| |
| |||||||
Log-Analyse und Auswertung: IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
19.06.2010, 08:12
| #1 |
 |  IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... Guten Morgen! Habe seit gestern immer wieder einen aufgehenden ie. Da bei mir der FIrefox Standart ist, hats mich zumindest gestern noch nicht gestört... Hier mal die Ergebnisse, die Ihr auchbei den anderen User haben wolltet, die damit zu kämpfen haben. (btw: Super-Dau  )Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4214 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 19.06.2010 08:57:04 mbam-log-2010-06-19 (08-57-04).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 123338 Laufzeit: 10 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 1 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 5 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 2 Infizierte Dateien: 10 Infizierte Speicherprozesse: C:\Users\*******\AppData\Local\Temp\Ctl.exe (Trojan.FraudPack) -> Unloaded process successfully. Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Protection System (Rogue.ProtectionSystem) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FraudPack) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\Users\*****\AppData\Roaming\pridl (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Protection System (Rogue.ProtectionSystem) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Users\*****\AppData\Local\Temp\Ctl.exe (Trojan.FraudPack) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Local\Temp\Ctj.exe (Trojan.FraudPack) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Local\Temp\Ctm.exe (Trojan.FraudPack) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Local\Temp\Cto.exe (Trojan.FraudPack) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Protection System\Live Support.lnk (Rogue.ProtectionSystem) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Protection System\Protection System.lnk (Rogue.ProtectionSystem) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Protection System\Uninstall.lnk (Rogue.ProtectionSystem) -> Quarantined and deleted successfully. C:\Users\*****\AppData\Local\Temp\sshnas21.dll (Trojan.Downloader) -> Delete on reboot. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. So... Nachdem löschen fordert Malwarebytes zum Neustart auf... Soll ich das machen? (Befehl: Bestimmte Objekte konnten nicht entfernt werden. Eine Logdatei wurde im Logdatei-Verzeichnis gespeichert. Der Computer muss neu gestartet werden, um den Entfernungsprozess abzuschließen. Möchten Sie den Neustart jetzt durchführen? Danach würde ich dann den OTL Bericht Posten. Oder andere Befehle ausführen  Gruß Reissdorf |
|
19.06.2010, 12:10
| #2 |
| /// Selecta Jahrusso   | IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList|helpassistant /rs
Bitte poste in Deiner nächsten Antwort OTL.txt Extras.txt
__________________ |
|
19.06.2010, 17:07
| #3 |
| | IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... Hier die OTl.Txt...
__________________OTL Logfile: Code:
ATTFilter OTL logfile created on: 19.06.2010 17:39:45 - Run 2 OTL by OldTimer - Version 3.2.6.0 Folder = C:\Users\*****\Desktop Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 55,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 137,05 Gb Total Space | 5,63 Gb Free Space | 4,11% Space Free | Partition Type: NTFS Drive D: | 6,08 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: *****-PC Current User Name: ***** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Minimal Quick Scan ========== Processes (SafeList) ========== PRC - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe (Carbonite, Inc.) PRC - C:\Programme\SiS VGA Utilities\SiSTray.exe (Silicon Integrated Systems Corporation) PRC - C:\Programme\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe () PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.) PRC - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) ========== Modules (SafeList) ========== MOD - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe () SRV - (TOSHIBA Bluetooth Service) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG) DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.) DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\CyberLink\PlayMovie\000.fcl (Cyberlink Corp.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (SiS6350) -- C:\Windows\System32\drivers\SISGRKMD.sys (Silicon Integrated Systems Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Corp.) DRV - (SiSGbeLH) -- C:\Windows\System32\drivers\SiSGB6.sys (Silicon Integrated Systems Corp.) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (BVRPMPR5) -- C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software) DRV - (sisagp) -- C:\Windows\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation) DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION) DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation) DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.) DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION) DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation) DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.) DRV - (DVBT_Loader) -- C:\Windows\System32\drivers\DVBT_Loader.sys (anchor chips) DRV - (GenDTV) -- C:\Windows\System32\drivers\Geniausb.sys (Windows (R) 2000 DDK provider) DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation) DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.packardbell.com/?id=9283 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.3 FF - prefs.js..extensions.enabledItems: {5B52016C-D097-4aec-BE61-9F129D8FDDBA}:2.0 FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.4.7amo FF - prefs.js..extensions.enabledItems: contact@searchfiles.de:1.3 FF - prefs.js..extensions.enabledItems: rsDownloadHelper@yevgenyandrov.net:1.0 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.81 FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=" FF - prefs.js..network.proxy.http: "localhost" FF - prefs.js..network.proxy.http_port: 9666 FF - prefs.js..network.proxy.socks: "localhost" FF - prefs.js..network.proxy.socks_port: 9050 FF - prefs.js..network.proxy.socks_remote_dns: true FF - prefs.js..network.proxy.ssl: "localhost" FF - prefs.js..network.proxy.ssl_port: 9666 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.06 17:48:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.25 21:15:05 | 000,000,000 | ---D | M] [2009.06.18 19:53:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Extensions [2009.06.18 19:53:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2010.06.19 00:50:08 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions [2010.05.29 18:39:20 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009.08.08 15:50:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA} [2010.05.29 18:39:16 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2010.05.29 18:39:19 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.05.29 18:39:20 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.04.01 23:10:14 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\contact@searchfiles.de [2010.05.29 18:39:17 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\personas@christopher.beard [2010.04.01 22:56:43 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\rsDownloadHelper@yevgenyandrov.net [2010.04.01 22:36:50 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\SkipScreen@SkipScreen [2010.05.08 20:14:07 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\mebdgxfo.default\extensions\youtube2mp3@mondayx.de [2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\FireFox\Profiles\mebdgxfo.default\searchplugins\conduit.xml [2010.05.25 21:15:07 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.05.25 21:15:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2006.09.26 13:03:14 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll [2010.03.13 12:02:56 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.03.13 12:02:56 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.03.13 12:02:56 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.03.13 12:02:57 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.03.13 12:02:57 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Google\Google_BAE\BAE.dll (Packard Bell) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe (Carbonite, Inc.) O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SiSTray] C:\Programme\SiS VGA Utilities\SiSTray.exe (Silicon Integrated Systems Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Halo2] C:\Users\*****~1\AppData\Local\Temp\sshnas21.DLL File not found O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKCU..\Run: [SmpcSys] C:\Programme\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe () O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe () O13 - gopher Prefix: missing O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1232315708398 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2008.01.21 04:46:39 | 000,000,000 | ---D | M] NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 90 Days ========== [2010.06.19 09:24:10 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Defiance [2010.06.19 08:36:40 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes [2010.06.19 08:36:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.06.19 08:36:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.06.19 08:36:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.06.19 08:36:20 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.06.19 08:20:33 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe [2010.06.19 07:50:23 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\milk [2010.06.19 01:29:23 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\*****\AppData\Roaming\pcouffin.sys [2010.06.19 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Vso [2010.06.19 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\PcSetup [2010.06.19 01:29:22 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\DVDFab [2010.06.19 01:29:12 | 000,000,000 | ---D | C] -- C:\Programme\DVDFab 7 [2010.06.17 21:32:18 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\t680t328briver [2010.06.17 20:00:32 | 000,000,000 | ---D | C] -- C:\Programme\Driver [2010.06.17 19:31:52 | 000,000,000 | ---D | C] -- C:\dvbdream [2010.06.17 19:23:07 | 000,000,000 | ---D | C] -- C:\Programme\AMC2000 [2010.06.16 22:32:39 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\John_Sinclair_Classics_-_Folge_01_-_Der_Anfang [2010.06.16 21:52:11 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Sebastian Fitzek - Der Augensammler [2010.06.15 22:12:26 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\BraveVol1.Disc3 [2010.06.12 10:49:55 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\BraveVol1.Disc2 [2010.06.07 21:47:39 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Mango_Enterprise_-_http__ [2010.06.06 21:34:36 | 000,000,000 | ---D | C] -- C:\Programme\Toshiba [2010.06.06 21:31:18 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\TOSHIBA_v5.10.02 [2010.06.06 20:49:35 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\wwm [2010.06.06 20:44:22 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\1000 Handy Games fuer alle java faehigen handys [2010.06.04 23:16:56 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Stefanie_Heinzmann_-_Roots_to_Grow-2009-MOD [2010.06.03 12:00:27 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Miller, Henry [2010.05.26 22:38:42 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Die_Drei_Fragezeichen-F138_Die_Geheime_Treppe-AUDIOBOOK-DE-2010-VOiCE [2010.05.25 21:17:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.05.25 21:17:20 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.05.13 11:49:07 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\NeroVision [2010.05.02 23:03:17 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\SharePod [2010.05.02 10:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX [2010.04.29 20:32:04 | 000,000,000 | ---D | C] -- C:\Programme\Veetle [2010.04.29 20:07:28 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Avira [2010.04.29 20:01:54 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntdd.sys [2010.04.29 20:01:54 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntmgr.sys [2010.04.27 00:04:42 | 000,353,592 | ---- | C] (DivX, Inc.) -- C:\Windows\System32\DivXControlPanelApplet.cpl [2010.04.25 19:10:46 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\DVD Profiler [2010.04.25 19:09:36 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\DVD Profiler [2010.04.25 19:09:35 | 000,000,000 | ---D | C] -- C:\Programme\DVD Profiler [2010.04.25 17:21:41 | 000,000,000 | ---D | C] -- C:\Programme\Conduit [2010.04.25 17:21:40 | 000,000,000 | ---D | C] -- C:\Programme\Winload [2010.04.25 17:05:47 | 000,000,000 | ---D | C] -- C:\Users\*****\Application Data [2010.04.24 16:56:43 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\VLN 24.04.2010 [2010.04.22 19:42:01 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Designer [2010.04.22 19:40:58 | 000,000,000 | ---D | C] -- C:\Windows\ShellNew [2010.04.22 19:40:55 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.04.13 22:42:15 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Opera [2010.04.13 22:42:15 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Opera [2010.04.13 22:42:08 | 000,000,000 | ---D | C] -- C:\Programme\Zone Labs [2010.04.13 22:41:27 | 000,000,000 | ---D | C] -- C:\Programme\Opera [2010.04.13 21:46:45 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint [2010.04.13 21:46:41 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs [2010.03.27 23:01:21 | 000,000,000 | ---D | C] -- C:\Programme\Zattoo4 [1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ] ========== Files - Modified Within 90 Days ========== [2010.06.19 17:39:05 | 002,621,440 | -HS- | M] () -- C:\Users\*****\NTUSER.DAT [2010.06.19 17:30:00 | 000,000,368 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator-*****.job [2010.06.19 17:30:00 | 000,000,368 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie-*****.job [2010.06.19 17:28:21 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.06.19 17:28:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.06.19 12:04:27 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.06.19 12:04:26 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.06.19 12:04:26 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.06.19 12:04:26 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.06.19 12:04:26 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.06.19 11:57:17 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.06.19 11:57:17 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.06.19 11:57:16 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.06.19 11:57:13 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.06.19 11:57:03 | 2010,300,416 | -HS- | M] () -- C:\hiberfil.sys [2010.06.19 11:54:54 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.06.19 11:54:45 | 000,524,288 | -HS- | M] () -- C:\Users\*****\NTUSER.DAT{0b6316d0-b644-11de-bf64-001e6888f2b7}.TMContainer00000000000000000001.regtrans-ms [2010.06.19 11:54:45 | 000,065,536 | -HS- | M] () -- C:\Users\*****\NTUSER.DAT{0b6316d0-b644-11de-bf64-001e6888f2b7}.TM.blf [2010.06.19 11:54:42 | 006,291,456 | -H-- | M] () -- C:\Users\*****\AppData\Local\IconCache.db [2010.06.19 08:20:45 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe [2010.06.19 01:29:23 | 000,087,608 | ---- | M] () -- C:\Users\*****\AppData\Roaming\inst.exe [2010.06.19 01:29:23 | 000,047,360 | ---- | M] (VSO Software) -- C:\Users\*****\AppData\Roaming\pcouffin.sys [2010.06.19 01:29:23 | 000,007,887 | ---- | M] () -- C:\Users\*****\AppData\Roaming\pcouffin.cat [2010.06.19 01:29:23 | 000,001,144 | ---- | M] () -- C:\Users\*****\AppData\Roaming\pcouffin.inf [2010.06.17 23:04:36 | 000,102,466 | ---- | M] () -- C:\Users\*****\Documents\cc_20100617_230409.reg [2010.06.17 20:25:52 | 000,310,078 | ---- | M] () -- C:\Users\*****\Documents\cc_20100617_202524.reg [2010.06.17 19:38:46 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\ProgDVB 6.lnk [2010.06.09 20:33:59 | 001,596,112 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.06.09 19:56:41 | 000,027,136 | ---- | M] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.06 21:42:59 | 000,000,821 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2010.06.06 11:52:09 | 000,017,408 | ---- | M] () -- C:\Users\*****\AppData\Local\WebpageIcons.db [2010.05.21 07:37:35 | 001,238,528 | ---- | M] () -- C:\Users\*****\Desktop\ADPJS.ppt [2010.05.03 18:37:16 | 000,055,392 | ---- | M] () -- C:\Users\*****\AppData\Roaming\GDIPFONTCACHEV1.DAT [2010.05.02 10:48:25 | 000,001,411 | ---- | M] () -- C:\Users\*****\Desktop\DivX Movies.lnk [2010.05.02 10:47:44 | 000,000,920 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2010.05.02 10:47:12 | 000,000,960 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk [2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.27 00:04:42 | 000,353,592 | ---- | M] (DivX, Inc.) -- C:\Windows\System32\DivXControlPanelApplet.cpl [2010.04.25 21:38:37 | 000,001,890 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk [2010.04.25 19:09:38 | 000,000,909 | ---- | M] () -- C:\Users\*****\Desktop\DVD Profiler.lnk [2010.04.23 23:17:37 | 000,055,392 | ---- | M] () -- C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT [2010.04.22 19:44:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2010.04.22 19:43:35 | 000,000,275 | ---- | M] () -- C:\Windows\win.ini [2010.04.22 19:42:16 | 000,001,883 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2010.03.28 01:06:33 | 000,001,656 | ---- | M] () -- C:\Users\*****\Desktop\Zattoo.lnk [1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.06.19 01:31:41 | 000,000,034 | ---- | C] () -- C:\Users\*****\AppData\Roaming\pcouffin.log [2010.06.19 01:29:23 | 000,087,608 | ---- | C] () -- C:\Users\*****\AppData\Roaming\inst.exe [2010.06.19 01:29:23 | 000,007,887 | ---- | C] () -- C:\Users\*****\AppData\Roaming\pcouffin.cat [2010.06.19 01:29:23 | 000,001,144 | ---- | C] () -- C:\Users\*****\AppData\Roaming\pcouffin.inf [2010.06.17 23:04:11 | 000,102,466 | ---- | C] () -- C:\Users\*****\Documents\cc_20100617_230409.reg [2010.06.17 20:25:34 | 000,310,078 | ---- | C] () -- C:\Users\*****\Documents\cc_20100617_202524.reg [2010.06.17 19:38:46 | 000,000,808 | ---- | C] () -- C:\Users\Public\Desktop\ProgDVB 6.lnk [2010.06.06 21:36:36 | 000,000,821 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2010.05.20 21:14:49 | 001,238,528 | ---- | C] () -- C:\Users\*****\Desktop\ADPJS.ppt [2010.05.02 10:48:25 | 000,001,411 | ---- | C] () -- C:\Users\*****\Desktop\DivX Movies.lnk [2010.05.02 10:47:44 | 000,000,920 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2010.05.02 10:47:12 | 000,000,960 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk [2010.04.29 19:32:46 | 000,001,122 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.04.29 19:32:41 | 000,001,118 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.04.25 19:09:38 | 000,000,909 | ---- | C] () -- C:\Users\*****\Desktop\DVD Profiler.lnk [2010.04.22 19:44:10 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2010.04.22 19:42:16 | 000,001,883 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2010.03.27 23:01:28 | 000,017,408 | ---- | C] () -- C:\Users\*****\AppData\Local\WebpageIcons.db [2009.10.22 22:52:18 | 000,000,000 | ---- | C] () -- C:\Windows\Editor.INI [2009.10.20 20:59:14 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.01 19:40:03 | 000,000,096 | ---- | C] () -- C:\Windows\buhl.ini [2009.04.26 17:38:47 | 000,000,804 | ---- | C] () -- C:\Windows\wiso.ini [2009.04.23 22:11:04 | 000,000,074 | ---- | C] () -- C:\Windows\tm.ini [2008.08.11 20:57:13 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.06.18 15:59:56 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2006.12.05 13:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2005.07.22 21:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll ========== LOP Check ========== [2009.04.26 17:39:34 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Buhl Data Service [2010.01.31 17:49:11 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\EscapeTheMuseum2 [2009.12.21 21:55:51 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gtk-2.0 [2010.06.11 23:04:03 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ [2010.04.13 22:42:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Opera [2008.12.25 02:50:32 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Packard Bell [2009.05.28 18:33:09 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\saveTV [2010.05.02 23:03:17 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\SharePod [2009.03.15 19:52:31 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Thunderbird [2009.06.18 19:53:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TomTom [2010.04.25 19:06:59 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TVcentral-Core [2010.06.19 01:31:41 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Vso [2010.04.25 19:05:14 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\WatchTVProEx [2009.03.08 18:33:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Zylom [2010.06.19 17:30:00 | 000,000,368 | ---- | M] () -- C:\Windows\Tasks\Erweiterte Garantie-*****.job [2010.06.19 17:30:00 | 000,000,368 | ---- | M] () -- C:\Windows\Tasks\Recovery DVD Creator-*****.job [2010.06.19 11:54:58 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr [2008.08.11 20:57:22 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt [2007.11.07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt [2007.11.07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt [2007.11.07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt [2008.04.23 17:10:04 | 000,002,916 | ---- | M] () -- C:\files.crc [2007.11.07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini [2010.06.19 11:57:03 | 2010,300,416 | -HS- | M] () -- C:\hiberfil.sys [2007.11.07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe [2007.11.07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini [2007.11.07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll [2007.11.07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll [2007.11.07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll [2007.11.07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll [2007.11.07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll [2007.11.07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll [2007.11.07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll [2007.11.07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll [2007.11.07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll [2008.12.25 23:19:09 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2008.12.25 23:19:09 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010.06.19 11:56:57 | 2324,119,552 | -HS- | M] () -- C:\pagefile.sys [2009.09.01 19:15:46 | 000,000,033 | ---- | M] () -- C:\ProgDVB.ini [2008.08.11 11:41:09 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log [2008.08.11 11:40:28 | 000,000,086 | ---- | M] () -- C:\sis19x.log [2009.10.27 23:25:07 | 000,394,626 | ---- | M] () -- C:\temp.raw [2007.11.07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp [2007.11.07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab [2007.11.07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:31:11 | 015,716,352 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:31:01 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:31:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\drivers\*.sys /90 > [2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.06.19 01:29:23 | 000,047,360 | ---- | M] (VSO Software) -- C:\Windows\System32\drivers\pcouffin.sys < %systemroot%\system32\user32.dll /md5 > [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll < %systemroot%\system32\ws2_32.dll /md5 > [2008.01.21 04:34:36 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList|helpassistant /rs > ========== Alternate Data Streams ========== @Alternate Data Stream - 24 bytes -> C:\Windows:16D6A4F5AB524BFF < End of report > Es kommt/öffnet sich keine Extra.Txt... |
|
19.06.2010, 17:20
| #4 |
| /// Selecta Jahrusso | IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... Bitte
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
19.06.2010, 18:48
| #5 |
| | IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... So... ich hoffe ich habe alles richtig gemacht: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-19 19:36:57
Windows 6.0.6002 Service Pack 2
Running: ef9n80ex.exe; Driver: C:\Users\*****~1\AppData\Local\Temp\afryqaob.sys
---- System - GMER 1.0.15 ----
SSDT A3C9AC9F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 621 81CF9D84 4 Bytes [9F, AC, C9, A3]
? System32\drivers\mojdflll.sys Das System kann den angegebenen Pfad nicht finden. !
C:\Program Files\CyberLink\PlayMovie\000.fcl entry point in "" section [0xA6514000]
.clc C:\Program Files\CyberLink\PlayMovie\000.fcl unknown last section [0xA6515000, 0x1000, 0x00000000]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74787817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [747DA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7478BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7477F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [747875E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7477E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [747B8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7478DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7477FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7477FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [747771CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7480CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [747AC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7477D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74776853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7477687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74782AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd5012c6
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd5012c6@0022988a6041 0x27 0x78 0xC0 0x61 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0009dd5012c6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0009dd5012c6@0022988a6041 0x27 0x78 0xC0 0x61 ...
---- EOF - GMER 1.0.15 ----
|
|
19.06.2010, 19:19
| #6 |
| /// Selecta Jahrusso | IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... Schritt 1 Die *** sind zu editieren.
Code:
ATTFilter :OTL
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
O4 - HKCU..\Run: [Halo2] C:\Users\*****~1\AppData\Local\Temp\sshnas21.DLL File not found
[2010.04.25 17:21:41 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.06.19 01:29:23 | 000,087,608 | ---- | M] () -- C:\Users\*****\AppData\Roaming\inst.exe
@Alternate Data Stream - 24 bytes -> C:\Windows:16D6A4F5AB524BFF
:services
:files
:reg
:Commands
[purity]
[emptytemp]
[reboot]
Schritt 2 Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**  
Schritt 3 Starte bitte OTL.exe. Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button. Bitte poste in Deiner nächsten Antwort Otlfix Log Combofix.txt OTL.txt Extras.txt
__________________ --> IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... |
|
| Themen zu IE öffnet von selber - Malwarebytes & OTL Ergebnisse (folgen)... |
| .dll, anti-malware, appdata, bericht, computer, dateien, explorer, firefox, folge, handle, live, local\temp, logdatei, löschen, m.exe, malwarebytes, microsoft, neustart, protection system, roaming, rogue.protectionsystem, software, start, start menu, system, temp, trojan.fakealert, version, öffnet |
Textbox.
.
Hybrid-Darstellung
