2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht

Tklr · 21.04.2013, 15:58

Hallo zusammen ich hatte bereits vor kurzer Zeit einen Virus und der wurde bereinigt soweit man mir dies Mitgeteilt hat hier den Link dazu :http://www.trojaner-board.de/133800-...t-warnung.html
Nun habe ich Heute meine Antivirensoftware laufen lassen und da tauchten 9 Viren auf, die bereinigt wurden !Jedoch konnte meine Antivirensoftware nicht alle Dateien öffnen. Gleichzeitig funktioniert der IE nicht. Ich kann zwar die URL eingeben, aber wenn ich dann Enter Drücke geschieht einfach nichts. Wenn ich IE als Admin starte geht's einwandfrei. Wenn ich im Interner Herumsurfe erscheint auch manchmal die Sicherheitswarnung, dass ich eine sichere Seite ansehe oder so ähnlich.Dies habe ich jedoch abgeschaltet (Haken bei nicht mehr Anzeigen)Da ich jedoch bezweifle, dass der Rechner Trojaner-frei ist, da nicht alle Dateien im Scan geöffnet wurden, wende ich mich an euch. Hier der Logfile :

Code:

ATTFilter

Ergebnis: 9 Malware gefunden
JS:Trojan.JS.Iframe.DH (Virus) •C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YHJ82F0C\header[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YHJ82F0C\menschen[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TUR51UWL\spanien[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\K2GHX90G\uebermich[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JVXYQTN6\ausruestung[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E1TIR82M\main[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DDCN55AT\florian[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BW65WXR6\florian2[1].htm Aktion: unter Quarantäne 
•C:\Users\David\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3ZC6PHPK\wolfgang-andre_net[1].htm Aktion: unter Quarantäne

Die Dateien, die nicht geöffnet werden konnten:

Code:

ATTFilter

Aktionen: •Desinfiziert: 0 
•Umbenannt: 0 
•Gelöscht: 0 
•In Quarantäne: 9 
•Fehlgeschl.: 0 
 Boot-Sektoren: •Gescannt: 3 
•Infiziert: 0 
•Verdächtige Elemente: 0 
•Desinfiziert: 0 
 Dateien, nicht gescannt: •Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\HIBERFIL.SYS 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\PAGEFILE.SYS 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\TASKS\GOOGLEUPDATETASKMACHINEUA.JOB 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\TASKS\GOOGLEUPDATETASKMACHINECORE.JOB 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\SYSTEM32\SYSPREP\PANTHER\IE\DIAGERR.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\SYSTEM32\SYSPREP\PANTHER\DIAGERR.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\SYSTEM32\SYSPREP\PANTHER\DIAGWRN.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\SYSTEM32\SYSPREP\PANTHER\IE\DIAGWRN.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\PLA\SYSTEM\SYSTEM PERFORMANCE.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\PLA\SYSTEM\SYSTEM DIAGNOSTICS.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\PANTHER\UNATTENDGC\DIAGERR.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\WINDOWS\PANTHER\UNATTENDGC\DIAGWRN.XML 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\USERS\PUBLIC\DESKTOP\DESKTOP.INI 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\USERS\DAVID\APPDATA\LOCAL\MICROSOFT\WINDOWS\WEBCACHE\WEBCACHEV01.TMP 
•Datei (Klicken Sie hier, um weitere Informationen zu erhalten) kann nicht geöffnet werden C:\PROGRAMDATA\MICROSOFT\WLSETUP\CABLOGS\LOGS.CAB

Was Mir bei den Trojanernamen aufgefallen ist, ist dass sie eine grosse Gemeinsamkeit mit diesem Fall hier haben : http://www.trojaner-board.de/132736-...-homepage.html sein Name ist Wolfgang und er hat auch Florian erwähnt. Da ich auch auf seine Seite gegangen bin (Blöd von mir), liegt es vielleicht daran.
Hier noch der OTL Logfile, der Extra-Logfile wurde irgendwie nicht erstellt.:

Code:

ATTFilter

OTL logfile created on: 21.04.2013 13:48:04 - Run 4
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\David\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
15.96 Gb Total Physical Memory | 13.83 Gb Available Physical Memory | 86.66% Memory free
31.91 Gb Paging File | 29.55 Gb Available in Paging File | 92.59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 212.34 Gb Total Space | 58.55 Gb Free Space | 27.57% Space Free | Partition Type: NTFS
Drive D: | 1863.01 Gb Total Space | 994.97 Gb Free Space | 53.41% Space Free | Partition Type: NTFS
Drive E: | 538.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: DAVID-PC | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.04.20 19:52:32 | 001,019,960 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\fssm32.exe
PRC - [2013.04.20 19:52:32 | 000,622,648 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\FSGK32.EXE
PRC - [2013.04.16 14:58:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
PRC - [2013.03.29 21:53:56 | 001,631,144 | ---- | M] (Valve Corporation) -- D:\Games\Steam\Steam.exe
PRC - [2013.03.29 21:53:56 | 000,543,656 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2013.03.24 00:32:33 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.12.27 17:05:10 | 000,169,464 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
PRC - [2012.12.07 19:27:50 | 000,167,424 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2012.11.26 13:49:10 | 000,183,864 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\fshoster32.exe
PRC - [2012.10.26 17:17:52 | 000,087,368 | ---- | M] (Nero AG) -- C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
PRC - [2012.10.18 18:44:00 | 000,310,992 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSM32.EXE
PRC - [2012.10.18 18:44:00 | 000,208,592 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSMA32.EXE
PRC - [2012.10.02 13:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.08.06 14:53:14 | 000,061,176 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe
PRC - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.02.22 04:26:24 | 003,325,952 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
PRC - [2012.01.21 01:29:28 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2012.01.21 01:29:26 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2012.01.20 20:45:40 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
PRC - [2012.01.04 21:59:50 | 000,291,608 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
PRC - [2011.11.30 05:04:56 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.11.30 05:04:54 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.10.22 02:00:00 | 002,105,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.03.29 21:53:56 | 001,114,024 | ---- | M] () -- D:\Games\Steam\bin\chromehtml.dll
MOD - [2013.03.27 02:16:40 | 020,341,672 | ---- | M] () -- D:\Games\Steam\bin\libcef.dll
MOD - [2013.03.26 00:23:34 | 000,651,776 | ---- | M] () -- D:\Games\Steam\SDL2.dll
MOD - [2013.02.14 21:47:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013.01.10 18:21:30 | 000,487,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\7ffdaee3a54ffd1a5e3b008a5bde5ecf\IAStorUtil.ni.dll
MOD - [2013.01.10 18:21:30 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\389a1832a3da11e1b409cd6ae60cb9fa\IAStorCommon.ni.dll
MOD - [2013.01.10 17:37:54 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 17:37:36 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 17:37:29 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.10 17:37:26 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 17:37:24 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.10 17:37:23 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 17:37:19 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.12.27 17:05:10 | 000,169,464 | ---- | M] () -- C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
MOD - [2012.12.11 19:51:10 | 001,100,800 | ---- | M] () -- D:\Games\Steam\bin\avcodec-53.dll
MOD - [2012.12.11 19:51:10 | 000,192,000 | ---- | M] () -- D:\Games\Steam\bin\avformat-53.dll
MOD - [2012.12.11 19:51:10 | 000,124,416 | ---- | M] () -- D:\Games\Steam\bin\avutil-51.dll
MOD - [2012.12.06 18:41:55 | 000,593,464 | ---- | M] () -- C:\Windows\winsxs\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll
MOD - [2012.10.18 18:43:52 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\FSGUI\strres.eng
MOD - [2012.10.18 18:43:52 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\FSGUI\fsavures.eng
MOD - [2012.02.22 04:26:24 | 003,325,952 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
MOD - [2012.02.20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.02.07 05:20:13 | 002,413,568 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
MOD - [2011.08.10 07:43:19 | 000,118,272 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll
MOD - [2011.04.12 09:14:04 | 000,063,488 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
MOD - [2011.04.11 14:53:46 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2011.03.21 13:33:17 | 000,999,424 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
MOD - [2011.01.09 14:45:55 | 000,088,064 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
MOD - [2010.12.02 11:56:52 | 000,815,104 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.01 14:16:00 | 000,062,976 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
MOD - [2010.09.20 08:18:57 | 000,085,504 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
MOD - [2010.09.20 08:18:54 | 000,054,272 | ---- | M] () -- C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.03.29 21:53:56 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.03.24 00:32:33 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2013.01.08 13:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.07 19:27:50 | 000,167,424 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012.11.26 13:49:10 | 000,183,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\Internet Security\fshoster32.exe -- (fshoster)
SRV - [2012.10.26 17:17:52 | 000,087,368 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe -- (HTCMonitorService)
SRV - [2012.10.18 18:44:00 | 000,208,592 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSMA32.EXE -- (FSMA)
SRV - [2012.10.02 13:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.08.06 14:53:14 | 000,061,176 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe -- (FSORSPClient)
SRV - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe -- (BBUpdate)
SRV - [2012.06.11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe -- (BBSvc)
SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.01.21 01:29:28 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2012.01.21 01:29:26 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2012.01.20 20:45:40 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
SRV - [2011.11.30 05:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2013.04.20 20:02:28 | 000,200,760 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper)
DRV - [2013.04.20 19:52:32 | 000,062,744 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\HIPS\drivers\fshs.sys -- (F-Secure HIPS)
DRV - [2013.04.20 19:49:26 | 000,042,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\drivers\fsbts.sys -- (fsbts)
DRV - [2013.01.30 13:07:50 | 000,071,680 | ---- | M] (F-Secure Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Internet Security\apps\CCF_Scanning\fsni64.sys -- (fsni)
DRV - [2012.10.18 18:43:44 | 000,014,032 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys -- (fsvista)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1000\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://wiki-de.guildwars2.com/wiki/Hauptseite
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 67 93 05 E2 39 CD 01  [binary data]
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\..\SearchScopes,DefaultScope = {656EEDB6-144F-4032-AD21-5E56E62BD89A}
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\..\SearchScopes\{656EEDB6-144F-4032-AD21-5E56E62BD89A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}&rlz=
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 37.72.0.152:8080
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.3: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2013.04.17 17:58:14 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [F-Secure Hoster (45119)] C:\Program Files (x86)\Internet Security\fshoster32.exe (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001..\Run: [OscarEditor] C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe ()
O4 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001..\Run: [Steam] D:\Games\Steam\steam.exe (Valve Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1668196811-2101089870-2358843871-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0D64ED55-9009-44CC-92C1-CD6C5FF38594}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71AA843D-E2C0-44D9-916C-5D910665E580}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.09.14 16:14:39 | 000,000,235 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2007.09.27 14:35:00 | 001,049,616 | R--- | M] (Microsoft Corporation) - E:\autorun.exe -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.04.20 19:47:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Internet Security
[2013.04.20 19:45:40 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure
[2013.04.20 19:38:00 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure uninstallationtool
[2013.04.20 19:24:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2013.04.20 19:24:20 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2013.04.20 19:10:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.04.19 16:41:38 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.04.19 16:40:55 | 000,000,000 | ---D | C] -- C:\JRT
[2013.04.18 16:02:04 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2013.04.17 17:56:50 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.04.17 17:51:01 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.04.16 16:13:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.04.16 16:12:32 | 000,000,000 | ---D | C] -- C:\Users\David\Desktop\mbar-1.05.0.1001
[2013.04.16 14:58:45 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2013.04.16 14:34:05 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\David\Desktop\HiJackThis204.exe
[2013.04.05 19:34:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Age of Empires 3
[2013.04.04 20:09:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Games
[2013.04.04 18:39:37 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Games for Windows - LIVE Demos
[2013.04.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft
[2013.04.04 18:12:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows - LIVE
[2013.04.04 18:12:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
[2013.04.04 18:10:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zuxxez
[2013.03.26 21:01:38 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Criterion Games
[2013.03.26 18:57:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need for Speed™ Most Wanted
[2013.03.23 23:27:09 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\PunkBuster
[2013.03.23 23:27:08 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Battlefield 3
[2013.03.23 18:38:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins
[2013.03.23 18:36:45 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2013.03.23 18:17:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3
[2013.03.23 01:21:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.03.23 01:21:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.04.21 13:20:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.21 10:14:07 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.21 10:13:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.04.21 10:13:57 | 4259,778,558 | -HS- | M] () -- C:\hiberfil.sys
[2013.04.20 20:11:05 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.04.20 19:49:26 | 000,042,672 | ---- | M] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2013.04.20 19:49:20 | 000,019,653 | ---- | M] () -- C:\Windows\prodsett_copy.ini
[2013.04.20 19:47:06 | 000,002,043 | ---- | M] () -- C:\Users\Public\Desktop\Launch Pad.lnk
[2013.04.20 17:56:29 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.04.20 17:56:29 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.04.16 14:58:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2013.04.16 14:53:22 | 000,000,000 | ---- | M] () -- C:\Users\David\defogger_reenable
[2013.04.16 14:34:06 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\David\Desktop\HiJackThis204.exe
[2013.04.04 20:17:31 | 000,000,510 | ---- | M] () -- C:\Users\David\Desktop\Age of Empires III - Verknüpfung.lnk
[2013.04.04 19:34:02 | 000,000,136 | ---- | M] () -- C:\Users\David\Desktop\Battle vs. Chess - Verknüpfung.lnk
[2013.04.04 15:15:58 | 000,000,205 | ---- | M] () -- C:\Users\David\Desktop\Portal 2.url
[2013.03.26 18:57:22 | 000,001,305 | ---- | M] () -- C:\Users\Public\Desktop\Need for Speed™ Most Wanted.lnk
[2013.03.24 12:20:17 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.03.24 00:32:33 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.03.23 18:17:12 | 000,001,174 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2013.03.23 01:21:24 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.04.20 20:11:05 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.04.20 19:49:26 | 000,042,672 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2013.04.20 19:47:06 | 000,002,043 | ---- | C] () -- C:\Users\Public\Desktop\Launch Pad.lnk
[2013.04.16 14:53:22 | 000,000,000 | ---- | C] () -- C:\Users\David\defogger_reenable
[2013.04.04 20:17:31 | 000,000,510 | ---- | C] () -- C:\Users\David\Desktop\Age of Empires III - Verknüpfung.lnk
[2013.04.04 19:34:02 | 000,000,136 | ---- | C] () -- C:\Users\David\Desktop\Battle vs. Chess - Verknüpfung.lnk
[2013.04.04 14:58:07 | 000,000,205 | ---- | C] () -- C:\Users\David\Desktop\Portal 2.url
[2013.03.26 18:57:22 | 000,001,305 | ---- | C] () -- C:\Users\Public\Desktop\Need for Speed™ Most Wanted.lnk
[2013.03.23 23:27:12 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.03.23 18:17:12 | 000,001,174 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk
[2012.12.06 18:52:56 | 000,019,653 | ---- | C] () -- C:\Windows\prodsett_copy.ini
[2012.08.15 18:35:18 | 000,000,859 | ---- | C] () -- C:\Users\David\AppData\Local\recently-used.xbel
[2012.06.01 17:10:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
[2012.05.30 21:18:07 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.05.30 21:18:07 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.05.25 18:19:50 | 000,000,528 | ---- | C] () -- C:\Windows\eReg.dat
[2012.05.24 21:07:46 | 005,831,758 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.04.27 00:13:13 | 000,056,788 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2012.04.27 00:12:23 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2012.04.27 00:12:18 | 000,040,227 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2012.01.11 05:39:16 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.03 23:58:11 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\.minecraft
[2012.12.25 01:45:55 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\HTC
[2012.12.25 01:45:55 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\HTC Sync
[2013.01.24 19:37:13 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Origin
[2012.08.16 21:06:12 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PhotoScape
[2012.05.30 21:18:04 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PunkBuster
[2012.06.07 18:20:01 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\SecondLife
[2013.04.21 13:07:24 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TS3Client
[2012.05.31 18:30:11 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Ubisoft
[2012.12.25 03:42:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Windows Live Writer
[2012.12.25 13:04:45 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WindSolutions
 
========== Purity Check ==========
 
 

< End of report >

Malwarebytes Scan:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.04.21.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16540
David :: DAVID-PC [administrator]

21.04.2013 13:56:19
mbar-log-2013-04-21 (13-56-19).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 30478
Time elapsed: 2 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus · 24.04.2013, 13:59

Du hast doch schon Hilfe von t'john! => http://www.trojaner-board.de/133998-...-dh-virus.html

24.04.2013, 13:59	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	2x \| Trojaner aufm Rechner und Internet Explorer funktioniert nicht Du hast doch schon Hilfe von t'john! => http://www.trojaner-board.de/133998-...-dh-virus.html __________________ __________________

2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht

Mülltonne: 2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht

2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht

2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht

Ähnliche Themen: 2x | Trojaner aufm Rechner und Internet Explorer funktioniert nicht