| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Computer mit Trojanern voll, Partition verschwunden, dunkler BildschirmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.02.2013, 19:56
| #46 |
 |  Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, vielen Dank für den Hinweis. Ich dachte, der Hinweis gehört noch zum Programm Combofix. Da stand der Hinweis ja auch drunter. Na, ist doch kein Problem, nach dem Neustart konnte ich OTL wieder starten. Hier die Datei: OTL Logfile: Code:
ATTFilter OTL logfile created on: 26.02.2013 18:28:10 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bille\Documents\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 45,97% Memory free 4,24 Gb Paging File | 2,86 Gb Available in Paging File | 67,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 236,31 Gb Total Space | 20,25 Gb Free Space | 8,57% Space Free | Partition Type: NTFS Drive D: | 931,28 Gb Total Space | 181,73 Gb Free Space | 19,51% Space Free | Partition Type: FAT32 Drive E: | 2,96 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Drive Z: | 19,99 Gb Total Space | 9,42 Gb Free Space | 47,14% Space Free | Partition Type: FAT32 Computer Name: BILLE-PC | User Name: Bille | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.02.17 22:57:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bille\Documents\Desktop\OTL.exe PRC - [2013.02.16 15:14:21 | 003,089,320 | ---- | M] (Emsisoft GmbH) -- C:\Programme\Emsisoft Anti-Malware\a2service.exe PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.02.16 12:49:28 | 002,310,544 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Programme\CodeMeter\Runtime\bin\CodeMeter.exe PRC - [2011.01.26 23:55:54 | 000,393,216 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2011.01.26 23:55:24 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Programme\Common Files\MAGIX Services\Database_146bec2\bin\FABS.exe PRC - [2009.04.11 07:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2007.04.13 18:14:28 | 000,016,384 | ---- | M] (Empolis GmbH) -- C:\Programme\Medion\MEDIONbox\Program\GCS.exe PRC - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe ========== Modules (No Company Name) ========== MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.01.26 23:11:58 | 000,023,040 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll ========== Services (SafeList) ========== SRV - [2013.02.16 15:14:21 | 003,089,320 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Programme\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware) SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.02.16 12:49:28 | 002,310,544 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Programme\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe) SRV - [2011.01.26 23:55:24 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2010.01.09 20:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2010.01.09 20:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Running] -- C:\Program Files\Common Files\MAGIX Services\Database_146bec2\bin\FABS.exe -- (Fabs) SRV - [2008.11.04 00:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\Common Files\MAGIX Services\Database_146bec2\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Stopped] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService) SRV - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\NETFWDSL.SYS -- (NETFWDSL) DRV - File not found [File_System | On_Demand | Stopped] -- C:\Windows\system32\drivers\mbam.sys -- (MBAMProtector) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2013.02.23 21:31:42 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.04.30 18:45:28 | 000,054,072 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\Programme\Emsisoft Anti-Malware\a2accx86.sys -- (a2acc) DRV - [2012.04.30 18:45:00 | 000,037,856 | ---- | M] (Emsisoft GmbH) [File_System | System | Running] -- C:\Programme\Emsisoft Anti-Malware\a2dix86.sys -- (a2injectiondriver) DRV - [2011.12.19 01:12:06 | 000,697,328 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2011.05.19 14:10:34 | 000,017,904 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Programme\Emsisoft Anti-Malware\a2ddax86.sys -- (A2DDA) DRV - [2011.01.27 00:36:14 | 007,566,848 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2011.01.26 23:13:10 | 000,238,592 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2010.11.17 13:04:12 | 000,097,296 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService) DRV - [2010.05.05 09:40:32 | 000,011,776 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Programme\Emsisoft Anti-Malware\a2util32.sys -- (a2util) DRV - [2010.04.03 21:55:32 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.11.19 13:32:02 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl) DRV - [2008.01.09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri) DRV - [2008.01.08 08:17:08 | 001,302,368 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\3xHybrid.sys -- (3xHybrid) DRV - [2007.12.10 14:22:22 | 000,110,120 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017unic.sys -- (s3017unic) DRV - [2007.12.10 14:22:22 | 000,100,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017obex.sys -- (s3017obex) DRV - [2007.12.10 14:22:20 | 000,104,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017mgmt.sys -- (s3017mgmt) DRV - [2007.12.10 14:22:20 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017nd5.sys -- (s3017nd5) DRV - [2007.12.10 14:22:18 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017mdm.sys -- (s3017mdm) DRV - [2007.12.10 14:22:18 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017mdfl.sys -- (s3017mdfl) DRV - [2007.12.10 14:22:14 | 000,083,880 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s3017bus.sys -- (s3017bus) DRV - [2007.11.18 02:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD) DRV - [2007.10.31 11:23:20 | 000,115,744 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32) DRV - [2007.09.21 10:38:22 | 000,554,496 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u) DRV - [2007.07.07 14:13:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) DRV - [2006.11.30 15:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF) DRV - [2006.11.17 10:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.focus.de/ IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes,DefaultScope = {CDE97567-36EB-4070-AAE2-54FEF0C2AC45} IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes\{C311C248-D7DE-4619-BBA2-271264ECF7E9}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3241949 IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes\{CDE97567-36EB-4070-AAE2-54FEF0C2AC45}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA_de IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Bille\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks) FF - HKCU\Software\MozillaPlugins\@www.flatcast.com/FlatViewer 5.2: C:\Windows\DOWNLO~1\NpFv522.dll () FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.14 12:40:52 | 000,000,000 | ---D | M] [2011.04.21 21:40:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bille\AppData\Roaming\mozilla\Extensions [2009.12.20 23:30:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bille\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.04.21 21:40:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bille\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de O1 HOSTS File: ([2013.02.26 14:32:21 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (YouTubeAnywhere) - {8015C430-448C-4003-A969-274F7F0F2D9C} - C:\Users\Bille\AppData\LocalLow\YouTubeAnywhere\IE\YouTubeAnywhere.dll (Diego Casorran) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O3 - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_265_ActiveX.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - Reg Error: Key error. File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office2010.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {3DF6983D-D415-4AE5-8106-43987731DAA5} hxxp://shop.aldi-fotoservice-druck.de/shop/activex/aldi_nord_express_upload.cab (AldiActiveFormX Element) O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game12.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player) O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class) O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} https://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab (IPSUploader4 Control) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {D8AA889B-2C65-47C3-8C16-3DCD4EF76A47} hxxp://rms2.invokesolutions.com/events/bin/6.2.0.1450/MILive.cab (Reg Error: Key error.) O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F560} hxxp://download.flatcast.net/objects/NpFv522.dll (Flatcast Viewer 5.2) O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{00A3DA5D-A255-433F-B7F2-AAFE2114A660}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{07A61B71-A20C-4746-B4CF-C06B9B0AABE0}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\haufereader - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img10.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img10.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.02.26 14:51:18 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.02.26 13:41:33 | 000,000,000 | ---D | C] -- C:\ComboFix [2013.02.26 13:37:00 | 005,034,894 | R--- | C] (Swearware) -- C:\Users\Bille\Documents\Desktop\ComboFix.exe [2013.02.25 23:07:11 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.02.25 23:07:10 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.02.25 23:07:10 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.02.25 23:00:37 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.02.25 22:59:16 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.02.22 01:02:56 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Canneverbe Limited [2013.02.22 01:02:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited [2013.02.22 01:02:35 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP [2013.02.22 01:00:57 | 005,232,040 | ---- | C] (Canneverbe Limited ) -- C:\Users\Bille\Documents\Desktop\cdbxp_setup_4.5.0.3717.exe [2013.02.22 00:59:32 | 000,000,000 | ---D | C] -- C:\Users\Bille\Documents\Desktop\pmagic_2013_01_29 [2013.02.19 23:01:32 | 005,156,352 | ---- | C] (Geza Kovacs) -- C:\Users\Bille\Documents\Desktop\unetbootin-windows-583.exe [2013.02.19 13:32:04 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Bille\Documents\Desktop\aswMBR.exe [2013.02.19 13:28:21 | 001,752,992 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Bille\Documents\Desktop\rkill.com [2013.02.18 21:27:25 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Bille\Documents\Desktop\tdsskiller.exe [2013.02.17 22:57:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Bille\Documents\Desktop\OTL.exe [2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Penou [2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Nyvu [2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Ciuze [2013.02.16 15:07:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware [2013.02.16 09:13:34 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware [2013.02.16 09:13:34 | 000,000,000 | ---D | C] -- C:\Users\Bille\Documents\Anti-Malware [2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Xatah [2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Unfiho [2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Oqky [2013.02.11 20:45:36 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch [2013.02.09 20:54:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2013.02.09 20:54:28 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2 [2013.02.03 18:16:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.02.03 18:16:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010.02.22 01:38:14 | 000,250,544 | ---- | C] (KeyWorks Software) -- C:\Program Files\Common Files\keyhelp.ocx [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.02.26 18:25:24 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl [2013.02.26 18:25:21 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.26 18:25:17 | 000,000,314 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2013.02.26 18:25:04 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.26 18:25:04 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.26 18:24:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.26 17:49:01 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.26 14:32:21 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2013.02.26 13:37:09 | 005,034,894 | R--- | M] (Swearware) -- C:\Users\Bille\Documents\Desktop\ComboFix.exe [2013.02.25 23:54:50 | 355,320,348 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.02.25 22:55:34 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.02.25 22:55:34 | 000,604,364 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.02.25 22:55:34 | 000,130,700 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.02.25 22:55:34 | 000,107,800 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.02.25 22:32:35 | 000,594,019 | ---- | M] () -- C:\Users\Bille\Documents\Desktop\adwcleaner.exe [2013.02.23 22:46:36 | 000,007,962 | ---- | M] () -- C:\Users\Bille\AppData\Roaming\wklnhst.dat [2013.02.23 21:31:42 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2013.02.22 01:02:40 | 000,001,740 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2013.02.22 01:00:57 | 005,232,040 | ---- | M] (Canneverbe Limited ) -- C:\Users\Bille\Documents\Desktop\cdbxp_setup_4.5.0.3717.exe [2013.02.20 22:51:31 | 312,475,648 | ---- | M] () -- C:\Users\Bille\Documents\Desktop\pmagic_2013_01_29.iso [2013.02.19 23:01:46 | 005,156,352 | ---- | M] (Geza Kovacs) -- C:\Users\Bille\Documents\Desktop\unetbootin-windows-583.exe [2013.02.19 13:33:16 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Bille\Documents\Desktop\aswMBR.exe [2013.02.19 13:28:21 | 001,752,992 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Bille\Documents\Desktop\rkill.com [2013.02.18 21:27:32 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Bille\Documents\Desktop\tdsskiller.exe [2013.02.17 22:57:59 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bille\Documents\Desktop\OTL.exe [2013.02.17 20:22:27 | 000,374,784 | ---- | M] () -- C:\Users\Bille\Documents\Desktop\GMER_2.1.18952.exe [2013.02.16 20:58:51 | 000,585,408 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.02.16 15:07:50 | 000,000,904 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2013.02.11 14:32:00 | 000,000,160 | ---- | M] () -- C:\ProgramData\-WnoFQbjneGr [2013.02.11 14:32:00 | 000,000,152 | ---- | M] () -- C:\ProgramData\-WnoFQbjneG [2013.02.02 11:55:25 | 000,055,808 | ---- | M] () -- C:\Users\Bille\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013.01.29 09:52:37 | 000,000,668 | ---- | M] () -- C:\Users\Bille\Documents\Desktop\mkgriso [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.02.25 23:07:11 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.02.25 23:07:11 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.02.25 23:07:10 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.02.25 23:07:10 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.02.25 23:07:10 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.02.25 22:32:35 | 000,594,019 | ---- | C] () -- C:\Users\Bille\Documents\Desktop\adwcleaner.exe [2013.02.22 01:02:40 | 000,001,740 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2013.02.22 01:02:40 | 000,001,690 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2013.02.20 22:52:38 | 000,000,668 | ---- | C] () -- C:\Users\Bille\Documents\Desktop\mkgriso [2013.02.20 22:48:12 | 312,475,648 | ---- | C] () -- C:\Users\Bille\Documents\Desktop\pmagic_2013_01_29.iso [2013.02.17 20:22:27 | 000,374,784 | ---- | C] () -- C:\Users\Bille\Documents\Desktop\GMER_2.1.18952.exe [2013.02.17 16:08:36 | 355,320,348 | ---- | C] () -- C:\Windows\MEMORY.DMP [2013.02.16 15:07:50 | 000,000,904 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2013.02.11 11:34:56 | 000,000,160 | ---- | C] () -- C:\ProgramData\-WnoFQbjneGr [2013.02.11 11:34:56 | 000,000,152 | ---- | C] () -- C:\ProgramData\-WnoFQbjneG [2012.10.31 20:26:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.08.16 22:36:37 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll [2012.05.30 22:16:07 | 000,002,277 | ---- | C] () -- C:\Users\Bille\.recently-used.xbel [2012.02.09 20:04:53 | 000,000,569 | ---- | C] () -- C:\Windows\wiso.ini [2011.10.17 15:59:41 | 000,003,113 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2011.05.26 22:12:09 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat [2011.02.10 14:38:57 | 000,008,296 | ---- | C] () -- C:\Users\Bille\AppData\Local\d3d9caps.dat [2010.12.03 20:55:29 | 000,019,456 | ---- | C] () -- C:\Users\Bille\AppData\Local\WebpageIcons.db [2010.10.24 19:58:27 | 000,034,901 | ---- | C] () -- C:\ProgramData\nvModes.001 [2010.10.24 19:58:26 | 000,034,901 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.10.02 07:20:47 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2008.11.22 23:33:15 | 000,047,148 | ---- | C] () -- C:\Users\Bille\AppData\Roaming\mdbu.bin [2008.07.10 11:36:34 | 000,000,052 | ---- | C] () -- C:\Users\Bille\AppData\Roaming\Default.PLS [2008.04.01 12:58:16 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.03.05 21:53:19 | 000,055,808 | ---- | C] () -- C:\Users\Bille\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.03.04 23:16:10 | 000,007,962 | ---- | C] () -- C:\Users\Bille\AppData\Roaming\wklnhst.dat [2008.02.07 14:06:59 | 000,000,093 | ---- | C] () -- C:\Users\Bille\AppData\Local\fusioncache.dat ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2010.12.17 21:00:30 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Amazon [2011.12.19 01:12:07 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\AquaSoft [2011.04.03 22:49:45 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Artweaver [2009.11.01 18:39:34 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\baywotch3 [2011.06.19 23:10:24 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Beurteilung [2012.02.09 20:04:59 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Buhl Data Service [2013.02.22 01:02:56 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Canneverbe Limited [2013.02.07 21:54:09 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Canon [2008.07.25 13:41:10 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\CD-LabelPrint [2011.05.01 20:39:53 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Cherry [2013.02.19 17:45:53 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Ciuze [2012.09.19 22:52:29 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Cornelsen [2009.10.27 21:42:18 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\CoSoSys [2011.10.21 19:18:51 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\dpdhl.versandhelfer [2012.09.23 22:34:46 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\DVDVideoSoft [2008.11.16 17:08:20 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\FileZilla [2012.12.20 22:18:07 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\FontExplorerX [2010.02.11 22:21:44 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\FRITZ! [2012.06.30 00:15:59 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Garmin [2012.09.30 20:48:47 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\GlarySoft [2012.05.02 06:51:12 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\gtk-2.0 [2011.02.02 23:08:20 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\HaCon [2008.10.15 23:06:32 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Haufe [2011.04.21 21:40:25 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Haufe Mediengruppe [2012.08.03 18:18:31 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\ICQ [2011.04.29 08:16:16 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\IN-MEDIAKG [2011.05.27 22:37:56 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\IrfanView [2009.01.19 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Lexware [2011.12.23 22:36:50 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\MAGIX [2010.02.22 00:57:46 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\MatchWare [2008.11.16 13:52:14 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\mirabyte [2011.04.28 23:51:03 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\mresreg [2013.01.06 13:43:42 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Notepad++ [2008.04.09 21:41:04 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Nvu [2013.02.19 18:26:36 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Nyvu [2010.02.18 22:04:42 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\OpenOffice.org [2010.02.28 11:00:22 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Opera [2013.02.14 23:39:22 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Oqky [2013.02.16 15:46:33 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Penou [2010.05.29 14:23:37 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\phonostar GmbH [2008.11.03 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\PixelPlanet [2009.07.07 10:14:54 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\PlayFirst [2011.12.10 22:19:52 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Rainlendar [2008.03.04 23:16:27 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Template [2009.12.20 23:30:46 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Thunderbird [2010.10.05 22:21:15 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\translateclient [2011.08.27 19:23:21 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\TuneUp Software [2008.03.05 00:24:01 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Ulead Systems [2013.02.16 12:05:11 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Unfiho [2013.02.16 10:24:40 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Xatah [2009.07.06 09:11:33 | 000,000,000 | ---D | M] -- C:\Users\Bille\AppData\Roaming\Zylom ========== Purity Check ========== < End of report > Viele Grüße Garfield2704 Hallo Leo, ich habe etwas vergessen: Ich habe eine Vollversion von Emsisoft (gültig 1 Jahr). Viele Grüße Garfield2704 |
|
26.02.2013, 21:47
| #47 |
| /// TB-Ausbilder   | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo,
__________________hmm, mal schauen, ob diese beiden Tools, die zuvor gestreikt haben, jetzt laufen. (Bitte die aswmbr.exe und tdsskiller.exe vom Desktop löschen und dann neu herunterladen.) Schritt 1
Code:
ATTFilter :OTL
[2013.02.11 11:34:56 | 000,000,160 | ---- | C] () -- C:\ProgramData\-WnoFQbjneGr
[2013.02.11 11:34:56 | 000,000,152 | ---- | C] () -- C:\ProgramData\-WnoFQbjneG
IE - HKU\S-1-5-21-3778007921-2159278055-2083024639-1003\..\SearchScopes\{C311C248-D7DE-4619-BBA2-271264ECF7E9}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3241949
[2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Xatah
[2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Unfiho
[2013.02.14 23:39:22 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Oqky
[2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Penou
[2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Nyvu
[2013.02.16 15:46:33 | 000,000,000 | ---D | C] -- C:\Users\Bille\AppData\Roaming\Ciuze
:commands
[emptytemp]
Schritt 2 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinen Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung. Hinweis: Sollte der Scan Button ausgeblendet sein, schliesse das Tool und starte es erneut. Sollte es erneut nicht klappen, teile mir das bitte mit. Schritt 3 Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts löschen, sondern nur einen Scan-Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop.
Bitte poste in deiner nächsten Antwort:
__________________ |
|
26.02.2013, 22:17
| #48 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo,
__________________OTL Log ist hier: Code:
ATTFilter All processes killed
========== OTL ==========
C:\ProgramData\-WnoFQbjneGr moved successfully.
C:\ProgramData\-WnoFQbjneG moved successfully.
Registry key HKEY_USERS\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Microsoft\Internet Explorer\SearchScopes\{C311C248-D7DE-4619-BBA2-271264ECF7E9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C311C248-D7DE-4619-BBA2-271264ECF7E9}\ not found.
C:\Users\Bille\AppData\Roaming\Xatah folder moved successfully.
C:\Users\Bille\AppData\Roaming\Unfiho folder moved successfully.
C:\Users\Bille\AppData\Roaming\Oqky folder moved successfully.
C:\Users\Bille\AppData\Roaming\Penou folder moved successfully.
C:\Users\Bille\AppData\Roaming\Nyvu folder moved successfully.
C:\Users\Bille\AppData\Roaming\Ciuze folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Bille
->Temp folder emptied: 79926142 bytes
->Temporary Internet Files folder emptied: 328238 bytes
->Java cache emptied: 22153247 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 78611 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1330 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 98,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 02262013_215433
Files\Folders moved on Reboot...
C:\Windows\temp\JET537C.tmp moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
 Viele Grüße Garfield2704 |
|
26.02.2013, 22:19
| #49 | |
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler BildschirmZitat:
 .Kommt noch irgendeine Meldung oder passiert einfach nichts, wenn du sie öffnest? Wie läuft denn der Rechner sonst so? Bemerkst du noch irgendwelche Probleme?
__________________ cheers, Leo |
|
26.02.2013, 23:01
| #50 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, dieses Smiley wollte ich auch schon posten.Wenn ich die beiden Programme öffne, kommt ein Fenster "Benutzerkontensteuerung": Zur Fortsetzung des Programms ist Ihre Zustimmung erforderlich. Dann klicke ich auf Fortsetzen, dann verschwindet das Fenster, dann kommt der Mauszeiger - und das war es .... leider. Mein Explorer- Zeichen ist auch wieder da. Ansonsten habe ich den Computer (außer zur Reparatur) nicht benutzt, ich würde sagen, das Internet läuft wieder normal, manche Programme brauchen etwas länger beim Starten. Viele Grüße Garfield2704 |
|
26.02.2013, 23:20
| #51 | |
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo, ja das ist wirklich ein zäher Fall hier.. Zitat:
Aber wie öffnest du diese Programme? Ist es das gleiche, wenn du nicht einen Doppelklick, sondern einen Rechtsklick auf das Programm machst und dann "als Administrator ausführen" wählst..?
__________________ --> Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm |
|
27.02.2013, 00:30
| #52 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, es gibt keine dummen Fragen. ;-) Ich habe es noch einmal ausprobiert. Es ist egal, wie ich die Programme starte. Es startet immer gleich (wie oben beschrieben) Ist vielleicht auch noch wichtig: Emsisoft hat wieder einen Trojaner gemeldet. Hier die Quarantäneliste: HTML-Code: All processes killed
========== OTL ==========
C:\ProgramData\-WnoFQbjneGr moved successfully.
C:\ProgramData\-WnoFQbjneG moved successfully.
Registry key HKEY_USERS\S-1-5-21-3778007921-2159278055-2083024639-1003\Software\Microsoft\Internet Explorer\SearchScopes\{C311C248-D7DE-4619-BBA2-271264ECF7E9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C311C248-D7DE-4619-BBA2-271264ECF7E9}\ not found.
C:\Users\Bille\AppData\Roaming\Xatah folder moved successfully.
C:\Users\Bille\AppData\Roaming\Unfiho folder moved successfully.
C:\Users\Bille\AppData\Roaming\Oqky folder moved successfully.
C:\Users\Bille\AppData\Roaming\Penou folder moved successfully.
C:\Users\Bille\AppData\Roaming\Nyvu folder moved successfully.
C:\Users\Bille\AppData\Roaming\Ciuze folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Bille
->Temp folder emptied: 79926142 bytes
->Temporary Internet Files folder emptied: 328238 bytes
->Java cache emptied: 22153247 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 78611 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1330 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 98,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 02262013_215433
Files\Folders moved on Reboot...
C:\Windows\temp\JET537C.tmp moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot... Garfield2704 |
|
27.02.2013, 00:39
| #53 | |
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo, Zitat:
Aber ich glaub, du hast das alte OTL-Fixlog eingefügt anstatt der Quarantäneliste. 
__________________ cheers, Leo |
|
27.02.2013, 00:43
| #54 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, o ja, sorry, ich hatte grade zwei Fenster auf. Hier nun die richtige Liste: Code:
ATTFilter Emsisoft Anti-Malware v. 7.0.0.18 (C) 2003-2013 Emsisoft - www.emsisoft.com ID Object 0 C:\Users\Bille\AppData\Local\Temp\Temporary Internet Files\Content.IE5\HJZJOF5K\turbo411_com[1].htm Dropped:Trojan.JS.Agent.ILJ (B) 1 C:\Users\Bille\2676591.exe Gen:Variant.Graftor.Elzob.24588 (B) 2 C:\Users\Bille\4587060.exe Gen:Variant.Graftor.Elzob.24588 (B) 3 C:\Users\Bille\7128027.exe Gen:Variant.Graftor.Elzob.24588 (B) 4 C:\Users\Bille\5527051.exe Trojan.Win32.Yakes.cjmo.AMN (A) 5 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\54adc967.qua Gen:Variant.Zusy.36952 (B) 6 C:\Users\Bille\0k23f5q8eozfv.exe Trojan.Win32.Yakes.cjmo.AMN (A) 7 C:\Users\Bille\AppData\Roaming\Nyvu\quysa.exe Gen:Variant.Kazy.145409 (B) 8 C:\Users\Bille\wgsdgsdgdsgsd.exe Trojan.Win32.ZAccess (A) 9 C:\Users\Bille\awt43abr.exe Trojan.Generic.KDZ.8573 (B) 10 C:\Users\Bille\AppData\Local\Temp\7.817780274771519E8.exe Gen:Variant.Zusy.36956 (B) 11 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55bbf4e1.qua Trojan.Injector.ANT (B) 12 C:\Program Files\PDF-to-Word\demos\p2wagent.exe Trojan.Win32.PSW.PdfCracker.cx (A) 13 C:\ProgramData\2A26FEA5ABD1BE6200002A26D483C34E\2A26FEA5ABD1BE6200002A26D483C34E.ico Rogue.Win32.SystemProtection (A) 14 Value: hkey_users\s-1-5-21-3778007921-2159278055-2083024639-1003\software\gamehouse\bigislandblends -> NORMALEXIT Trace.Registry.GameFiesta Big Island Blends (A) 15 C:\Users\Bille\AppData\Local\Temp\Temporary Internet Files\Content.IE5\DX2ILFEP\turbo411_com[1].htm Dropped:Trojan.JS.Agent.ILJ (B) 16 Value: hkey_users\s-1-5-21-3778007921-2159278055-2083024639-1003\software\gamehouse\bigislandblends -> NORMALEXIT Trace.Registry.GameFiesta Big Island Blends (A) 17 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\558bdc77.qua Trojan.Sirefef.MC (B) 18 C:\$RECYCLE.BIN\S-1-5-21-3778007921-2159278055-2083024639-1003\$f44ef113dd481a83252d2572d863fd1f\U\00000001.@ Trojan.Win32.Conedex.AMN (A) 19 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4ddee15a.qua Trojan.Sirefef.MC (B) 20 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\540fd455.qua Trojan.Sirefef.MC (B) 21 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5559de07.qua Trojan.Sirefef.MC (B) 22 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4df1fa1c.qua Trojan.Sirefef.MC (B) 23 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4d0af5b8.qua Trojan.Sirefef.MC (B) 24 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4de2fb74.qua Trojan.Sirefef.MC (B) 25 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55d0dc8c.qua Trojan.Sirefef.MC (B) 26 C:\$RECYCLE.BIN\S-1-5-21-3778007921-2159278055-2083024639-1003\$f44ef113dd481a83252d2572d863fd1f\U\80000000.@ Trojan.Sirefef.RG (B) 27 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55c4d6ba.qua Trojan.Sirefef.MC (B) 28 C:\ProgramData\2A26FEA5ABD1BE6200002A26D483C34E\2A26FEA5ABD1BE6200002A26D483C34E.ico Rogue.Win32.SystemProtection (A) 29 C:\$RECYCLE.BIN\S-1-5-21-3778007921-2159278055-2083024639-1003\$f44ef113dd481a83252d2572d863fd1f\U\800000cb.@ Trojan.Sirefef.MC (B) 30 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5768fc43.qua Trojan.Script.480616 (B) 31 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55d3fe4a.qua Trojan.Script.480616 (B) 32 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55a4f973.qua Trojan.Script.480616 (B) 33 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5788ffd3.qua Trojan.Script.480616 (B) 34 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4a1def2d.qua Trojan.Sirefef.MC (B) 35 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4c89ebf7.qua Trojan.Sirefef.MC (B) 36 C:\Program Files\PDF-to-Word\demos\p2wagent.exe Trojan.Win32.PSW.PdfCracker.cx (A) 37 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\553df2c2.qua Trojan.Script.480616 (B) 38 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\54cffe19.qua Trojan.Script.480616 (B) 39 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5575d4d3.qua Trojan.Sirefef.RG (B) 40 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\559dda1f.qua Trojan.Sirefef.RG (B) 41 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4d76d6de.qua Trojan.Script.480616 (B) 42 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\54c1ff0b.qua Trojan.Script.480616 (B) 43 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5596d135.qua Trojan.Sirefef.RG (B) 44 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5442f23c.qua Trojan.Script.480616 (B) 45 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\541ade43.qua Trojan.Sirefef.RG (B) 46 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\541aca20.qua Trojan.Zbot.HYT (B) 47 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5566d5bb.qua Trojan.Sirefef.RG (B) 48 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\528ac08b.qua Trojan.Sirefef.RG (B) 49 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5425d2ba.qua Trojan.Sirefef.RG (B) 50 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5549cefd.qua Trojan.Sirefef.RG (B) 51 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5540df9f.qua Trojan.Sirefef.RG (B) 52 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\55f8c81d.qua Trojan.Generic.KDV.859530 (B) 53 C:\ProgramData\Avira\AntiVir Desktop\INFECTED\541ec450.qua Trojan.Sirefef.RG (B) 54 C:\Users\Bille\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\7268ce85-7e7b7044 Exploit.JAVA.CVE-2012-0507.BO (B) Garfield2704 |
|
27.02.2013, 00:49
| #55 |
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Eine richtige Sammlung...  (Ich melde mich dann morgen wieder.) Schritt 1 Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinen Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers. Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
27.02.2013, 06:47
| #56 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, hier Die Datei: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.01.0.1020
www.malwarebytes.org
Database version: v2013.02.26.11
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Bille :: BILLE-PC [administrator]
27.02.2013 01:10:52
mbar-log-2013-02-27 (01-10-52).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 29445
Time elapsed: 14 minute(s), 52 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 4
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\MBR_0_infected.mbam (Bootkit.TDL4.A.MBR) -> Delete on reboot.
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_976758544_user.mbam (Forged physical sector) -> Delete on reboot.
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_976771154_user.mbam (Forged physical sector) -> Delete on reboot.
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_976773167_user.mbam (Forged physical sector) -> Delete on reboot.
(end)
Meine angeschlossenen Festplatte (Partition D  ist immer noch "verschlüsselt".Viele Grüße Garfield2704 |
|
27.02.2013, 10:42
| #57 | |
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo, TDL4 war auch mal bei dir zu Gast.  Ich möchte nicht den Moralfinger heben, aber etwas ist hier auf deinem Computer in der Vergangenheit gewaltig schiefgelaufen. Da tauchen jede Menge unschöne Sachen auf und dass diese beiden Tools nicht laufen, ist auch noch sehr störend.. Es bleibt deine Entscheidung, wie du fortfahren willst, aber ich möchte dich darauf hinweisen, dass ein radikaler sauberer Neuanfang in so einer Situation auch eine gute Option ist. Zitat:
Hast du mit MBAR nach dem cleanup dann nochmals einen zweiten Scan gemacht und der war sauber? Versuch bitte mal noch das: Lade dir MbrScan herunter und speichere es auf den Desktop.
__________________ cheers, Leo |
|
27.02.2013, 15:35
| #58 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, musste erst einmal googeln, was TDL4 ist. Ich habe heute Nacht zweimal MBAR laufen lassen. bei zweiten Mal ist alles clean gewesen. Hier die zweite Datei: HTML-Code: Malwarebytes Anti-Rootkit BETA 1.01.0.1020 www.malwarebytes.org Database version: v2013.02.26.11 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Bille :: BILLE-PC [administrator] 27.02.2013 01:34:56 mbar-log-2013-02-27 (01-34-56).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 29481 Time elapsed: 13 minute(s), 59 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Bei der veschlüsselten Festplatte handelt es sich um die alte. Die neue, die ich erst seit Samstag habe, habe ich nach dem Sichern der Dateien wieder "abgedockt". Ich habe aber auch mal eine freudige Nachricht zu überbringen. Die beiden Programme, die vorher nicht funktioniert haben (konnten nicht gestartet werden), kann ich jetzt starten. ich habe sie noch nicht laufen lassen. Wollte erst dich fragen. Vielleicht gibt es noch Licht am Tunnel????  Viele Grüße Garfield2704 |
|
27.02.2013, 15:46
| #59 | ||
| /// TB-Ausbilder | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo, Zitat:
 Zitat:
Aber es wär sicher ein Anfang. Dann lass diese Programme bitte laufen, ich poste nochmals die Anleitungen dazu: Schritt 1 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinen Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung. Hinweis: Sollte der Scan Button ausgeblendet sein, schliesse das Tool und starte es erneut. Sollte es erneut nicht klappen, teile mir das bitte mit. Schritt 2 Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts löschen, sondern nur einen Scan-Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop.
__________________ cheers, Leo |
|
27.02.2013, 18:36
| #60 |
| | Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm Hallo Leo, hier die Logfiles: Code:
ATTFilter aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-27 17:05:03
-----------------------------
17:05:03.428 OS Version: Windows 6.0.6002 Service Pack 2
17:05:03.428 Number of processors: 2 586 0xF0B
17:05:03.429 ComputerName: BILLE-PC UserName: Bille
17:05:05.154 Initialize success
17:05:13.895 AVAST engine defs: 13022700
17:05:20.566 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000055
17:05:20.568 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 6
17:05:20.569 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000056
17:05:20.570 Disk 1 Vendor: Hitachi_ ST6O Size: 953869MB BusType: 6
17:05:20.615 Disk 0 MBR read successfully
17:05:20.616 Disk 0 MBR scan
17:05:20.651 Disk 0 Windows VISTA default MBR code
17:05:20.670 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 241979 MB offset 63
17:05:20.707 Disk 0 Partition 2 00 06 FAT16 NTFS 214476 MB offset 495572992
17:05:20.710 Disk 0 Partition - 00 0F Extended LBA 20481 MB offset 934822350
17:05:20.782 Disk 0 Partition 3 00 0B FAT32 MSDOS5.0 20481 MB offset 934822413
17:05:20.799 Disk 0 scanning sectors +976768065
17:05:20.904 Disk 0 scanning C:\Windows\system32\drivers
17:05:31.729 Service scanning
17:05:46.423 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
17:05:50.896 Modules scanning
17:06:01.753 Disk 0 trace - called modules:
17:06:01.772 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x862241f8]<<
17:06:01.775 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8705bac8]
17:06:01.777 3 CLASSPNP.SYS[895a68b3] -> nt!IofCallDriver -> [0x8627fb68]
17:06:01.779 5 acpi.sys[805be6bc] -> nt!IofCallDriver -> \Device\00000055[0x86288c90]
17:06:01.782 \Driver\nvstor32[0x86291d38] -> IRP_MJ_CREATE -> 0x862241f8
17:06:04.406 AVAST engine scan C:\Windows
17:06:10.034 AVAST engine scan C:\Windows\system32
17:08:55.253 AVAST engine scan C:\Windows\system32\drivers
17:09:07.212 AVAST engine scan C:\Users\Bille
17:39:38.805 AVAST engine scan C:\ProgramData
18:07:31.553 Scan finished successfully
18:09:27.571 Disk 0 MBR has been saved successfully to "C:\Users\Bille\Documents\Desktop\MBR.dat"
18:09:27.574 The log file has been saved successfully to "C:\Users\Bille\Documents\Desktop\aswMBR.txt"
Ich versuche es, anzuhängen..... Geht leider auch nicht, Fehlermeldung beim Zippen (habe es mit 7-zip und auch mit WinRar probiert) Viele Grüße Garfield2704 |
|
| Themen zu Computer mit Trojanern voll, Partition verschwunden, dunkler Bildschirm |
| 32 bit, bildschirm, bootkit.tdl4.a.mbr, desktop, emsisoft, fehlermeldung, festplatte, forged physical sector, freeware, heuristics.reserved.word.exploit, programm, pum.disabled.securitycenter, pum.hijack.regedit, pum.hijack.startmenu, quarantäne, rogue.systemprogressiveprotection, rootkit.0access, schwarzer bildschirm, spybot, spyware.passwords.ed, trojan.0access, trojan.agent.dd69gen, trojan.agent.gni, trojan.fakealert, trojan.lameshield, trojan.pornoasset, verschwunden |
Textbox.
Linear-Darstellung
