Antivir findet "TR/Spy.Browse.A" / Onelinebanking-Attacke

Dan_s_deal · 19.08.2010, 07:18

hallo,

hab ich jeweils installiert (reicht Dir das als Bericht, oder willst Du ein log-file? ; ) ) Was würdst Du denn anstelle des flash-player installieren?? Ist es jetzt wieder sicher, online-banking zu machen (mit neuen passwords)?

Viele Grüße,
Daniel

Larusso · 19.08.2010, 17:00

Online Banking ist nie sicher. Anstelle von Flash Player. Naja ich nutze den auch

Starte bitte OTL und lass einen QuickScan laufen.

Dan_s_deal · 19.08.2010, 20:38

...das geht ja immer schnell bei Dir! Danke!

hier der Report von OTL-Quick-Scan:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 19.08.2010 21:27:13 - Run 5
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 50,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 23,77 Gb Free Space | 34,07% Space Free | Partition Type: NTFS
Drive D: | 66,27 Gb Total Space | 22,08 Gb Free Space | 33,32% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 7,14 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ASPIRE
Current User Name: ***
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\TUProgSt.exe (TuneUp Software GmbH)
PRC - C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Acer\Empowering Technology\eAudio\eAudio.exe (CyberLink)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.)
PRC - C:\Acer\ALaunch\ALaunchSvc.exe ()
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Programme\Agnitum\Outpost Firewall Pro\wl_hook.dll (Agnitum Ltd.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (acssrv) -- C:\Programme\Agnitum\Outpost Firewall Pro\acs.exe (Agnitum Ltd.)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\System32\TUProgSt.exe (TuneUp Software GmbH)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (eSettingsService) -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (eNet Service) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
SRV - (WMIService) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eDataSecurity Service) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eLockService) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ALaunchService) -- C:\Acer\ALaunch\ALaunchSvc.exe ()
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (SandBox) -- C:\Windows\System32\drivers\SandBox.sys (Agnitum Ltd.)
DRV - (ASWFilt) -- C:\Windows\System32\Filt\ASWFilt.dll (Agnitum Ltd.)
DRV - (afwcore) -- C:\Windows\System32\drivers\afwcore.sys (Agnitum Ltd.)
DRV - (afw) -- C:\Windows\System32\drivers\afw.sys (Agnitum Ltd.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (PSDNServ) -- C:\Windows\system32\drivers\PSDNServ.sys (HiTRUST)
DRV - (psdvdisk) -- C:\Windows\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (HiTRUST)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (int15) -- C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\Play Movie\000.fcl (Cyberlink Corp.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (Hardlock) -- C:\Windows\System32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (aksusb) -- C:\Windows\System32\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV - (akshasp) -- C:\Windows\System32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1351351
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic Deutsch Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1351351&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "hxxp://www.faz.de/"
FF - prefs.js..extensions.enabledItems: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c}:2.7.1.3
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.2.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1351351&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.08.05 18:12:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.18 17:19:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.05.13 01:03:12 | 000,000,000 | ---D | M]
 
[2008.09.14 15:55:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2010.08.19 16:08:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\axex7f1h.default\extensions
[2010.08.19 16:08:48 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\axex7f1h.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.05 23:23:55 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\axex7f1h.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.07.20 10:22:20 | 000,000,000 | ---D | M] (Softonic Deutsch Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\axex7f1h.default\extensions\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}
[2010.07.21 14:12:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\axex7f1h.default\extensions\2020Player@2020Technologies.com
[2010.06.14 14:16:56 | 000,000,935 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\axex7f1h.default\searchplugins\conduit.xml
[2010.08.18 16:54:55 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.10.11 12:46:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
[2010.08.18 16:54:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2008.09.14 15:55:49 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla.org
[2010.08.18 16:54:33 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.08.05 18:11:59 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.05 18:11:59 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.08.05 18:11:59 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.08.05 18:11:59 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.08.05 18:11:59 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (PCCBHO.CPCCBHO) - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Programme\Winferno\PC Confidential\PCCBHO.dll (Capital Intellect Inc)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eAudio] C:\Acer\Empowering Technology\eAudio\eAudio.exe (CyberLink)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe (Agnitum Ltd.)
O4 - HKLM..\Run: [OutpostMonitor] C:\Programme\Agnitum\Outpost Firewall Pro\op_mon.exe (Agnitum Ltd.)
O4 - HKLM..\Run: [PLFSet] C:\Windows\PLFSet.DLL ( )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Programme\ERUNT\AUTOBACK.EXE ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay =  [binary data]
O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc)
O9 - Extra Button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Programme\Winferno\PC Confidential\PCConfidential.exe (Capital Intellect, Inc)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: google.de ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\agnitum\outpos~1\wl_hook.dll) - c:\Programme\Agnitum\Outpost Firewall Pro\wl_hook.dll (Agnitum Ltd.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0ddd98fb-5b28-11dd-8d0f-b219bb007dd3}\Shell\AutoRun\command - "" = E:\SJELO\\smrcebelo.exe -- File not found
O33 - MountPoints2\{0ddd98fb-5b28-11dd-8d0f-b219bb007dd3}\Shell\open\command - "" = E:\SJELO\\smrcebelo.exe -- File not found
O33 - MountPoints2\{ae82bbf4-6350-11df-a0fc-f6c5c4869bfb}\Shell - "" = AutoRun
O33 - MountPoints2\{ae82bbf4-6350-11df-a0fc-f6c5c4869bfb}\Shell\AutoRun\command - "" = E:\LapNetWizard.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.08.19 19:28:11 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices
[2010.08.18 23:30:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2010.08.18 23:30:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2010.08.18 23:30:08 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2010.08.18 23:24:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2010.08.18 22:56:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2010.08.18 22:09:00 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2010.08.18 21:11:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\WindowsUpdate
[2010.08.18 17:08:15 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2010.08.18 10:05:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Yahoo
[2010.08.12 12:24:28 | 000,378,880 | ---- | C] (The RaProducts Team: Paul McLain and Fred de Vries) -- C:\Users\***\Desktop\JavaRa.exe
[2010.08.12 12:24:28 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\JavaRa
[2010.08.10 15:07:55 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2010.08.10 15:07:49 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010.08.10 15:07:49 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2010.08.10 15:07:49 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntdd.sys
[2010.08.10 15:07:49 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntmgr.sys
[2010.08.10 15:07:44 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2010.08.10 15:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2010.08.10 01:29:09 | 000,713,672 | ---- | C] (Agnitum Ltd.) -- C:\Windows\System32\drivers\SandBox.sys
[2010.08.10 01:26:47 | 000,328,296 | ---- | C] (Agnitum Ltd.) -- C:\Windows\System32\drivers\afwcore.sys
[2010.08.10 01:26:23 | 000,000,000 | ---D | C] -- C:\Windows\System32\Filt
[2010.08.10 01:26:21 | 000,034,920 | ---- | C] (Agnitum Ltd.) -- C:\Windows\System32\drivers\afw.sys
[2010.08.10 01:26:04 | 000,000,000 | ---D | C] -- C:\Programme\Agnitum
[2010.08.10 00:29:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Agnitum
[2010.08.09 23:56:54 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group
[2010.08.08 11:37:39 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Gmer
[2010.08.07 15:47:49 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.08.07 15:26:49 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2010.08.07 14:58:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2010.08.07 14:58:08 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.07 14:58:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.07 14:58:05 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.07 14:58:05 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.07 14:56:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.08.07 14:54:24 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\MFTools
[2010.08.05 23:24:13 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\FinalMediaPlayer
[2010.08.05 23:24:10 | 000,000,000 | ---D | C] -- C:\Programme\FinalMediaPlayer
[2010.08.05 23:24:06 | 000,000,000 | ---D | C] -- C:\Programme\Free Offers from Freeze.com
[2010.08.05 23:24:04 | 000,835,584 | ---- | C] (Capital Intellect Inc) -- C:\Windows\System32\WINCTL4.OCX
[2010.08.05 23:24:04 | 000,495,616 | ---- | C] (Capital Intellect Inc) -- C:\Windows\System32\WINUTIL5.DLL
[2010.08.05 23:24:04 | 000,393,216 | ---- | C] (Capital Intellect Inc) -- C:\Windows\System32\WINLCTL5.DLL
[2010.08.05 23:24:04 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Winferno
[2010.08.05 23:24:01 | 000,000,000 | ---D | C] -- C:\Programme\Winferno
[2010.08.05 23:23:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
[2010.08.05 23:23:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Yahoo!
[2010.08.03 23:23:17 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Bilder Opp55
[2010.08.03 17:54:20 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PC Tools
[2010.07.21 12:41:33 | 000,000,000 | ---D | C] -- C:\Programme\Sweet Home 3D
[2010.07.20 10:22:22 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.07.20 10:22:21 | 000,000,000 | ---D | C] -- C:\Programme\Softonic_Deutsch
[2007.09.15 10:14:24 | 000,172,032 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2007.09.15 10:14:24 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2007.08.14 14:51:31 | 000,045,056 | ---- | C] ( ) -- C:\Windows\PLFSet.dll
[2007.08.14 07:11:40 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
 
========== Files - Modified Within 90 Days ==========
 
[2010.08.19 21:26:23 | 003,932,160 | ---- | M] () -- C:\Users\***\NTUSER.DAT
[2010.08.19 21:00:00 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2010.08.19 19:39:21 | 001,445,894 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.19 19:39:21 | 000,628,374 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.19 19:39:21 | 000,595,506 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.19 19:39:21 | 000,127,238 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.19 19:39:21 | 000,104,940 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.19 19:32:57 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job
[2010.08.19 19:32:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.19 19:32:17 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.19 19:31:40 | 008,405,015 | ---- | M] () -- C:\Windows\TempFile
[2010.08.19 19:31:34 | 000,382,248 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.19 19:31:32 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.19 19:31:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.19 19:30:22 | 2137,448,448 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.19 19:22:36 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2010.08.19 19:22:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010.08.19 17:06:16 | 000,524,288 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{e4fcb0b7-cd1f-11dd-9ee3-90259bfdf3e7}.TMContainer00000000000000000001.regtrans-ms
[2010.08.19 17:06:16 | 000,065,536 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{e4fcb0b7-cd1f-11dd-9ee3-90259bfdf3e7}.TM.blf
[2010.08.19 09:30:02 | 001,872,955 | -H-- | M] () -- C:\Users\***\AppData\Local\IconCache.db
[2010.08.19 09:23:40 | 000,102,864 | ---- | M] () -- C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.19 08:27:21 | 000,000,219 | ---- | M] () -- C:\Windows\win.ini
[2010.08.18 23:28:47 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.18 23:28:20 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2010.08.18 22:27:06 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest
[2010.08.18 21:50:29 | 000,101,888 | ---- | M] (Infineon Technologies AG) -- C:\Windows\System32\ifxcardm.dll
[2010.08.18 21:50:22 | 000,082,432 | ---- | M] (Gemalto, Inc.) -- C:\Windows\System32\axaltocm.dll
[2010.08.18 17:19:22 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.08.18 15:48:37 | 000,003,127 | ---- | M] () -- C:\Users\***\Desktop\Nederlands.lng
[2010.08.18 15:48:37 | 000,002,553 | ---- | M] () -- C:\Users\***\Desktop\Suomi.lng
[2010.08.18 15:48:36 | 000,378,880 | ---- | M] (The RaProducts Team: Paul McLain and Fred de Vries) -- C:\Users\***\Desktop\JavaRa.exe
[2010.08.18 15:48:35 | 000,322,351 | ---- | M] () -- C:\Users\***\Desktop\JavaRa.def
[2010.08.18 15:48:34 | 000,003,027 | ---- | M] () -- C:\Users\***\Desktop\Français.lng
[2010.08.18 15:48:34 | 000,002,920 | ---- | M] () -- C:\Users\***\Desktop\Italiano.lng
[2010.08.18 15:48:33 | 000,002,946 | ---- | M] () -- C:\Users\***\Desktop\Español.lng
[2010.08.18 15:48:30 | 000,002,758 | ---- | M] () -- C:\Users\***\Desktop\Deutsch.lng
[2010.08.18 15:47:31 | 000,156,329 | ---- | M] () -- C:\Users\***\Desktop\JavaRa.zip
[2010.08.18 15:26:08 | 000,001,593 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2010.08.13 12:47:18 | 000,013,362 | ---- | M] () -- C:\Users\***\Desktop\Ehe aus Schwamm.docx
[2010.08.12 16:28:21 | 000,020,992 | ---- | M] () -- C:\Users\***\Desktop\Kalender.xls
[2010.08.12 15:08:23 | 000,869,051 | ---- | M] () -- C:\Users\***\Desktop\SecurityCheck.exe
[2010.08.12 12:47:45 | 002,672,312 | ---- | M] () -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2010.08.10 15:08:15 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010.08.09 09:47:57 | 407,669,089 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.08.08 11:35:01 | 000,010,749 | ---- | M] () -- C:\Users\***\Desktop\Malwarebytes.docx
[2010.08.07 15:39:25 | 000,513,722 | ---- | M] () -- C:\Users\***\Desktop\Fehlermeldung.bmp
[2010.08.07 15:27:05 | 000,000,917 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010.08.07 15:26:49 | 000,000,737 | ---- | M] () -- C:\Users\***\Desktop\NTREGOPT.lnk
[2010.08.07 15:26:49 | 000,000,718 | ---- | M] () -- C:\Users\***\Desktop\ERUNT.lnk
[2010.08.07 14:58:10 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.07 14:56:24 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.08.07 14:56:12 | 000,284,915 | ---- | M] () -- C:\Users\***\Desktop\Gmer.zip
[2010.08.07 14:52:28 | 000,411,356 | ---- | M] () -- C:\Users\***\Desktop\Load.exe
[2010.08.05 23:20:21 | 000,020,992 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.02 23:09:51 | 000,000,662 | ---- | M] () -- C:\Users\***\Desktop\tools.lnk
[2010.08.02 11:20:25 | 001,132,614 | ---- | M] () -- C:\Users\***\Desktop\Trojaner.bmp
[2010.07.23 10:56:04 | 000,713,672 | ---- | M] (Agnitum Ltd.) -- C:\Windows\System32\drivers\SandBox.sys
[2010.07.21 14:52:40 | 000,000,049 | ---- | M] () -- C:\Windows\transp.gif
[2010.07.21 13:35:23 | 001,036,040 | ---- | M] () -- C:\Users\***\Documents\Küche.sh3d
[2010.07.14 23:12:20 | 000,704,224 | ---- | M] () -- C:\Users\***\Desktop\Eine Ehe aus Schwamm.pdf
[2010.06.15 20:38:14 | 000,018,944 | ---- | M] () -- C:\Users\***\Desktop\2DO.xls
[2010.05.27 19:28:57 | 000,080,229 | ---- | M] () -- C:\Users\***\Documents\Präsentation1.pptx
 
========== Files Created - No Company Name ==========
 
[2010.08.19 19:22:36 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2010.08.19 19:22:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2010.08.18 23:28:47 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.18 23:28:20 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2010.08.18 23:01:54 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2010.08.18 23:01:52 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2010.08.18 23:01:52 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2010.08.18 23:01:43 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2010.08.18 23:01:41 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.08.18 23:01:39 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2010.08.18 23:00:59 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex
[2010.08.18 23:00:57 | 003,662,128 | ---- | C] () -- C:\Windows\System32\locale.nls
[2010.08.18 23:00:55 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2010.08.18 23:00:11 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.08.18 23:00:11 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.08.18 22:59:57 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2010.08.18 22:59:55 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2010.08.18 22:59:45 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2010.08.18 17:19:22 | 000,001,891 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.08.18 15:47:30 | 000,156,329 | ---- | C] () -- C:\Users\***\Desktop\JavaRa.zip
[2010.08.18 15:26:08 | 000,001,593 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2010.08.18 12:47:40 | 000,030,208 | ---- | C] () -- C:\Users\***\Desktop\LebenslaufBewerb09_V2.0.doc
[2010.08.18 12:47:37 | 000,021,504 | ---- | C] () -- C:\Users\***\Desktop\AnschreibenBewerbung_D_V1.doc
[2010.08.18 10:36:14 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2010.08.18 10:32:25 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2010.08.18 10:32:23 | 000,015,181 | ---- | C] () -- C:\Windows\System32\gatherWirelessInfo.vbs
[2010.08.12 15:08:18 | 000,869,051 | ---- | C] () -- C:\Users\***\Desktop\SecurityCheck.exe
[2010.08.12 12:47:40 | 002,672,312 | ---- | C] () -- C:\Users\***\Desktop\esetsmartinstaller_enu.exe
[2010.08.12 12:24:28 | 000,322,351 | ---- | C] () -- C:\Users\***\Desktop\JavaRa.def
[2010.08.12 12:24:28 | 000,003,127 | ---- | C] () -- C:\Users\***\Desktop\Nederlands.lng
[2010.08.12 12:24:28 | 000,003,027 | ---- | C] () -- C:\Users\***\Desktop\Français.lng
[2010.08.12 12:24:28 | 000,002,946 | ---- | C] () -- C:\Users\***\Desktop\Español.lng
[2010.08.12 12:24:28 | 000,002,920 | ---- | C] () -- C:\Users\***\Desktop\Italiano.lng
[2010.08.12 12:24:28 | 000,002,758 | ---- | C] () -- C:\Users\***\Desktop\Deutsch.lng
[2010.08.12 12:24:28 | 000,002,553 | ---- | C] () -- C:\Users\***\Desktop\Suomi.lng
[2010.08.10 15:08:15 | 000,001,851 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010.08.10 01:26:25 | 000,000,049 | ---- | C] () -- C:\Windows\transp.gif
[2010.08.08 22:56:20 | 000,013,362 | ---- | C] () -- C:\Users\***\Desktop\Ehe aus Schwamm.docx
[2010.08.08 11:37:39 | 000,293,376 | ---- | C] () -- C:\Users\***\Desktop\gmer.exe
[2010.08.08 11:35:00 | 000,010,749 | ---- | C] () -- C:\Users\***\Desktop\Malwarebytes.docx
[2010.08.07 15:39:25 | 000,513,722 | ---- | C] () -- C:\Users\***\Desktop\Fehlermeldung.bmp
[2010.08.07 15:27:05 | 000,000,917 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010.08.07 15:26:49 | 000,000,737 | ---- | C] () -- C:\Users\***\Desktop\NTREGOPT.lnk
[2010.08.07 15:26:49 | 000,000,718 | ---- | C] () -- C:\Users\***\Desktop\ERUNT.lnk
[2010.08.07 14:58:10 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.07 14:56:07 | 000,284,915 | ---- | C] () -- C:\Users\***\Desktop\Gmer.zip
[2010.08.07 14:52:27 | 000,411,356 | ---- | C] () -- C:\Users\***\Desktop\Load.exe
[2010.08.05 23:24:08 | 000,000,416 | ---- | C] () -- C:\Windows\tasks\PCConfidential.job
[2010.08.02 23:09:59 | 000,000,662 | ---- | C] () -- C:\Users\***\Desktop\tools.lnk
[2010.08.02 11:20:25 | 001,132,614 | ---- | C] () -- C:\Users\***\Desktop\Trojaner.bmp
[2010.07.21 13:35:23 | 001,036,040 | ---- | C] () -- C:\Users\***\Documents\Küche.sh3d
[2010.07.21 12:50:44 | 000,020,992 | ---- | C] () -- C:\Users\***\Desktop\Kalender.xls
[2010.07.14 23:12:20 | 000,704,224 | ---- | C] () -- C:\Users\***\Desktop\Eine Ehe aus Schwamm.pdf
[2010.06.15 20:38:14 | 000,018,944 | ---- | C] () -- C:\Users\***\Desktop\2DO.xls
[2010.05.27 19:28:56 | 000,080,229 | ---- | C] () -- C:\Users\***\Documents\Präsentation1.pptx
[2009.03.31 18:59:52 | 000,000,055 | ---- | C] () -- C:\Windows\videotoaudio.ini
[2008.08.06 19:26:48 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2008.08.06 19:26:48 | 000,090,112 | ---- | C] () -- C:\Windows\System32\LxUtl10.dll
[2008.08.06 19:26:47 | 000,131,072 | ---- | C] () -- C:\Windows\System32\BH_DATA100VC7.dll
[2008.01.02 17:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008.01.02 17:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008.01.02 17:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008.01.02 17:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007.09.15 20:09:46 | 000,000,030 | ---- | C] () -- C:\Windows\SetPanel.ini
[2007.09.15 20:09:28 | 000,000,092 | ---- | C] () -- C:\Windows\CLEANUP.INI
[2007.09.15 10:13:45 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.08.14 17:19:28 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.08.14 14:51:39 | 000,910,720 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007.08.14 14:51:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1280.dll
[2007.08.14 14:51:31 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.08.14 14:49:11 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.08.14 07:17:30 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2007.08.14 07:17:30 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2007.08.14 07:16:50 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2007.08.14 07:11:35 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.08.14 06:19:33 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007.04.25 16:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.04.25 16:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.04.25 16:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.04.25 16:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.04.25 16:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.04.25 16:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.12.10 15:52:04 | 000,397,312 | ---- | C] () -- C:\Windows\System32\BH_DATA100VC8.dll
[2006.11.04 03:58:02 | 000,057,344 | ---- | C] () -- C:\Windows\System32\FKStampPainter20.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.09.29 15:12:12 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2006.09.24 21:04:42 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2006.09.24 21:03:32 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2006.09.21 13:53:28 | 000,282,679 | ---- | C] () -- C:\Windows\System32\dnt27.dll
[2006.09.21 13:52:24 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc27.dll
[2006.09.21 13:52:14 | 000,077,881 | ---- | C] () -- C:\Windows\System32\dntvm27.dll
[2006.04.21 11:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll
[2005.11.09 12:13:48 | 000,282,624 | ---- | C] () -- C:\Windows\System32\dnt27VC7.dll
[2005.11.09 12:11:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvmc27VC7.dll
[2005.11.09 12:11:30 | 000,077,824 | ---- | C] () -- C:\Windows\System32\dntvm27VC7.dll
[2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.10.10 08:57:58 | 000,073,786 | ---- | C] () -- C:\Windows\System32\dntvmc23.dll
[2001.10.10 08:57:58 | 000,061,497 | ---- | C] () -- C:\Windows\System32\dntvm23.dll
[2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[2001.03.07 08:02:30 | 000,229,431 | ---- | C] () -- C:\Windows\System32\dnt23.dll
 
========== LOP Check ==========
 
[2009.10.11 14:15:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Academic Software Zurich
[2008.01.18 20:02:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Acer
[2010.08.06 08:23:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FinalMediaPlayer
[2008.07.24 16:07:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GHISLER
[2008.08.09 15:17:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Haufe
[2010.01.08 14:26:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\JGsoft
[2008.08.06 19:24:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lexware
[2008.09.16 21:06:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2008.01.20 16:59:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2008.01.18 19:40:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2008.12.14 12:48:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software
[2008.02.17 16:14:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Wizards of the Coast
[2010.08.19 21:00:00 | 000,000,506 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2010.08.19 19:32:57 | 000,000,416 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job
[2010.08.19 19:28:54 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:5711EF65
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

--- --- ---

Larusso · 20.08.2010, 12:13

Deinstalliere bitte mit dem Revo Uninstaller Softonic Deutsch Toolbar

Ich würde Dir auch von TuneUp abraten. Das hat schon mehr Systeme kaputt getuned als wieder heile gemacht. your choice.

Noch Probleme ?

19.08.2010, 17:00	#17
Larusso /// Selecta Jahrusso	Antivir findet "TR/Spy.Browse.A" / Onelinebanking-Attacke Online Banking ist nie sicher. Anstelle von Flash Player. Naja ich nutze den auch Starte bitte OTL und lass einen QuickScan laufen. __________________ __________________

Antivir findet "TR/Spy.Browse.A" / Onelinebanking-Attacke

Plagegeister aller Art und deren Bekämpfung: Antivir findet "TR/Spy.Browse.A" / Onelinebanking-Attacke