06.10 17:22:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tobit [2012.06.13 14:22:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bernhard\Anwendungsdaten\Infomedia [2006.01.26 14:25:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\bernhard\Anwendungsdaten\T-Octopus CTI [2010.10.06 08:15:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\karl\Anwendungsdaten\T-Octopus CTI [2010.10.04 16:56:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\karl\Anwendungsdaten\Tobit [2007.04.10 12:23:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\thomas\Anwendungsdaten\T-Octopus CTI ========== Purity Check ========== < End of report > achja, die Datei hieß wohl nach dem entpacken "Sybol" oder so ähnlich...genaueres kann ich nicht sagen, da die Mail und Datei bereits gelöscht wurden... |
| Themen zu T-Online Virus/Wurm durch mms E-Mail |
| adobe, alcatel, antivir, antivirus, defender, downloader, e-mail, einstellungen, error, firefox, hewlett packard, hijack, homepage, installation, logfile, malware, mozilla, neu aufsetzen, object, photoshop, plug-in, problem, programm, refresh, registry, scan, security, system, thomas, virus, windows |
Baum-Darstellung