| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer Massivst Werbung(Popups) und nun "laggendes Internet"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
15.04.2010, 23:51
| #1 |
| |  Internet Explorer Massivst Werbung(Popups) und nun "laggendes Internet" Gestern abend war mein IE am rumspinnen und öffnete oben link massig viele Popups und im Hintergrund Werbung ohne Ende. Nachdem ich alle Fenster geschlossen hatte dachte ich mir erst nichts weiter dabei.Seit dem ist mein Internet allerdings langsam, der Seitenaufbau dauert länger als sonst und auch das Onlinespielen ist nahezu unmöglich geworden. Ich hab jetzt schon Angst das ich mir etwas eingefangen habe bei der Aktion =( HJT LOG Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:44:19, on 16.04.2010 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.17037) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\ehome\ehtray.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\regedit.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\StarCraft II Beta\Versions\Base14803\SC2.exe C:\Program Files\StarCraft II Beta\Versions\Base14803\SC2.exe C:\Program Files\Trillian\trillian.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://gosugamers.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [SetPoint] C:\Program Files\Logitech\SetPoint\SetPoint.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Livestream Procaster] "C:\Program Files\Livestream Procaster\Procaster.exe" -autorun O4 - HKCU\..\Run: [Power2GoExpress] NA O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [SMASH] "C:\Program Files\SoftMaker Office 2010\smash.exe" O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Kutluay\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [tjlpds] RUNDLL32.EXE C:\Users\Kutluay\AppData\Local\Temp\mseimsso.dll,w O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O13 - Gopher Prefix: O16 - DPF: {571CB303-4267-4D92-B45C-9B79ACC18632} - hxxp://potplayer.daum.net/PotPlayer/v2/PotWeb.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - hxxp://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} (PPLive Lite Class) - hxxp://dl.pplive.com/PluginSetup.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A3B4FA3F-419C-4D0F-B4AE-5D34B81FBFC8}: NameServer = 192.0.0.1 O20 - AppInit_DLLs: nmklo O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- End of file - 6730 bytes Code:
ATTFilter Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org
Datenbank Version: 3985
Windows 6.0.6000
Internet Explorer 7.0.6000.17037
14.04.2010 03:16:37
mbam-log-2010-04-14 (03-16-37).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 248879
Laufzeit: 1 Stunde(n), 33 Minute(n), 57 Sekunde(n)
Infizierte Speicherprozesse: 9
Infizierte Speichermodule: 3
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 16
Infizierte Dateiobjekte der Registrierung: 6
Infizierte Verzeichnisse: 0
Infizierte Dateien: 28
Infizierte Speicherprozesse:
C:\Windows\System32\net.net (Trojan.Downloader) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\mdm.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\lsass.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\setup.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\hexdump.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\taskmgr.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\geurge.exe (Trojan.Agent.Gen) -> No action taken.
C:\Windows\System32\reader_s.exe (Trojan.Agent) -> No action taken.
C:\Windows\services.exe (Trojan.Agent) -> No action taken.
Infizierte Speichermodule:
C:\Windows\System32\j43reu.dll (Trojan.Ertfor) -> No action taken.
C:\Windows\System32\msxsltsso.dll (Trojan.GootKit) -> No action taken.
C:\Windows\System32\nmklo.dll (Trojan.Agent) -> No action taken.
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> No action taken.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> No action taken.
Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.FakeAlert.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.FakeAlert.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewrgetuj (Trojan.Agent.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf (Trojan.Ertfor) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\appreg70700.exe (Trojan.FakeAV) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\gootkitsso (Trojan.GootKit) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\host (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\id (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Services\del (Malware.Trace) -> No action taken.
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32\sdra64.exe,) Good: (Userinit.exe) -> No action taken.
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\Windows\System32\reader_s.exe (Trojan.FakeAlert.H) -> No action taken.
C:\Windows\services.exe (Trojan.FakeAlert.H) -> No action taken.
C:\Windows\System32\j43reu.dll (Trojan.Ertfor) -> No action taken.
C:\Windows\System32\net.net (Trojan.Downloader) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\mdm.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\lsass.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\setup.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\hexdump.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\taskmgr.exe (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\geurge.exe (Trojan.Agent.Gen) -> No action taken.
C:\Windows\System32\msxsltsso.dll (Trojan.GootKit) -> No action taken.
C:\Windows\System32\nmklo.dll (Trojan.Agent) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\bmtv3gi5j.exe (Trojan.Ertfor) -> No action taken.
C:\Users\Kutluay\AppData\Roaming\D52CCE0FA67A74F3098D983B74E7AE4C\appreg70700.exe (Trojan.FakeAV) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\524E.tmp (Rootkit.TDSS) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\acnmswoxre.exe (Trojan.Agent.Gen) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\el42vs7hpodki1a.exe (Trojan.Clicker) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\wxmcrensoa.exe (Trojan.Downloader) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\u0byoo.exe (Trojan.Ertfor) -> No action taken.
C:\Users\Kutluay\AppData\Local\Temp\gtk2AFE.tmp (Spyware.Passwords) -> No action taken.
C:\Windows\System32\drivers\ovjndgni.sys (Rootkit.Agent) -> No action taken.
C:\Windows\System32\drivers\zcomdpaa7.sys (Rootkit.Tent) -> No action taken.
C:\Windows\Temp\CA88.tmp (Rootkit.TDSS) -> No action taken.
C:\$Recycle.Bin\S-1-5-21-4080093333-732458210-2902676382-1000\$R0I4B0Y\lazylaunch.exe (Hacktool.Gen) -> No action taken.
C:\Windows\System32\cooper.mine (Trojan.FakeAlert) -> No action taken.
C:\Windows\System32\sdra64.exe (Spyware.Zbot) -> No action taken.
Code:
ATTFilter OTL logfile created on: 14.04.2010 00:34:26 - Run 1 OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\Kutluay\Desktop Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 7.0.6000.17037) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 28,00% Memory free 6,00 Gb Paging File | 3,00 Gb Available in Paging File | 55,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 144,09 Gb Total Space | 42,10 Gb Free Space | 29,22% Space Free | Partition Type: NTFS Drive D: | 144,00 Gb Total Space | 100,96 Gb Free Space | 70,11% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPPI Current User Name: Kutluay Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Kutluay\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\services.exe () PRC - C:\Windows\System32\reader_s.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\geurge.exe ( ) PRC - C:\Users\Kutluay\AppData\Local\Temp\taskmgr.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\hexdump.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\setup.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\lsass.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\mdm.exe () PRC - C:\Users\Kutluay\AppData\Local\Temp\rknfl.exe (Sound HD) PRC - C:\Windows\System32\net.net (Privat) PRC - C:\Programme\StarCraft II Beta\Versions\Base14803\SC2.exe (Blizzard Entertainment) PRC - C:\Users\Kutluay\Desktop\MapHack v10a.exe (CraniX) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Programme\Trillian\trillian.exe (Cerulean Studios) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) PRC - C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.) PRC - C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) PRC - C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.) PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.) PRC - C:\Programme\RocketDock\RocketDock.exe () PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems) ========== Modules (SafeList) ========== MOD - C:\Users\Kutluay\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Users\Kutluay\AppData\Local\Temp\mseimsso.dll () MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\msvcr80.dll (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.20533_none_4634c4a0218d65c1\comctl32.dll (Microsoft Corporation) MOD - C:\Programme\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.) MOD - C:\Programme\Logitech\SetPoint\GameHook.dll (Logitech, Inc.) MOD - C:\Programme\RocketDock\RocketDock.dll () ========== Win32 Services (SafeList) ========== SRV - (DaumCleanerService) -- C:\Program Files\Daum\Cleaner\DaumCleanerService.exe (Daum Communications Corp.) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (LBTServ) -- C:\Programme\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone) SRV - (Samsung Update Plus) -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe () SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems) SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (zcomdpaa7) -- C:\Windows\System32\drivers\zcomdpaa7.sys () DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (RMCAST) RMCAST (Pgm) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell) DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems) DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://gosugamers.net/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2008.12.12 00:33:32 | 000,000,791 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: ::1 localhost O2 - BHO: (C:\Windows\system32\j43reu.dll) - {A9BA40A1-74F1-52BD-F431-00B15A2C8953} - C:\Windows\System32\j43reu.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ewrgetuj] C:\Users\Kutluay\AppData\Local\Temp\geurge.exe ( ) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [Livestream Procaster] C:\Program Files\Livestream Procaster\Procaster.exe () O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [net] C:\Windows\System32\net.net (Privat) O4 - HKLM..\Run: [reader_s] C:\Windows\System32\reader_s.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [services] C:\Windows\services.exe () O4 - HKLM..\Run: [SetPoint] C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [appreg70700.exe] C:\Users\Kutluay\AppData\Roaming\D52CCE0FA67A74F3098D983B74E7AE4C\appreg70700.exe (MS) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) O4 - HKCU..\Run: [DaumCleaner] C:\Program Files\Daum\Cleaner\DaumCleaner.exe (Daum Communications Corp.) O4 - HKCU..\Run: [hf8wefhuaihf8ewfydiujhfdsfdf] C:\Users\Kutluay\AppData\Local\Temp\bmtv3gi5j.exe () O4 - HKCU..\Run: [hsf87efjhdsf87f3jfsdi7fhsujfd] C:\Users\Kutluay\AppData\Local\Temp\lsass.exe () O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Users\Kutluay\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS) O4 - HKCU..\Run: [Power2GoExpress] File not found O4 - HKCU..\Run: [reader_s] C:\Users\Kutluay\reader_s.exe File not found O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe () O4 - HKCU..\Run: [SMASH] C:\Program Files\SoftMaker Office 2010\smash.exe (SoftMaker Software GmbH) O4 - HKCU..\Run: [tjlpds] C:\Users\Kutluay\AppData\Local\Temp\mseimsso.DLL () O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFolderOptions = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O13 - gopher Prefix: missing O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {571CB303-4267-4D92-B45C-9B79ACC18632} hxxp://potplayer.daum.net/PotPlayer/v2/PotWeb.cab (PotWeb Control) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 139.7.30.126 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O20 - AppInit_DLLs: (nmklo) - C:\Windows\System32\nmklo.dll () O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\sdra64.exe) - C:\Windows\System32\sdra64.exe (Sound HD) O21 - SSODL: GootkitSSO - {A1BAD51D-7F0E-4A95-A574-31E60A929272} - C:\Windows\System32\msxsltsso.dll () O22 - SharedTaskScheduler: {A9BA40A1-74F1-52BD-F431-00B15A2C8953} - hasiufhiusdfjdhfudd - C:\Windows\System32\j43reu.dll () O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{55ed05fe-fdf0-11dd-9f05-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{55ed05fe-fdf0-11dd-9f05-806e6f6e6963}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O33 - MountPoints2\{b92c600c-fc5d-11dd-99db-001377a990c4}\Shell - "" = AutoRun O33 - MountPoints2\{b92c600c-fc5d-11dd-99db-001377a990c4}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O33 - MountPoints2\{bd52594b-fc5f-11dd-9fc6-001377a990c4}\Shell - "" = AutoRun O33 - MountPoints2\{bd52594b-fc5f-11dd-9fc6-001377a990c4}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O33 - MountPoints2\{bd525973-fc5f-11dd-9fc6-001377a990c4}\Shell - "" = AutoRun O33 - MountPoints2\{bd525973-fc5f-11dd-9fc6-001377a990c4}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O33 - MountPoints2\{fb06b044-fc66-11dd-a32c-001377a990c4}\Shell - "" = AutoRun O33 - MountPoints2\{fb06b044-fc66-11dd-a32c-001377a990c4}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.14 00:32:26 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Users\Kutluay\Desktop\OTL.exe [2010.04.14 00:19:40 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\hkapgnbl [2010.04.14 00:04:16 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\stu2.exe [2010.04.14 00:03:27 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\AppData\Roaming\D52CCE0FA67A74F3098D983B74E7AE4C [2010.04.14 00:03:10 | 000,036,648 | ---- | C] (Privat) -- C:\Windows\System32\net.net [2010.04.12 00:14:45 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\Documents\Meine empfangenen Dateien [2010.04.11 19:32:33 | 000,058,880 | ---- | C] (CraniX) -- C:\Users\Kutluay\Desktop\MapHack v10a.exe [2010.04.10 14:13:29 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\Tracing [2010.04.10 14:12:41 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft [2010.04.10 14:12:31 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2010.04.10 14:12:24 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live SkyDrive [2010.04.10 14:12:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live [2010.04.10 14:11:45 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.04.10 14:07:38 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Windows Live [2010.04.01 16:32:18 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\AppData\Roaming\Octoshape [2010.04.01 16:32:18 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\AppData\Roaming\Mozilla [2010.03.31 03:20:22 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.03.31 03:20:22 | 000,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.03.31 03:20:21 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2010.03.31 03:20:20 | 001,830,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010.03.31 03:20:20 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010.03.31 03:20:19 | 000,459,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.03.31 03:20:19 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.03.31 03:20:19 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2010.03.31 03:20:19 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2010.03.31 03:20:19 | 000,192,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.03.31 03:20:19 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2010.03.31 03:20:19 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.03.31 03:20:18 | 000,214,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2010.03.31 03:20:18 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.03.31 03:20:18 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2010.03.31 03:20:18 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2010.03.31 03:20:18 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010.03.31 03:20:18 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010.03.31 03:20:18 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010.03.31 03:20:17 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.03.31 03:20:17 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2010.03.31 03:20:17 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2010.03.27 12:48:12 | 000,000,000 | ---D | C] -- C:\Programme\DAUM [2010.03.25 00:19:41 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\AppData\Roaming\Ventrilo [2010.03.25 00:19:27 | 000,000,000 | ---D | C] -- C:\Programme\Ventrilo [2010.03.19 17:28:23 | 000,000,000 | ---D | C] -- C:\Programme\eBay [2010.03.19 17:28:23 | 000,000,000 | ---D | C] -- C:\ProgramData\eBay [2010.03.18 19:04:15 | 000,000,000 | ---D | C] -- C:\Users\Kutluay\AppData\Local\SF-Software [2010.03.18 18:30:50 | 000,000,000 | ---D | C] -- C:\Programme\SF [2010.03.18 18:30:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SF [2010.03.18 18:26:33 | 000,000,000 | ---D | C] -- C:\Programme\JDownloader [2010.03.16 07:24:00 | 000,000,000 | R--D | C] -- C:\Users\Kutluay\Documents\Notes [2006.11.24 07:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll [2006.11.24 07:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll ========== Files - Modified Within 30 Days ========== [2010.04.14 00:37:18 | 002,097,152 | -HS- | M] () -- C:\Users\Kutluay\NTUSER.DAT [2010.04.14 00:36:47 | 000,845,824 | ---- | M] () -- C:\Windows\System32\drivers\ovjndgni.sys [2010.04.14 00:32:36 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Kutluay\Desktop\OTL.exe [2010.04.14 00:19:40 | 000,032,768 | ---- | M] () -- C:\Windows\System32\23rh46g.4e [2010.04.14 00:19:39 | 000,065,024 | ---- | M] () -- C:\Windows\System32\bb52fkri.few [2010.04.14 00:19:38 | 000,186,368 | ---- | M] () -- C:\Windows\System32\cooper.mine [2010.04.14 00:07:25 | 000,042,496 | ---- | M] () -- C:\Windows\System32\msxsltsso.dll [2010.04.14 00:04:28 | 000,135,168 | ---- | M] () -- C:\Windows\System32\nmklo.dll [2010.04.14 00:04:18 | 000,050,688 | ---- | M] () -- C:\Windows\services.exe [2010.04.14 00:04:14 | 000,026,624 | ---- | M] () -- C:\Windows\System32\reader_s.exe [2010.04.14 00:03:21 | 000,020,000 | ---- | M] () -- C:\Windows\System32\j43reu.dll [2010.04.14 00:03:10 | 000,036,648 | ---- | M] (Privat) -- C:\Windows\System32\net.net [2010.04.13 23:41:08 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.13 23:41:08 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.13 16:47:00 | 001,461,736 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.04.13 16:47:00 | 000,641,344 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.04.13 16:47:00 | 000,610,142 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.04.13 16:47:00 | 000,116,706 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.04.13 16:47:00 | 000,103,924 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.04.13 16:43:25 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{650B5F1A-0A62-470F-910B-D384D04FDE11}.job [2010.04.13 16:41:09 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.04.13 16:41:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.13 16:41:02 | 3219,308,544 | -HS- | M] () -- C:\hiberfil.sys [2010.04.13 05:59:43 | 001,562,813 | -H-- | M] () -- C:\Users\Kutluay\AppData\Local\IconCache.db [2010.04.11 23:37:55 | 000,000,008 | ---- | M] () -- C:\Users\Kutluay\AppData\Roaming\jdzarn.dat [2010.04.06 03:12:59 | 010,487,748 | ---- | M] () -- C:\Users\Kutluay\Desktop\AllanValentine-The Outsider Renholder Apocalypse Mix.mp3 [2010.04.04 00:57:49 | 003,081,645 | ---- | M] () -- C:\Users\Kutluay\Desktop\Toony Feat. Kollegah & Farid Bang - Disco Bitch.mp3 [2010.03.28 09:31:07 | 000,058,880 | ---- | M] (CraniX) -- C:\Users\Kutluay\Desktop\MapHack v10a.exe [2010.03.25 00:19:33 | 000,000,262 | ---- | M] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2010.03.25 00:19:28 | 000,000,752 | ---- | M] () -- C:\Users\Public\Desktop\Ventrilo.lnk [2010.03.20 14:07:02 | 000,000,339 | ---- | M] () -- C:\Windows\win.ini ========== Files Created - No Company Name ========== [2010.04.14 00:07:25 | 000,042,496 | ---- | C] () -- C:\Windows\System32\msxsltsso.dll [2010.04.14 00:04:31 | 000,065,024 | ---- | C] () -- C:\Windows\System32\bb52fkri.few [2010.04.14 00:04:31 | 000,032,768 | ---- | C] () -- C:\Windows\System32\23rh46g.4e [2010.04.14 00:04:28 | 000,135,168 | ---- | C] () -- C:\Windows\System32\nmklo.dll [2010.04.14 00:04:27 | 000,186,368 | ---- | C] () -- C:\Windows\System32\cooper.mine [2010.04.14 00:04:20 | 000,050,688 | ---- | C] () -- C:\Windows\services.exe [2010.04.14 00:04:14 | 000,026,624 | ---- | C] () -- C:\Windows\System32\reader_s.exe [2010.04.14 00:03:21 | 000,020,000 | ---- | C] () -- C:\Windows\System32\j43reu.dll [2010.04.11 23:38:48 | 000,845,824 | ---- | C] () -- C:\Windows\System32\drivers\ovjndgni.sys [2010.04.11 23:37:55 | 000,000,008 | ---- | C] () -- C:\Users\Kutluay\AppData\Roaming\jdzarn.dat [2010.04.06 03:12:59 | 010,487,748 | ---- | C] () -- C:\Users\Kutluay\Desktop\AllanValentine-The Outsider Renholder Apocalypse Mix.mp3 [2010.04.04 00:57:35 | 003,081,645 | ---- | C] () -- C:\Users\Kutluay\Desktop\Toony Feat. Kollegah & Farid Bang - Disco Bitch.mp3 [2010.03.25 00:19:28 | 000,000,752 | ---- | C] () -- C:\Users\Public\Desktop\Ventrilo.lnk [2010.03.25 00:19:24 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini [2009.06.16 17:57:16 | 000,000,039 | ---- | C] () -- C:\Programme\myini.ini [2009.06.16 17:57:14 | 000,002,240 | ---- | C] () -- C:\Programme\uninstal.ini [2009.04.01 15:29:25 | 000,098,400 | ---- | C] () -- C:\Programme\news.mtd [2009.04.01 15:29:25 | 000,041,400 | ---- | C] () -- C:\Programme\kons.mtd [2009.04.01 15:29:25 | 000,028,672 | ---- | C] () -- C:\Programme\news.ma1 [2009.04.01 15:29:25 | 000,012,288 | ---- | C] () -- C:\Programme\walks.ma1 [2009.04.01 15:29:25 | 000,012,288 | ---- | C] () -- C:\Programme\kons.ma1 [2009.04.01 15:29:25 | 000,012,000 | ---- | C] () -- C:\Programme\walks.mtd [2009.04.01 15:24:07 | 000,428,032 | ---- | C] () -- C:\Programme\kons.blb [2009.04.01 15:23:57 | 000,000,105 | ---- | C] () -- C:\Programme\readme.txt [2009.04.01 15:23:42 | 000,008,192 | ---- | C] () -- C:\Programme\kons.ma2 [2009.04.01 15:21:42 | 002,163,712 | ---- | C] () -- C:\Programme\walks.blb [2009.04.01 15:21:42 | 000,008,192 | ---- | C] () -- C:\Programme\walks.ma2 [2009.04.01 15:21:20 | 003,244,032 | ---- | C] () -- C:\Programme\news.blb [2009.04.01 15:21:20 | 000,008,192 | ---- | C] () -- C:\Programme\news.ma2 [2009.03.29 12:18:20 | 000,728,064 | ---- | C] () -- C:\Programme\chtb0409.exe [2009.02.01 12:47:20 | 1218,772,992 | ---- | C] () -- C:\Programme\rondommlit.iso [2008.12.19 01:28:05 | 000,053,760 | ---- | C] () -- C:\Users\Kutluay\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.12.11 16:33:58 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2008.12.11 13:35:51 | 000,004,744 | ---- | C] () -- C:\Windows\HotFixList.ini [2008.12.11 13:25:30 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini [2008.12.11 13:25:30 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini [2008.12.11 13:20:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.12.11 12:36:17 | 000,000,680 | ---- | C] () -- C:\Users\Kutluay\AppData\Local\d3d9caps.dat [2008.12.11 12:36:16 | 000,524,288 | -HS- | C] () -- C:\Users\Kutluay\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2008.12.11 12:36:16 | 000,524,288 | -HS- | C] () -- C:\Users\Kutluay\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2008.12.11 12:36:16 | 000,262,144 | -H-- | C] () -- C:\Users\Kutluay\ntuser.dat.LOG1 [2008.12.11 12:36:16 | 000,065,536 | -HS- | C] () -- C:\Users\Kutluay\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2008.12.11 12:36:16 | 000,000,020 | -HS- | C] () -- C:\Users\Kutluay\ntuser.ini [2008.12.11 12:36:16 | 000,000,000 | -H-- | C] () -- C:\Users\Kutluay\ntuser.dat.LOG2 [2008.12.11 12:36:15 | 002,097,152 | -HS- | C] () -- C:\Users\Kutluay\NTUSER.DAT [2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2008.06.23 14:02:02 | 000,097,410 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4 [2008.05.23 18:48:50 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml [2007.12.24 19:39:53 | 000,003,640 | ---- | C] () -- C:\Programme\news.mti [2007.12.24 19:36:35 | 000,003,640 | ---- | C] () -- C:\Programme\walks.mti [2007.12.24 19:36:08 | 000,004,680 | ---- | C] () -- C:\Programme\kons.mti [2007.08.07 02:31:18 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2007.02.15 09:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll [2006.11.29 10:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.10.09 03:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll [1999.10.19 05:56:42 | 000,030,234 | ---- | C] () -- C:\Programme\Uninstal.exe < End of report > |
| Themen zu Internet Explorer Massivst Werbung(Popups) und nun "laggendes Internet" |
| 8.tmp, agere systems, bho, corp./icp, defender, desktop, disabled.securitycenter, error, explorer, format, hacktool.gen, hijack, hijack.folderoptions, hijack.regedit, hijackthis, home premium, internet, internet explorer, langsam, local\temp, location, malwarebytes' anti-malware, msvcr80.dll, nvidia, nvstor.sys, object, oldtimer, otl.exe, plug-in, popups, port, programdata, realtek, recycle.bin, rogue.antimalwaredoctor, rundll, security, services.exe, software, sptd.sys, spyware.passwords, spyware.zbot, system, taskmgr.exe, temp, trojan.agent.ge, trojan.clicker, trojan.downloader, trojan.ertfor, trojan.fakeav, trojan.gootkit, viele popups, vista, vodafone, werbung, windows |
Baum-Darstellung