| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus wird nicht erkannt, zerstört aber MusikWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.07.2010, 12:06
| #1 |
| |  Virus wird nicht erkannt, zerstört aber Musik Vor einigen Monaten hatte ich mir auf meinem Rechner einen Virus eingefangen, der in rapidem Tempo Musik zerstört, dabei aber von keinem Virusprogramm erkannt wurde. Damals half mir nur neu aufsetzen - ich war stinksauer, 30GB Daten waren weg. Nun scheine ich denselben Virus wieder erwischt zu haben, denn gestern fiel mir eine Datei auf, die dasselbe Schadensbild zeigt wie damals und wieder erkennt kein Virusprogramm den Übeltäter. Schaden sieht wie folgt aus: Musikdateien werden zerschnitten und die bis zu mehreren Sekunden langen Lücken mit Teilen anderer Lieder gestopft, heraus kommt ein Patchwork unterschiedlicher Lieder, völlig unbrauchbar. Mit Sicherheit kann ich es nicht sagen, aber ich denke es sind davon nur mp3 betroffen. OTL: [quote] OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.07.2010 12:51:17 - Run 2 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\**** 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 286,05 Gb Total Space | 185,73 Gb Free Space | 64,93% Space Free | Partition Type: NTFS Drive D: | 12,04 Gb Total Space | 1,93 Gb Free Space | 16,02% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: *****-PC Current User Name: ****** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\*****\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe () PRC - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe () PRC - C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink) PRC - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\SMINST\BLService.exe () PRC - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\******\OTL.exe (OldTimer Tools) MOD - C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation) MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (ezSharedSvc) -- C:\Windows\SysNative\ezsvc7.dll File not found SRV:64bit: - (TabletServiceWacom) -- C:\Windows\SysNative\Wacom_Tablet.exe () SRV:64bit: - (Ati External Event Utility) -- C:\Windows\SysNative\Ati2evxx.exe () SRV:64bit: - (AESTFilters) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_7af0d372\AESTSr64.exe () SRV:64bit: - (STacSV) -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_7af0d372\STacSV64.exe () SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\Hpservice.exe () SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (TVCapSvc) TV Background Capture Service (TVBCS) -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe () SRV - (TVSched) TV Task Scheduler (TVTS) -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe () SRV - (Recovery Service for Windows) -- C:\Program Files (x86)\SMINST\BLService.exe () SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS) ========== Driver Services (SafeList) ========== DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found DRV:64bit: - (Lbd) -- C:\Windows\SysNative\DRIVERS\Lbd.sys () DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\DRIVERS\wacmoumonitor.sys () DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys () DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\DRIVERS\wacomvhid.sys () DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys () DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys () DRV:64bit: - (STHDA) -- C:\Windows\SysNative\DRIVERS\stwrt64.sys () DRV:64bit: - (athr) -- C:\Windows\SysNative\DRIVERS\athrx.sys () DRV:64bit: - (JMCR) -- C:\Windows\SysNative\DRIVERS\jmcr.sys () DRV:64bit: - (SynTP) -- C:\Windows\SysNative\DRIVERS\SynTP.sys () DRV:64bit: - (enecir) -- C:\Windows\SysNative\DRIVERS\enecir.sys () DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\DRIVERS\usbfilter.sys () DRV:64bit: - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys () DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\DRIVERS\hpdskflt.sys () DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\DRIVERS\Accelerometer.sys () DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys () DRV:64bit: - (NETw3v64) Intel(R) -- C:\Windows\SysNative\DRIVERS\NETw3v64.sys () DRV:64bit: - (sdbus) -- C:\Windows\SysNative\DRIVERS\sdbus.sys () DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys () DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\DRIVERS\wacommousefilter.sys () DRV:64bit: - (yukonx64) -- C:\Windows\SysNative\DRIVERS\yk60x64.sys () DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof () DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) -- C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb IE - HKLM\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O2 - BHO: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O3 - HKCU\..\Toolbar\WebBrowser: (Messenger Plus Live Toolbar) - {9B339F6E-DDCD-401B-8764-230ADBD01761} - C:\Program Files (x86)\Messenger_Plus_Live\tbMess.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O4:64bit: - HKLM..\Run: [SmartMenu] C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard) O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [DVDAgent] C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [TSMAgent] C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [TVAgent] C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O8:64bit: - Extra context menu item: &AOL Toolbar-Suche - C:\ProgramData\AOL\ieToolbar\resources\de-DE\local\search.html () O8 - Extra context menu item: &AOL Toolbar-Suche - C:\ProgramData\AOL\ieToolbar\resources\de-DE\local\search.html () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\maria\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\maria\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.07.15 12:44:05 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\maria\OTL.exe [2010.07.11 20:52:44 | 000,000,000 | ---D | C] -- C:\Users\****\More Than Meets The Eye [2010.07.11 20:52:43 | 000,000,000 | ---D | C] -- C:\Users\****\Micromasters [2010.07.11 20:52:42 | 000,000,000 | ---D | C] -- C:\Users\****\Transformers GI Joe [2010.07.11 20:52:40 | 000,000,000 | ---D | C] -- C:\Users\****\War Within [2010.07.09 22:16:39 | 000,000,000 | ---D | C] -- C:\Users\****\Fanmixes [2010.07.09 15:07:19 | 000,000,000 | ---D | C] -- C:\Users\****\RENOs Fanmixes [2010.07.06 21:41:42 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\Windows\SysWow64\devil.dll [2010.07.06 21:41:42 | 000,369,152 | ---- | C] (The Public) -- C:\Windows\SysWow64\avisynth.dll [2010.07.06 21:41:38 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2010.07.06 21:41:37 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\i420vfw.dll [2010.07.06 21:41:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5 [2010.07.06 21:39:31 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSSplitter.ax [2010.07.06 21:39:30 | 000,186,880 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLOgg.ax [2010.07.06 21:39:30 | 000,092,672 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLVorbisDec.ax [2010.07.06 21:39:30 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSDecoder.ax [2010.07.06 21:39:30 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\Windows\SysWow64\RLTheoraDec.ax [2010.07.06 21:39:29 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\SysWow64\pncrt.dll [2010.07.06 21:39:29 | 000,161,792 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\RealMediaDX.ax [2010.07.06 21:39:28 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\Windows\SysWow64\nbDX.dll [2010.07.06 21:39:28 | 000,169,472 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\MatroskaDX.ax [2010.07.06 21:39:28 | 000,163,328 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\flvDX.dll [2010.07.06 21:39:28 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\Windows\SysWow64\msfDX.dll [2010.07.06 21:39:27 | 000,179,200 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\DiracSplitter.ax [2010.07.06 21:39:26 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\Windows\SysWow64\AVCDX.ax [2010.07.06 21:38:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft [2010.07.04 13:14:28 | 000,000,000 | ---D | C] -- C:\Users\****\Documents\Over his dead body [2010.07.02 13:01:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Software Update Utility [2010.07.01 13:57:09 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\acccore [2010.07.01 13:57:08 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\AIM [2010.07.01 13:56:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AOL [2010.06.30 16:57:26 | 000,000,000 | ---D | C] -- C:\Users\****\Joomla [2010.06.28 02:22:31 | 000,000,000 | ---D | C] -- C:\0a725c7a1e3305d16975b3 [2010.06.28 02:21:12 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2010.06.28 02:21:12 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2010.06.28 02:21:01 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2010.06.28 02:21:00 | 000,428,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2010.06.28 02:21:00 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax [2010.06.28 02:20:42 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll [2010.06.28 02:20:42 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe [2010.06.28 02:20:42 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll [2010.06.28 02:20:42 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll [2010.06.27 21:42:48 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll [2010.06.27 21:42:47 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll ========== Files - Modified Within 30 Days ========== [2010.07.15 12:51:10 | 001,835,008 | -HS- | M] () -- C:\Users\****\NTUSER.DAT [2010.07.15 12:44:05 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\maria\OTL.exe [2010.07.15 12:05:54 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.07.15 12:05:54 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.07.15 12:05:51 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.07.15 12:05:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.07.15 12:05:38 | 4292,698,112 | -HS- | M] () -- C:\hiberfil.sys [2010.07.15 01:55:53 | 000,524,288 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms [2010.07.15 01:55:53 | 000,065,536 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf [2010.07.15 01:55:43 | 002,947,531 | -H-- | M] () -- C:\Users\****\AppData\Local\IconCache.db [2010.07.15 00:55:21 | 000,007,192 | -HS- | M] () -- C:\Users\****\Folder.jpg [2010.07.15 00:55:20 | 000,001,955 | -HS- | M] () -- C:\Users\****\AlbumArtSmall.jpg [2010.07.14 19:10:18 | 000,011,613 | ---- | M] () -- C:\Users\****\Documents\rpg.docx [2010.07.14 18:37:17 | 000,002,655 | ---- | M] () -- C:\Users\****\Desktop\Microsoft Office Word 2007.lnk [2010.07.14 00:21:26 | 004,751,319 | ---- | M] () -- C:\Users\****\Legend.222.Heart of Courage (Choir).mp3 [2010.07.13 22:06:45 | 000,012,185 | ---- | M] () -- C:\Users\****\Documents\-.-.docx [2010.07.13 03:57:55 | 000,100,294 | ---- | M] () -- C:\Users\****\heartlocker.jpg [2010.07.13 03:34:23 | 000,100,294 | ---- | M] () -- C:\Users\****\1278983096998.jpg [2010.07.13 01:27:21 | 000,046,336 | ---- | M] () -- C:\Users\****\1278235722001.jpg [2010.07.13 01:18:05 | 000,056,629 | ---- | M] () -- C:\Users\****\ist2_10332964-tattoo-sun.jpg [2010.07.13 01:16:01 | 000,016,221 | ---- | M] () -- C:\Users\****\sun-tattoo.jpg [2010.07.13 01:13:01 | 000,004,212 | ---- | M] () -- C:\Users\****\nabel_sonne.jpg [2010.07.13 01:02:56 | 000,128,029 | ---- | M] () -- C:\Users\****\1278190866001.jpg [2010.07.12 23:18:13 | 000,818,018 | ---- | M] () -- C:\Users\****\Blacktop Arttrade.jpg [2010.07.12 02:12:06 | 000,346,216 | ---- | M] () -- C:\Users\****\020.jpg [2010.07.11 22:13:59 | 005,648,616 | ---- | M] () -- C:\Users\****\portal_still_alive.mp3 [2010.07.11 21:50:39 | 000,181,773 | ---- | M] () -- C:\Users\****\2z8amtg.jpg.png [2010.07.11 21:36:22 | 000,123,360 | ---- | M] () -- C:\Users\****\megatron-sama.jpg [2010.07.11 21:07:25 | 000,295,246 | ---- | M] () -- C:\Users\****\prettyone.jpg [2010.07.11 12:51:40 | 001,432,482 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.07.11 12:51:40 | 000,623,280 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.07.11 12:51:40 | 000,591,320 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.07.11 12:51:40 | 000,125,378 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.07.11 12:51:40 | 000,103,194 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.07.11 03:15:26 | 000,046,932 | ---- | M] () -- C:\Users\****\Grimlockdarkcreation.jpg [2010.07.10 14:01:40 | 000,007,168 | ---- | M] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.10 03:41:58 | 004,972,672 | ---- | M] () -- C:\Users\****\Ultraviolet Movie OST Opening Theme.mp3 [2010.07.10 03:15:41 | 014,300,760 | ---- | M] () -- C:\Users\****\Room of Angel - Silent Hill 4 OST.mp3 [2010.07.10 03:11:54 | 007,626,752 | ---- | M] () -- C:\Users\****\Hometown - Joe Romersa.mp3 [2010.07.10 03:08:01 | 004,587,556 | ---- | M] () -- C:\Users\****\You're not here - Silent Hill 3 OST.wma [2010.07.10 03:05:20 | 003,298,524 | ---- | M] () -- C:\Users\****\Theme of Laura - Silent Hill 2 OST.wma [2010.07.10 03:05:09 | 002,848,946 | ---- | M] () -- C:\Users\****\14 Never Forgive Me, Never Forget Me.wma [2010.07.10 03:01:44 | 002,536,934 | ---- | M] () -- C:\Users\****\15 - promis(reprise).mp3 [2010.07.09 15:06:54 | 000,014,435 | -HS- | M] () -- C:\Users\****\AlbumArt_{899676C3-2B2A-48B6-B8E5-3F2B4C81911C}_Large.jpg [2010.07.09 15:06:52 | 000,003,102 | -HS- | M] () -- C:\Users\****\AlbumArt_{899676C3-2B2A-48B6-B8E5-3F2B4C81911C}_Small.jpg [2010.07.09 00:54:01 | 000,003,486 | -HS- | M] () -- C:\Users\****\AlbumArt_{B74A2828-73C3-4F5D-AA62-7FC8D9094559}_Large.jpg [2010.07.09 00:54:01 | 000,001,324 | -HS- | M] () -- C:\Users\****\AlbumArt_{B74A2828-73C3-4F5D-AA62-7FC8D9094559}_Small.jpg [2010.07.09 00:02:19 | 000,007,765 | -HS- | M] () -- C:\Users\****\AlbumArt_{0A91A971-6B62-421C-97EC-C6A9E38414D0}_Large.jpg [2010.07.09 00:02:08 | 000,001,977 | -HS- | M] () -- C:\Users\****\AlbumArt_{0A91A971-6B62-421C-97EC-C6A9E38414D0}_Small.jpg [2010.07.08 23:48:11 | 009,271,872 | ---- | M] () -- C:\Users\****\08 Hellrider.wma [2010.07.08 23:35:07 | 000,008,919 | -HS- | M] () -- C:\Users\****\AlbumArt_{A0449866-777E-4DB7-935D-4DF488E93A29}_Large.jpg [2010.07.08 23:35:07 | 000,002,413 | -HS- | M] () -- C:\Users\****\AlbumArt_{A0449866-777E-4DB7-935D-4DF488E93A29}_Small.jpg [2010.07.08 19:50:43 | 000,003,771 | ---- | M] () -- C:\Users\****\5193859.jpg [2010.07.06 21:39:32 | 000,001,883 | ---- | M] () -- C:\Users\Public\Desktop\SUPER © Uninstall.lnk [2010.07.06 21:39:32 | 000,001,859 | ---- | M] () -- C:\Users\Public\Desktop\SUPER ©.lnk [2010.07.06 02:05:21 | 000,121,761 | ---- | M] () -- C:\Users\****\hornoxe.com_picdump161_016.jpg [2010.07.04 04:18:24 | 000,010,553 | ---- | M] () -- C:\Users\****\Documents\after that....docx [2010.07.02 13:01:24 | 000,000,720 | -H-- | M] () -- C:\IPH.PH [2010.06.30 16:55:39 | 007,009,864 | ---- | M] () -- C:\Users\****\Joomla_1.5.18-Stable-Full_Package_German.zip [2010.06.17 17:01:52 | 000,012,204 | ---- | M] () -- C:\Users\****\Documents\Skelettmuskulatur.docx ========== Files Created - No Company Name ========== [2010.07.15 12:49:00 | 000,060,630 | ---- | C] () -- C:\Users\*****\Extras.Txt [2010.07.15 12:48:15 | 000,071,476 | ---- | C] () -- C:\Users\*****\OTL.Txt [2010.07.14 00:18:22 | 004,751,319 | ---- | C] () -- C:\Users\*****\Legend.222.Heart of Courage (Choir).mp3 [2010.07.13 22:06:26 | 000,012,185 | ---- | C] () -- C:\Users\*****\Documents\-.-.docx [2010.07.13 03:57:55 | 000,100,294 | ---- | C] () -- C:\Users\*****\heartlocker.jpg [2010.07.13 03:34:23 | 000,100,294 | ---- | C] () -- C:\Users\*****\1278983096998.jpg [2010.07.13 01:27:18 | 000,046,336 | ---- | C] () -- C:\Users\*****\1278235722001.jpg [2010.07.13 01:18:05 | 000,056,629 | ---- | C] () -- C:\Users\*****\ist2_10332964-tattoo-sun.jpg [2010.07.13 01:16:01 | 000,016,221 | ---- | C] () -- C:\Users\*****\sun-tattoo.jpg [2010.07.13 01:13:00 | 000,004,212 | ---- | C] () -- C:\Users\*****\nabel_sonne.jpg [2010.07.13 01:02:44 | 000,128,029 | ---- | C] () -- C:\Users\*****\1278190866001.jpg [2010.07.12 23:16:03 | 000,818,018 | ---- | C] () -- C:\Users\*****\Blacktop Arttrade.jpg [2010.07.12 02:11:57 | 000,346,216 | ---- | C] () -- C:\Users\*****\020.jpg [2010.07.11 22:13:42 | 005,648,616 | ---- | C] () -- C:\Users\*****\portal_still_alive.mp3 [2010.07.11 21:50:21 | 000,181,773 | ---- | C] () -- C:\Users\*****\2z8amtg.jpg.png [2010.07.11 21:35:52 | 000,123,360 | ---- | C] () -- C:\Users\*****\megatron-sama.jpg [2010.07.11 21:07:24 | 000,295,246 | ---- | C] () -- C:\Users\*****\prettyone.jpg [2010.07.11 03:15:26 | 000,046,932 | ---- | C] () -- C:\Users\*****\Grimlockdarkcreation.jpg [2010.07.10 03:39:43 | 004,972,672 | ---- | C] () -- C:\Users\*****\Ultraviolet Movie OST Opening Theme.mp3 [2010.07.10 02:45:10 | 002,536,934 | ---- | C] () -- C:\Users\*****\15 - promis(reprise).mp3 [2010.07.10 02:45:06 | 002,848,946 | ---- | C] () -- C:\Users\*****\14 Never Forgive Me, Never Forget Me.wma [2010.07.10 02:45:03 | 007,626,752 | ---- | C] () -- C:\Users\*****\Hometown - Joe Romersa.mp3 [2010.07.10 02:45:00 | 014,300,760 | ---- | C] () -- C:\Users\*****\Room of Angel - Silent Hill 4 OST.mp3 [2010.07.10 02:45:00 | 004,587,556 | ---- | C] () -- C:\Users\*****\You're not here - Silent Hill 3 OST.wma [2010.07.10 02:45:00 | 003,298,524 | ---- | C] () -- C:\Users\*****\Theme of Laura - Silent Hill 2 OST.wma [2010.07.09 15:06:56 | 000,014,435 | -HS- | C] () -- C:\Users\*****\AlbumArt_{899676C3-2B2A-48B6-B8E5-3F2B4C81911C}_Large.jpg [2010.07.09 15:06:55 | 000,003,102 | -HS- | C] () -- C:\Users\*****\AlbumArt_{899676C3-2B2A-48B6-B8E5-3F2B4C81911C}_Small.jpg [2010.07.09 00:54:02 | 000,003,486 | -HS- | C] () -- C:\Users\*****\AlbumArt_{B74A2828-73C3-4F5D-AA62-7FC8D9094559}_Large.jpg [2010.07.09 00:54:02 | 000,001,324 | -HS- | C] () -- C:\Users\*****\AlbumArt_{B74A2828-73C3-4F5D-AA62-7FC8D9094559}_Small.jpg [2010.07.09 00:02:24 | 000,007,765 | -HS- | C] () -- C:\Users\*****\AlbumArt_{0A91A971-6B62-421C-97EC-C6A9E38414D0}_Large.jpg [2010.07.09 00:02:24 | 000,001,977 | -HS- | C] () -- C:\Users\*****\AlbumArt_{0A91A971-6B62-421C-97EC-C6A9E38414D0}_Small.jpg [2010.07.08 23:43:32 | 009,271,872 | ---- | C] () -- C:\Users\*****\08 Hellrider.wma [2010.07.08 23:35:37 | 000,008,919 | -HS- | C] () -- C:\Users\*****\AlbumArt_{A0449866-777E-4DB7-935D-4DF488E93A29}_Large.jpg [2010.07.08 23:35:37 | 000,007,192 | -HS- | C] () -- C:\Users\*****\Folder.jpg [2010.07.08 23:35:37 | 000,002,413 | -HS- | C] () -- C:\Users\*****\AlbumArt_{A0449866-777E-4DB7-935D-4DF488E93A29}_Small.jpg [2010.07.08 23:35:37 | 000,001,955 | -HS- | C] () -- C:\Users\*****\AlbumArtSmall.jpg [2010.07.08 19:50:43 | 000,003,771 | ---- | C] () -- C:\Users\*****\5193859.jpg [2010.07.06 21:41:38 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2010.07.06 21:39:32 | 000,001,883 | ---- | C] () -- C:\Users\Public\Desktop\SUPER © Uninstall.lnk [2010.07.06 21:39:32 | 000,001,859 | ---- | C] () -- C:\Users\Public\Desktop\SUPER ©.lnk [2010.07.06 21:39:30 | 000,051,712 | RHS- | C] () -- C:\Windows\SysWow64\RLSpeexDec.ax [2010.07.06 21:39:29 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\RLMPCDec.ax [2010.07.06 21:39:29 | 000,070,656 | RHS- | C] () -- C:\Windows\SysWow64\RLAPEDec.ax [2010.07.06 21:39:28 | 000,120,832 | RHS- | C] () -- C:\Windows\SysWow64\MPCDx.ax [2010.07.06 21:39:27 | 000,175,104 | RHS- | C] () -- C:\Windows\SysWow64\CoreAAC.ax [2010.07.06 21:39:27 | 000,097,280 | RHS- | C] () -- C:\Windows\SysWow64\FLACDX.ax [2010.07.06 21:39:26 | 000,227,328 | RHS- | C] () -- C:\Windows\SysWow64\ac3DX.ax [2010.07.06 21:39:26 | 000,081,920 | RHS- | C] () -- C:\Windows\SysWow64\aac_parser.ax [2010.07.06 02:05:13 | 000,121,761 | ---- | C] () -- C:\Users\*****\hornoxe.com_picdump161_016.jpg [2010.07.04 04:18:17 | 000,010,553 | ---- | C] () -- C:\Users\*****\Documents\after that....docx [2010.07.01 13:55:52 | 000,000,720 | -H-- | C] () -- C:\IPH.PH [2010.06.30 16:55:01 | 007,009,864 | ---- | C] () -- C:\Users\*****\Joomla_1.5.18-Stable-Full_Package_German.zip [2010.06.28 02:21:12 | 000,227,328 | ---- | C] () -- C:\Windows\SysNative\mpg2splt.ax [2010.06.28 02:21:12 | 000,101,376 | ---- | C] () -- C:\Windows\SysNative\MSNP.ax [2010.06.28 02:21:00 | 000,558,592 | ---- | C] () -- C:\Windows\SysNative\EncDec.dll [2010.06.28 02:21:00 | 000,375,808 | ---- | C] () -- C:\Windows\SysNative\psisdecd.dll [2010.06.28 02:21:00 | 000,289,792 | ---- | C] () -- C:\Windows\SysNative\psisrndr.ax [2010.06.28 02:20:42 | 001,942,856 | ---- | C] () -- C:\Windows\SysNative\dfshim.dll [2010.06.28 02:20:42 | 000,444,752 | ---- | C] () -- C:\Windows\SysNative\mscoree.dll [2010.06.28 02:20:42 | 000,320,352 | ---- | C] () -- C:\Windows\SysNative\PresentationHost.exe [2010.06.28 02:20:42 | 000,109,912 | ---- | C] () -- C:\Windows\SysNative\PresentationHostProxy.dll [2010.06.28 02:20:42 | 000,048,960 | ---- | C] () -- C:\Windows\SysNative\netfxperf.dll [2010.06.27 21:42:48 | 000,032,256 | ---- | C] () -- C:\Windows\SysNative\Apphlpdm.dll [2010.06.27 21:42:47 | 004,240,384 | ---- | C] () -- C:\Windows\SysNative\GameUXLegacyGDFs.dll [2010.06.17 16:45:20 | 000,012,204 | ---- | C] () -- C:\Users\*****\Documents\Skelettmuskulatur.docx [2008.01.21 04:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini [2008.01.21 04:49:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll < End of report > |
|
15.07.2010, 14:23
| #2 |
 | Virus wird nicht erkannt, zerstört aber Musik Dann setz dein System neu auf.
__________________Wenn es dir Schonmal Geholfen hat dann mach es wieder  Ich kann dazu nichts sagen kenne so einen "Virus" Nicht. Ich würde sagen pass mal in Zukunft auf. |
|
15.07.2010, 15:17
| #3 | |
| | Virus wird nicht erkannt, zerstört aber MusikZitat:
Genau das will ich ja vermeiden. Es sind Daten auf diesem Computer, wichtige Daten, die ich eigentlich so bald als möglich sichern wollte - leider kam mir der Virus scheints zuvor. Das nennt man wohl Pech. Wenn irgendjemand eine Lösung wüsste, bei der ich nicht komplett alles verliere, wäre ich wirklich sehr dankbar. |
|
| Themen zu Virus wird nicht erkannt, zerstört aber Musik |
| ad-aware, antivir, autorun, avgntflt.sys, avira, bho, black, conduit, defender, desktop, error, explorer, format, home, home premium, intranet, location, logfile, microsoft, microsoft office word, mp3, musik, neu, neu aufsetzen, oldtimer, opera, opera.exe, otl.exe, plug-in, programdata, programme, registry, sched.exe, sekunden, senden, service pack 1, sicherheit, software, super, syswow64, virus, virus eingefangen, virus wird nicht erkannt, virusprogramm, vista, wird nicht erkannt |
Linear-Darstellung
