werde Malware nicht los z.B. HEUR/HTML.Malware [heuristic

Dr.Soap · 05.03.2010, 18:03

Guten Tag.
Ich bin neu hier und brauche dringend Hilfe weil ich befürchte das mein PC nicht mehr lange durchhällt.
Ich habe seit gestern aber ein Malware bzw. Trojaner problem.
Wie? hab auf das falsche im Internet geklickt.
Seitdem hat mir mein Antivirus Programm Avira sate 30 malware Vorfälle gemeldet, hier ein paar beispiele : HEUR/HTML.Malware [heuristic , Fundort:C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RT4RL51L\girlfriends[1].htm.
oder TR/Agent.192512 [trojan]' , Fundort : C:\Windows\System32\sshnas21.dll.

mir gelingt es sowass immer wieder fast folständig zu löschen , es taucht aber immer wieder auf.
in den Ordnern wo die Malware "versteckt " ist sind oftmals 100 Bilder von nackten frauen etc.

Wie werde ich den ganzen Dreck los? brauche dringend Hilfe, kp wie lange mein Pc noch durchhällt.
Ps. Sorry wenn ich irgendwas falsch gemacht habe. Bin neu in solchen Sachen ^^
BItte , hat keiner ne Idee?

Chris4You · 05.03.2010, 19:55

Hi,

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
Fullscan und alles bereinigen lassen! Log posten.

Dann wäre es ganz nützlich zu wissen, was für ein System Du hast...

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop
* Doppelklick auf die OTL.exe
* Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
* Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
* Unter Extra Registry, wähle bitte Use SafeList
* Klicke nun auf Run Scan links oben
* Wenn der Scan beendet wurde werden 2 Logfiles erstellt
* Poste die Logfiles hier in den Thread.

chris

Voogl · 27.03.2010, 19:02

Hallo!

Ich hab ebenso diese malware im comp. hab alles installiert, wies oben beschrieben wurde..
die 2 Dateien, die sich da angezeigt haben sind aber recht lang..

hier OTL.Txt-Editor:

OTL logfile created on: 27.03.2010 18:44:02 - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Users\didi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223,28 Gb Total Space | 110,62 Gb Free Space | 49,54% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: R189161
Current User Name: didi
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\didi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\didi\AppData\Local\Temp\Bmh.exe ()
PRC - C:\Windows\Bfegua.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\TUProgSt.exe (TuneUp Software)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Programme\sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Programme\sony\Network Utility\NSUService.exe (Sony Corporation)
PRC - C:\Programme\sony\Network Utility\LANUtil.exe (Sony Corporation)
PRC - C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
PRC - C:\Programme\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\Programme\sony\VAIO Power Management\SPMService.exe (Sony Corporation)
PRC - C:\Programme\sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Programme\sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\didi\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (TeamViewer4) -- C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (VAIO Event Service) -- C:\Program Files\sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (NSUService) -- C:\Program Files\sony\Network Utility\NSUService.exe (Sony Corporation)
SRV - (SOHDms) -- C:\Program Files\Sony\VAIO Media plus\SOHDms.exe (Sony Corporation)
SRV - (SOHDs) -- C:\Program Files\Sony\VAIO Media plus\SOHDs.exe (Sony Corporation)
SRV - (SOHCImp) -- C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe (Sony Corporation)
SRV - (RtkAudioService) -- C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
SRV - (uCamMonitor) -- C:\Programme\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (VCFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VAIO Power Management) -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV - (VcmIAlzMgr) -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SQLWriter) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (IviRegMgr) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (MSSQLServerADHelper) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (btnetBUs) -- C:\Windows\System32\drivers\btnetBus.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (risdptsk) -- C:\Windows\System32\drivers\risdptsk.sys (REDC)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (SFEP) -- C:\Windows\System32\drivers\SFEP.sys (Sony Corporation)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (ArcSoftKsUFilter) -- C:\Windows\System32\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search13.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://search13.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Programme\Celebrity Toolbar\tbhelper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://google.de"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.06.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20090123.1
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {7694c49c-9fbd-11dc-8314-0800200c9a66}:3.0.2
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"

FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.12 19:49:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.03.24 19:57:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.03.24 19:57:24 | 000,000,000 | ---D | M]

[2009.03.06 18:31:05 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Extensions
[2010.01.18 13:45:13 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions\{6236BA26-C117-4007-928C-DE0716C7FA80}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions\{6236BA26-C117-4007-928C-DE0716C7FA96}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (FBFan) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions\{6236BA26-C117-4007-928C-DE0716C7FA99}
[2010.01.18 13:45:13 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009.06.29 22:31:14 | 000,000,000 | ---D | M] (kikin plugin (JDownloader Edition)) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\2igs56zt.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.03.27 17:51:30 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{6236BA26-C117-4007-928C-DE0716C7FA80}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{6236BA26-C117-4007-928C-DE0716C7FA96}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (FBFan) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{6236BA26-C117-4007-928C-DE0716C7FA99}
[2010.01.18 13:45:15 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.03.12 10:22:19 | 000,000,000 | ---D | M] (Speed Dial) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009.06.27 23:35:00 | 000,000,000 | ---D | M] (Aquatint Black Gloss) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2009.07.09 14:02:43 | 000,000,000 | ---D | M] (tennissport Toolbar) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{95c8b433-1a1b-4425-8e7f-14b0330f560b}
[2009.06.27 23:09:21 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2009.06.29 22:30:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{a3b24d40-bac4-11dc-95ff-0800200c9a66}
[2009.06.29 22:31:14 | 000,000,000 | ---D | M] (kikin plugin (JDownloader Edition)) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2009.06.27 23:35:00 | 000,000,000 | ---D | M] (BitComet Download Helper) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009.09.27 13:32:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
[2009.06.27 23:16:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.02.07 21:46:36 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009.03.15 15:32:39 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\betterflickr@ginatrapani.org
[2009.03.15 15:02:41 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\betterlifehacker@ginatrapani.org
[2009.09.17 15:06:53 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\DivXWebPlayer@divx.com
[2009.09.18 10:27:49 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\gclips@appspot.com
[2009.03.10 15:11:19 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\greasefire@skrul.com
[2010.03.12 10:22:19 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\7hrhyag7.testprofil didi raarrr\extensions\staged-xpis
[2010.01.18 13:45:14 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{6236BA26-C117-4007-928C-DE0716C7FA80}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{6236BA26-C117-4007-928C-DE0716C7FA96}
[2010.01.06 19:47:17 | 000,000,000 | ---D | M] (FBFan) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{6236BA26-C117-4007-928C-DE0716C7FA99}
[2010.01.18 13:45:14 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009.04.28 20:55:34 | 000,000,000 | ---D | M] (Speed Dial) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009.05.31 19:55:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}
[2009.03.15 22:42:31 | 000,000,000 | ---D | M] (Aquatint Black Gloss) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2009.06.27 22:57:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2009.06.29 22:31:14 | 000,000,000 | ---D | M] (kikin plugin (JDownloader Edition)) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2009.03.15 23:12:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009.06.27 22:53:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2009.04.28 20:55:33 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009.06.27 22:57:49 | 000,000,000 | ---D | M] -- C:\Users\didi\AppData\Roaming\mozilla\Firefox\Profiles\ux96hmby.didi123\extensions\staged-xpis
[2010.02.03 19:27:59 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.02.03 19:27:59 | 000,000,000 | ---D | M] (Celebrity Toolbar) -- C:\Programme\Mozilla Firefox\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}
[2010.02.17 21:29:07 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.03.09 14:56:39 | 000,001,779 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\clipfish.xml
[2009.03.09 14:56:39 | 000,001,013 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\conrad.xml
[2009.03.09 14:56:39 | 000,002,487 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\discount24.xml
[2010.02.17 21:29:07 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.02.17 21:29:07 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.03.09 14:56:39 | 000,001,047 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\musicload.xml
[2009.03.09 14:56:39 | 000,002,120 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\myvideo.xml
[2009.03.09 14:56:39 | 000,002,023 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\otto.xml
[2009.03.09 14:56:39 | 000,000,758 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\quelle.xml
[2009.03.09 14:56:39 | 000,001,329 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\telefonbuch-de.xml
[2010.02.17 21:29:07 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.02.17 21:29:07 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
[2009.03.09 14:56:39 | 000,005,375 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yodl.xml

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (MHTBPos00 Class) - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Programme\Celebrity Toolbar\tbcore3.dll ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {751BE56D-A6B1-4901-91BA-D62033450B13} - No CLSID value found.
O2 - BHO: (no name) - {8AA217B9-D729-4ee0-AED7-E93D695E94A2} - No CLSID value found.
O2 - BHO: (GdfrDUEn Class) - {A3CF7606-E683-4375-A372-96B75DA0AEF7} - C:\Programme\Get Styles\enlbrdr.dll (TODO: <Company name>)
O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Programme\Celebrity Toolbar\tbcore3.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Programme\Celebrity Toolbar\tbcore3.dll ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [NokiaMusic FastStart] C:\Program Files\Nokia\Ovi Player\NokiaOviPlayer.exe (Nokia)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Canaveral] C:\Windows\System32\sshnas21.DLL ()
O4 - HKCU..\Run: [NSUFloatingUI] C:\Program Files\Sony\Network Utility\LANUtil.exe (Sony Corporation)
O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\didi\AppData\Local\Temp\Bmh.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin)
O9 - Extra Button: GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Programme\Get Styles\ct.htm ()
O9 - Extra 'Tools' menuitem : GetStyles - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Programme\Get Styles\ct.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = moos.swh.mhn.de
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\didi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\didi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.03.27 18:41:38 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Users\didi\Desktop\OTL.exe
[2010.03.27 18:37:52 | 000,000,000 | ---D | C] -- C:\Users\didi\AppData\Roaming\Malwarebytes
[2010.03.27 18:37:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.03.27 18:37:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.03.27 18:37:21 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.03.27 18:37:20 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.03.27 17:52:18 | 000,000,000 | ---D | C] -- C:\Users\didi\AppData\Roaming\HPAppData
[2010.03.26 19:48:20 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.03.14 00:43:30 | 000,000,000 | ---D | C] -- C:\Users\didi\Desktop\B
[2010.03.11 22:19:35 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2010.03.11 22:19:28 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2010.03.09 03:01:13 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2010.03.06 21:36:42 | 000,000,000 | ---D | C] -- C:\Users\didi\Desktop\Z
[2010.03.05 15:31:11 | 000,000,000 | ---D | C] -- C:\Users\didi\Desktop\HA StrR VÜ 2010
[1 C:\Users\didi\Desktop\*.tmp files -> C:\Users\didi\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.03.27 18:49:24 | 002,883,584 | -HS- | M] () -- C:\Users\didi\NTUSER.DAT
[2010.03.27 18:41:41 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Users\didi\Desktop\OTL.exe
[2010.03.27 18:37:43 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.03.27 18:33:02 | 000,002,379 | ---- | M] () -- C:\Users\didi\Desktop\Skype.lnk
[2010.03.27 18:32:22 | 000,000,244 | -H-- | M] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.03.27 18:32:19 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010.03.27 18:32:15 | 000,000,498 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2010.03.27 18:31:49 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.03.27 18:31:41 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.03.27 18:31:41 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.03.27 18:31:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.03.27 18:31:31 | 3079,729,152 | -HS- | M] () -- C:\hiberfil.sys
[2010.03.27 18:22:53 | 000,524,288 | -HS- | M] () -- C:\Users\didi\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.03.27 18:22:53 | 000,065,536 | -HS- | M] () -- C:\Users\didi\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.03.27 18:22:48 | 002,850,343 | -H-- | M] () -- C:\Users\didi\AppData\Local\IconCache.db
[2010.03.26 20:15:59 | 000,056,320 | ---- | M] () -- C:\Users\didi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.26 19:46:16 | 000,191,488 | ---- | M] () -- C:\Windows\Bfegua.exe
[2010.03.26 19:46:14 | 000,210,944 | ---- | M] () -- C:\Windows\System32\sshnas21.dll
[2010.03.26 18:14:11 | 000,002,631 | ---- | M] () -- C:\Users\didi\Desktop\Microsoft Office Word 2007.lnk
[2010.03.23 16:29:54 | 000,024,576 | ---- | M] () -- C:\Users\didi\Desktop\Fehde.doc
[2010.03.22 21:52:07 | 000,049,109 | ---- | M] () -- C:\Users\didi\Desktop\Loesung_PK1_HS07.pdf
[2010.03.21 15:28:24 | 230,200,489 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.03.20 12:05:26 | 001,614,352 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.03.20 12:05:26 | 000,692,064 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.03.20 12:05:26 | 000,650,538 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.03.20 12:05:26 | 000,153,150 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.03.20 12:05:26 | 000,125,554 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.03.03 23:05:12 | 000,015,060 | ---- | M] () -- C:\Users\didi\Documents\Schilder.docx
[2010.02.26 16:57:43 | 000,112,840 | ---- | M] () -- C:\Users\didi\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.02.26 16:56:08 | 000,408,912 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Users\didi\Desktop\*.tmp files -> C:\Users\didi\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.03.27 18:37:43 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.03.26 19:46:26 | 000,191,488 | ---- | C] () -- C:\Windows\Bfegua.exe
[2010.03.26 19:46:21 | 000,000,282 | -H-- | C] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010.03.26 19:46:19 | 000,000,244 | -H-- | C] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.03.26 19:46:14 | 000,210,944 | ---- | C] () -- C:\Windows\System32\sshnas21.dll
[2010.03.23 16:29:52 | 000,024,576 | ---- | C] () -- C:\Users\didi\Desktop\Fehde.doc
[2010.03.22 21:52:07 | 000,049,109 | ---- | C] () -- C:\Users\didi\Desktop\Loesung_PK1_HS07.pdf
[2010.03.03 23:00:47 | 000,015,060 | ---- | C] () -- C:\Users\didi\Documents\Schilder.docx
[2010.01.28 18:29:25 | 000,001,547 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.06.04 19:26:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.03.08 16:30:54 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.03.06 19:31:06 | 000,000,095 | ---- | C] () -- C:\Windows\winamp.ini
[2009.03.06 12:27:44 | 000,056,320 | ---- | C] () -- C:\Users\didi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.03.06 10:33:04 | 000,002,708 | ---- | C] () -- C:\Users\didi\AppData\Local\d3d9caps.dat
[2008.12.07 11:44:54 | 000,030,088 | ---- | C] () -- C:\Windows\System32\drivers\btnetBus.sys
[2008.11.28 08:54:13 | 000,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI
[2008.10.23 19:50:56 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1511.dll
[2008.10.23 19:49:43 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.10.23 19:48:24 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.04.17 09:08:56 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== Files - Unicode (All) ==========
[2010.03.08 18:04:29 | 001,421,824 | ---- | M] ()(C:\Users\didi\Documents\8-????.pps) -- C:\Users\didi\Documents\8-МАРТ.pps
[2010.03.08 18:03:28 | 001,421,824 | ---- | C] ()(C:\Users\didi\Documents\8-????.pps) -- C:\Users\didi\Documents\8-МАРТ.pps
< End of report >

und nun Extras.Txt-Editor:

OTL Extras logfile created on: 27.03.2010 18:44:02 - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Users\didi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223,28 Gb Total Space | 110,62 Gb Free Space | 49,54% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: R189161
Current User Name: didi
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with Paint Shop Pro 9] -- "C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\\Paint Shop Pro 9.exe" "/Browse" "%L" (Jasc Software, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{25D4ADB3-5A29-4325-BCE4-A53A279A3B70}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{2C8120A5-37CA-469A-817C-50717FB2CE09}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2D90EF24-0509-4D28-AE7B-BABAEF2831E2}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6C301243-791C-4549-84E3-6AF9881E719D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7D594B56-0E9C-44E2-82B3-618AFAB9E638}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{A6A13E61-D810-4AC5-91B7-4EB036372A85}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D63F397F-4E0B-4295-8376-363F9F4A9D22}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D9EA0FEE-730E-4712-87C8-297FA620C3E5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{DBEF949E-3ED6-4365-967B-617841380B08}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E3F0A6-45A6-4C9B-AC1B-D5CCC7A74C6B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{04D49CB9-B2A6-4F19-A5FD-D6432B13FFAB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{10EF48AC-EA5C-4240-936D-D28BC4275764}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{1842896A-91DF-4AEA-9DA3-D923C23DAFDC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1E4A7822-B969-4BC8-A128-E69704A69C6A}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{1F06D61F-5279-4F01-A54F-1C66599A44AC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{23516C7B-5D35-4EFA-B025-1DEF1177BA65}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{30884C1E-41F2-44D0-B27B-5D6DE12A3A94}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{39E2BA58-0C4E-462E-9A2F-134272E8616C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{5F6E76F9-D340-4F3F-9285-3E7DB9024D9B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{626BBFB9-8F5D-443B-A04A-ED91A0DE4113}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{6991433D-4551-4635-98AE-33165186CB12}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{738EFAE1-2E41-4FFF-9794-83CF725AD1A2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{7BB1F531-BE07-4493-81AC-9F38D11492B8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{8F03AF6A-A4C1-45F7-8810-4B1608FE44F3}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{9A12A507-8BB8-4726-A26A-76FB80DED49D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{9E8620D3-CA42-4A20-94D4-21374139037C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{A0D4BEC5-CED9-4979-BA01-7387297CD88F}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{A5E67FC8-BC5C-42B5-8E72-9BDADA775901}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{B39B5B2F-C1C5-48B3-B5A7-AACA61122334}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{BD7CD795-A38B-41F2-BDD1-1A20F164AA03}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{C5EC1E69-B6EF-44C6-B5F6-D9EB28140FA3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{C8E596C6-A74E-4E6C-AAFA-BEECEA175BA8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe |
"{CFB0445F-8B99-46D1-9C4F-221AE37F5F8C}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-203 |
"{D641F48D-65B0-4E0C-8681-85DCD3EC5C8D}" = protocol=58 | dir=in | app=system |
"TCP Query User{1D028E94-F157-4B31-95DE-E3B6C3E96FAA}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{5C2F19F9-0A9B-4A07-B1F7-80695B7E6779}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{61EAAB63-3B6A-4835-86CF-9FC40481104E}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{620C00F0-F462-4D54-A7A9-E1200067FDCA}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{C798679A-B2B9-463E-AFD8-DF2757A30CEF}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{CD5B033B-FF13-42CA-B147-011466DF441A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{194F86F5-E7C6-418C-9024-C0569C29E417}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{3AA2B345-8A8E-4824-90C4-DD085E7321FB}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{4BC6DF7B-1F7A-4628-93DD-2F91E4948071}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{D61D00DA-2ADD-4F5D-8954-B4CA04EABD5D}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{DDD77A61-FD0D-4E50-8DED-97D379B5A231}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{E761570F-5BE0-470B-9086-20B422D56730}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{088C7311-A3BB-43C5-B046-C114D2F9728C}" = VAIO Media plus
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{150C6C87-D187-4105-BF7A-090378D7AE2A}" = Nokia Ovi Suite
"{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}" = VAIO Launcher
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1D1D8ADC-BF08-4E61-9393-5FA305B16864}" = Microsoft SQL Server Native Client
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{2018C019-30D9-4240-8C01-0865C10DCF5A}" = Unterstützung für VAIO-Präsentation
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{23825B69-36DF-4DAD-9CFD-118D11D80F16}" = VAIO Content Folder Setting
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 17
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FA28330-2028-4033-BD10-425C87EB4D54}" = Nokia Software Updater
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{327B75F0-92AF-420A-988F-FA596A218E0B}" = VAIO Content Folder Watcher
"{3762698E-E9DF-4DD8-99F1-8192D0F8EE06}" = Nokia_Multimedia_Common_Components_2_5
"{3B659FAD-E772-44A3-B7E7-560FF084669F}" = VAIO Smart Network
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{42B74521-4706-412A-9A27-AED12B83E886}" = Nokia Ovi Application Installer
"{42E2EEB2-D48E-4A47-B181-32ECA031D93B}" = DJ_AIO_06_F2400_SW_Min
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4AE48A64-6C6A-4E5A-95FA-55F5131DECF9}" = Nokia Ovi One Touch Access
"{4C271126-C295-4828-A901-5910AE0C258B}" = Cisco Systems VPN Client 5.0.03.0530
"{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"{4EA55D20-27FB-45D7-8726-147E8A5F6C62}" = VAIO MusicBox
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Easy Media Creator 10 LJ
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}" = VAIO DVD Menu Data Basic
"{5C5EE8F2-0B38-4C13-AE4E-A87A237FE718}" =
"{5C759B74-34F4-43C6-A5D9-039CB754C5E9}" = Microsoft SQL Server VSS Writer
"{5F5867F0-2D23-4338-A206-01A76C823924}" = VAIO Energie Verwaltung
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{6442DEDF-AC2F-4CBA-85DE-42E459C5006C}" = Nokia Ovi Content Copier
"{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}" = Click to Disc
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69C8B1E3-2665-4A0F-B049-67746E5C4CE3}" = Software Info for Me&My VAIO
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BAA71B6-8F43-4C72-931A-3354ABB0258A}" = F2400
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6C50525A-2D77-4C22-B058-9AA2F27ACFF2}" = VAIO Content Metadata Intelligent Analyzing Manager
"{6D4673B7-A982-43E5-82E9-13E037681478}" = Click to Disc
"{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}" = VAIO Movie Story Template Data
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{75F52FAC-16CE-4A2A-B89A-9742F39A1864}" = VAIO Movie Story
"{76D7CCD6-8369-405C-B494-5F34FAE67249}" = Me&My VAIO
"{7BB90344-0647-468E-925A-7F69F7983421}" = ArcSoft Magic-i Visual Effects 2
"{7E823DA5-43A2-46E8-A75E-5A2A0FDE81A1}" = VAIO Content Metadata Manager Setting
"{82427977-8776-4087-90CA-9F65174D3C4D}" = Nokia Connectivity Cable Driver
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83CDA18E-0BF3-4ACA-872C-B4CDABF2360E}" = VAIO Update 4
"{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}" = VAIO Media plus
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{91F2D688-B8CB-4461-A92D-6B35279DAE8F}" = VAIO Content Folder Watcher
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{9238E8A4-BEBA-43A3-B926-769BDBF194C5}" = VAIO Media plus Opening Movie
"{96D0B6C6-5A72-4B47-8583-A87E55F5FE81}" =
"{98FC7A64-774B-49B5-B046-4B4EBC053FA9}" = VAIO MusicBox Sample Music
"{9973498D-EA29-4A68-BE0B-C88D6E03E928}" = ArcSoft WebCam Companion 2
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D6B740F-D9A2-45A6-BDC4-0A453D499FE6}" = PC Connectivity Solution
"{A2052C95-48CC-4AC9-A8D4-FCD89DDD8F2C}" = VAIO Content Folder Watcher
"{A528306A-C5EC-481C-A619-6106334E6800}" = Nokia Ovi Player
"{A63E7492-A0BC-4BB9-89A7-352965222380}" = VAIO Original Function Setting
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.1 - Deutsch
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B0B49C20-D2D1-437B-80F0-C2298F5DCD2B}" = Nokia Photos
"{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}" = VAIO Movie Story
"{B513C7B0-024A-498F-B0F5-00C67E2440A9}" = VAIO Content Metadata Intelligent Analyzing Manager
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1083DBC-C541-4E8C-91EA-D92397AB9A2C}" = OpenMG Secure Module 5.1.00
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" = VAIO Event Service
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C7CDB2AC-A0AB-4D83-B046-187E24D9EA68}" = Nokia Ovi System Utilities
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB8A8696-93EC-414E-A752-850AB133F68A}" = VAIO Content Metadata XML Interface Library
"{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}" = HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6
"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Music Transfer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D5FBA9C1-21D3-4210-A604-CF9E38238F35}" = VAIO Entertainment Platform
"{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}" = VAIO Wallpaper Contents
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{EE59BBF9-415C-45DB-8C4B-EE43CF635FEA}" = VAIO Content Metadata XML Interface Library
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{FAF26102-09D7-4C58-AB01-0D59A2E517CA}" = Copy
"{FB8148DD-C575-4B0A-9F6C-0CFC46937930}" = Opera 10.10
"{FD72E69E-CF34-4071-BFD6-FD081A365E2C}" = VAIO Content Metadata Intelligent Analyzing Manager
"{FE51662F-D8F6-43B5-99D9-D4894AF00F83}" = Roxio Easy Media Creator Home
"{FE697886-F392-4E0D-A0C0-47587BF60992}" = VAIO Content Metadata Manager Setting
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ahnenblatt_is1" = Ahnenblatt 2.60
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Celebrity Toolbar" = Celebrity Toolbar
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"dt icon module" =
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Get Styles" = Get Styles
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"InstallShield_{C1083DBC-C541-4E8C-91EA-D92397AB9A2C}" = OpenMG Secure Module 5.1.00
"kikin Plugin (JDownloader Edition)" = kikin Plugin (JDownloader Edition) 1.11
"Magentic" = Magentic
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MarketingTools" = VAIO Marketing Tools
"McLoad Preinstaller" = McLoad Preinstaller
"MFU Module" =
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MozBackup" = MozBackup 1.4.9
"Mozilla Firefox (3.6.2pre)" = Mozilla Firefox (3.6.2pre)
"Nokia Ovi Application Installer" = Nokia Ovi Application Installer 6.85.3011
"Nokia Ovi Content Copier" = Nokia Ovi Content Copier 6.85.3011
"Nokia Ovi One Touch Access" = Nokia Ovi One Touch Access 6.85.3011
"Nokia Ovi System Utilities" = Nokia Ovi System Utilities 6.85.3014
"Picasa 3" = Picasa 3
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 4" = TeamViewer 4
"VAIO Help and Support" =
"VLC media player" = VLC media player 0.9.8a
"Winamp" = Winamp (nur entfernen)
"WinRAR archiver" = WinRAR
"Yahoo! Messenger" = Yahoo! Messenger

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12.03.2010 08:29:47 | Computer Name = r189161.moos.swh.mhn.de | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
(Fehlercode = 0x80042019)

Error - 12.03.2010 08:30:31 | Computer Name = r189161.moos.swh.mhn.de | Source = WinMgmt | ID = 10
Description =

Error - 13.03.2010 05:15:36 | Computer Name = r189161.moos.swh.mhn.de | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
(Fehlercode = 0x80042019)

Error - 13.03.2010 05:15:39 | Computer Name = r189161.moos.swh.mhn.de | Source = WinMgmt | ID = 10
Description =

Error - 13.03.2010 07:32:37 | Computer Name = r189161.moos.swh.mhn.de | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
(Fehlercode = 0x80042019)

Error - 13.03.2010 07:33:14 | Computer Name = r189161.moos.swh.mhn.de | Source = WinMgmt | ID = 10
Description =

Error - 13.03.2010 08:06:03 | Computer Name = r189161.moos.swh.mhn.de | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
(Fehlercode = 0x80042019)

Error - 13.03.2010 08:06:19 | Computer Name = r189161.moos.swh.mhn.de | Source = WinMgmt | ID = 10
Description =

Error - 13.03.2010 13:49:28 | Computer Name = r189161.moos.swh.mhn.de | Source = VzCdbSvc | ID = 7
Description = Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5})
(Fehlercode = 0x80042019)

Error - 13.03.2010 13:49:39 | Computer Name = r189161.moos.swh.mhn.de | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 25.03.2010 05:22:55 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7000
Description =

Error - 25.03.2010 05:22:55 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7026
Description =

Error - 26.03.2010 14:52:26 | Computer Name = r189161.moos.swh.mhn.de | Source = DCOM | ID = 10010
Description =

Error - 27.03.2010 05:17:47 | Computer Name = r189161.moos.swh.mhn.de | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =

Error - 27.03.2010 05:18:22 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7000
Description =

Error - 27.03.2010 05:18:22 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7026
Description =

Error - 27.03.2010 13:22:44 | Computer Name = r189161.moos.swh.mhn.de | Source = DCOM | ID = 10010
Description =

Error - 27.03.2010 13:31:49 | Computer Name = r189161.moos.swh.mhn.de | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =

Error - 27.03.2010 13:32:33 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7000
Description =

Error - 27.03.2010 13:32:33 | Computer Name = r189161.moos.swh.mhn.de | Source = Service Control Manager | ID = 7026
Description =

[ TuneUp Events ]
Error - 27.03.2010 13:37:52 | Computer Name = r189161.moos.swh.mhn.de | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-03-27 18:37:52', '\device\harddiskvolume2\program
files\malwarebytes' anti-malware\mbam.exe','1032',0)

Error - 27.03.2010 13:38:42 | Computer Name = r189161.moos.swh.mhn.de | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-03-27 18:38:42', '\device\harddiskvolume2\program
files\malwarebytes' anti-malware\mbam.exe','4488',0)

< End of report >

Bitte helft mir! Was soll ich nun tun, um den Scheiss loszuwerden??
Danke im Voraus!
Didi

Chris4You · 29.03.2010, 06:45

@Voogl
Hi,

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen!
(nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“
und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Users\didi\AppData\Local\Temp\Bmh.exe
C:\Windows\Bfegua.exe

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\didi\AppData\Local\Temp\Bmh.exe ()
O4 - HKCU..\Run: [Canaveral] C:\Windows\System32\sshnas21.DLL ()
[2010.03.27 18:32:22 | 000,000,244 | -H-- | M] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.03.27 18:32:19 | 000,000,282 | -H-- | M] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010.03.26 19:46:16 | 000,191,488 | ---- | M] () -- C:\Windows\Bfegua.exe
:Commands
[emptytemp]
[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-malwarebytes-anti-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
MAM Updaten und dann Fullscan und alles bereinigen lassen! Log posten.

chris

Voogl · 30.03.2010, 16:08

Hallo Chris4You,

hier einmal die ergebnisse von dieser C:\Windows\Bfegua.exe Datei:

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.03.30 -
AhnLab-V3 5.0.0.2 2010.03.30 Win-Trojan/Fakeav.191488
AntiVir 7.10.6.4 2010.03.30 -
Antiy-AVL 2.0.3.7 2010.03.30 -
Authentium 5.2.0.5 2010.03.30 W32/FakeAlert.FT.gen!Eldorado
Avast 4.8.1351.0 2010.03.30 Win32:Malware-gen
Avast5 5.0.332.0 2010.03.30 Win32:Malware-gen
AVG 9.0.0.787 2010.03.29 Downloader.Agent2.UPG
BitDefender 7.2 2010.03.30 -
CAT-QuickHeal 10.00 2010.03.30 -
ClamAV 0.96.0.0-git 2010.03.30 -
Comodo 4439 2010.03.30 -
DrWeb 5.0.2.03220 2010.03.30 -
eSafe 7.0.17.0 2010.03.28 -
eTrust-Vet 35.2.7396 2010.03.30 Win32/FakeAlert.D!generic
F-Prot 4.5.1.85 2010.03.29 W32/FakeAlert.FT.gen!Eldorado
F-Secure 9.0.15370.0 2010.03.30 -
Fortinet 4.0.14.0 2010.03.30 -
GData 19 2010.03.30 Win32:Malware-gen
Ikarus T3.1.1.80.0 2010.03.30 -
Jiangmin 13.0.900 2010.03.30 -
K7AntiVirus 7.10.1004 2010.03.22 -
Kaspersky 7.0.0.125 2010.03.30 -
McAfee 5935 2010.03.29 Downloader-CEW
McAfee+Artemis 5935 2010.03.29 Downloader-CEW
McAfee-GW-Edition 6.8.5 2010.03.30 Heuristic.BehavesLike.Win32.Suspicious.H
Microsoft 1.5605 2010.03.30 TrojanDownloader:Win32/Renos.KF
NOD32 4985 2010.03.30 a variant of Win32/Kryptik.DIR
Norman 6.04.10 2010.03.30 -
nProtect 2009.1.8.0 2010.03.30 -
Panda 10.0.2.2 2010.03.29 Generic Trojan
PCTools 7.0.3.5 2010.03.30 -
Prevx 3.0 2010.03.30 Medium Risk Malware
Rising 22.41.01.03 2010.03.30 Trojan.Win32.Crypt.afq
Sophos 4.52.0 2010.03.30 Mal/FakeAV-CX
Sunbelt 6116 2010.03.30 -
Symantec 20091.2.0.41 2010.03.30 Suspicious.Insight
TheHacker 6.5.2.0.248 2010.03.30 Trojan/Kryptik.dir
TrendMicro 9.120.0.1004 2010.03.30 TROJ_RENOS.SMD
VBA32 3.12.12.2 2010.03.30 -
ViRobot 2010.3.30.2252 2010.03.30 -
VirusBuster 5.0.27.0 2010.03.30 -
weitere Informationen
File size: 191488 bytes
MD5...: 9dea569cf4b1c7ff502d8a24fcdd4a17
SHA1..: 5cb9fdc8b1e344c7907986d086b0e9296cbc5532
SHA256: 63d53a42664301dbcde8b21576d9cd8b4cdeb690905cf9a81c309ffa251d0498
ssdeep: 3072:ZfZNT04dS571w8QhacteKnVglamUooLgyx7D0xp3J1tY2QHbakRPxKEg:Zh
Nv671wNVgleooL9FD4TO2abhPK
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5a23
timedatestamp.....: 0x4a136ba6 (Wed May 20 02:32:06 2009)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.CODE 0x1000 0xdbee 0xdc00 5.64 03ac6910d76763d9706b272498530396
.rdata 0xf000 0x2d8e4 0x1ea00 7.46 957c9fd8b19c0ae20c3d7823cfce0d06
.data 0x3d000 0x13e2 0x1400 5.04 622a9067262a4e0913109ca8dd52f904
.idata 0x3f000 0x5d5 0x600 0.00 53e979547d8c2ea86560ac45de08ae25
INIT 0x40000 0x490 0x600 0.00 53e979547d8c2ea86560ac45de08ae25

( 13 imports )
> NTDLL.DLL: atoi
> ole32.dll: CoTaskMemFree, ReleaseStgMedium, CoDisconnectObject, CoCreateFreeThreadedMarshaler, PropVariantClear, CoGetMalloc, OleRegGetUserType, WriteClassStm, StgOpenStorage
> msvcrt.dll: exit, mbstowcs, memcpy, sqrt, swprintf, memset, tolower, _acmdln, malloc, clock, wcstol, atol, strlen, wcscspn, rand, calloc, memmove, sprintf, wcschr
> GDI32.DLL: GetPixel, GetPaletteEntries, CreateCompatibleBitmap, RestoreDC
> version.dll: VerInstallFileA, VerQueryValueA, VerFindFileA
> SHLWAPI.DLL: PathGetCharTypeA, SHQueryInfoKeyA, SHGetValueA, PathFileExistsA, SHDeleteKeyA, SHQueryValueExA, SHDeleteValueA, PathIsContentTypeA, SHStrDupA, SHSetValueA
> COMDLG32.DLL: FindTextA, GetFileTitleA
> USER32.DLL: EndPaint, IsDialogMessageA, GetSysColorBrush, FillRect, CheckMenuItem, CreatePopupMenu, DrawMenuBar, GetClientRect, SetTimer, GetDC, EqualRect, GetWindowTextA, CharNextA, EnableMenuItem, ShowWindow, GetMessagePos, GetClassInfoA, GetActiveWindow, FrameRect, CreateIcon, GetClassLongA, GetCursor, IsWindowEnabled, GetFocus, BeginDeferWindowPos, IsChild, GetForegroundWindow, GetCapture, GetWindow, GetDlgItem, EndDeferWindowPos
> SHELL32.DLL: Shell_NotifyIconA
> ADVAPI32.DLL: RegCreateKeyA, RegDeleteValueA, RegLoadKeyA
> COMCTL32.DLL: ImageList_Create, ImageList_DrawEx, ImageList_Remove, ImageList_Draw, ImageList_Destroy, ImageList_Add, ImageList_Read, ImageList_GetBkColor, ImageList_DragShowNolock
> KERNEL32.DLL: GetStringTypeA, GlobalFindAtomA, InitializeCriticalSection, SetEndOfFile, ExitThread, GetModuleFileNameA, GetTickCount, GetCurrentProcess, GlobalAddAtomA, FormatMessageA, GetSystemDefaultLangID, WideCharToMultiByte, DeleteCriticalSection, GlobalAlloc, VirtualAlloc, VirtualFree, GetProcessHeap, GetDateFormatA, LoadResource, GetLastError, GetUserDefaultLCID, SizeofResource, CreateFileA, HeapFree, CreateThread, GetModuleHandleA, lstrcmpiA, CloseHandle, SetHandleCount, GetStartupInfoA, lstrlenA, lstrcpyA, GetCPInfo, GetFullPathNameA, GetStringTypeW, GetACP, GetCurrentThread, GetProcAddress, LocalReAlloc, WaitForSingleObject, VirtualQuery, GetVersion, MulDiv, GetLocaleInfoA, GetFileType, GetOEMCP, SetThreadLocale, GetCurrentProcessId, LoadLibraryExA, MoveFileExA, GetThreadLocale, GetLocalTime, SetLastError, FindClose, HeapDestroy, ExitProcess, EnterCriticalSection, ResetEvent, FreeResource, CompareStringA, FreeLibrary, GetEnvironmentStrings, GetFileSize, CreateEventA, LocalFree, HeapAlloc, GetCommandLineA, GetCurrentThreadId, ReadFile, VirtualAllocEx, Sleep, GlobalDeleteAtom, LoadLibraryA, GetVersionExA, lstrcatA, GetStdHandle, EnumCalendarInfoA
> OLEAUT32.DLL: SysStringLen

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (60.8%)
Win32 Executable Generic (13.7%)
Win32 Dynamic Link Library (generic) (12.2%)
Win16/32 Executable Delphi generic (3.3%)
Clipper DOS Executable (3.2%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='hxxp://info.prevx.com/aboutprogramtext.asp?PX5=8C3231D3009DC5B6EC97029CC07E1E00E9A415CD' target='_blank'>hxxp://info.prevx.com/aboutprogramtext.asp?PX5=8C3231D3009DC5B6EC97029CC07E1E00E9A415CD</a>

Allerdings konnte ich die Datei Bmh.exe nicht finden. Hab nur Bmf.exe und Bmg.exe.... Was wäre denn dann zu tun?

Und hier dieses OTL-Ding:

========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\YVIBBBHA8C not found.
File C:\Users\didi\AppData\Local\Temp\Bmh.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Canaveral not found.
File C:\Windows\System32\sshnas21.DLL not found.
File C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job not found.
File C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job not found.
C:\Windows\Bfegua.exe moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.1.37.3 log created on 03302010_170241

Was kommt nun?
Vielen Dank für die Hilfe!
LG

Chris4You · 30.03.2010, 16:23

Hi,

MAM updaten und Fullscan, MAM Log posten...

chris

Voogl · 30.03.2010, 18:11

soooo

hab ich getan und dies kam raus:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3930

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

30.03.2010 19:07:26
mbam-log-2010-03-30 (19-07-26).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 235716
Laufzeit: 1 Stunde(n), 29 Minute(n), 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

sieht aus, als wäre alles schon clean, oder..

gruß,
didi

Chris4You · 30.03.2010, 19:26

Hi,

wie verhält sich der Rechner?

chris

Voogl · 30.03.2010, 20:12

hi,

eigentlich passiert nichts merkwürdiges nach dem ersten MAMscan.. der rechner verhält sich ganz normal.

didi

Chris4You · 31.03.2010, 06:41

Hi,

abschließend noch ein Tool das zwar einige Fehlalarme verursacht (und in der freien Version nichts entfernen kann), aber ziemlich viel findet:

Prevx:
http://www.prevx.com/freescan.asp
Falls das Tool was findet, nicht das Log posten sondern einen Screenshot des dann angezeigten Fensters...

chris

Voogl · 31.03.2010, 10:02

hi,

also das tool hat keine aktiven bedrohungen gefunden.
ich nehme an, es ist alles in ordnung.
vielen dank für deine hilfe!!

didi

werde Malware nicht los z.B. HEUR/HTML.Malware [heuristic

Log-Analyse und Auswertung: werde Malware nicht los z.B. HEUR/HTML.Malware [heuristic