| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BDS/Papras.PK & TR.Banker - Trojaner eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
08.09.2010, 21:53
| #1 |
| |  BDS/Papras.PK & TR.Banker - Trojaner eingefangen BDS/Papras.PK & TR.Banker - Trojaner habe ich "mir" eingefangen. da ich alle Beiträge zum Thema etwas verwirrend finde ;-) bitte ich um hilfe. Ich poste mal meine OTL.txt & die Log von Anti-Malware Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4573 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 08.09.2010 22:25:14 mbam-log-2010-09-08 (22-25-14).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 201199 Laufzeit: 54 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 1 Infizierte Dateien: 37 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\prh (Trojan.Banker) -> No action taken. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\appconf32.exe,) Good: (userinit.exe) -> No action taken. Infizierte Verzeichnisse: C:\WINDOWS\system32\xmldm (Stolen.Data) -> No action taken. Infizierte Dateien: C:\WINDOWS\system32\xmldm\2864_FF_0000000033.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000008.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000009.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000010.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000011.htm (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000012.key (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000013.htm (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000014.key (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000015.frm (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000016.htm (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000017.key (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000018.htm (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000019.key (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000020.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000021.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000022.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3256_FF_0000000023.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000024.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000025.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000026.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000027.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000028.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000029.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000030.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000031.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3568_FF_0000000032.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3960_FF_0000000034.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\3960_FF_0000000035.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000002.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000003.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000004.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000005.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000006.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\4032_FF_0000000007.pst (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\firefox.exe_UAs1.dat (Stolen.Data) -> No action taken. C:\WINDOWS\system32\xmldm\iexplore.exe_UAs010.dat (Stolen.Data) -> No action taken. C:\WINDOWS\system32\AcroIEHelpe018.dll (Trojan.Banker) -> No action taken. OTL Logfile: Code:
ATTFilter OTL logfile created on: 08.09.2010 21:03:28 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Dokumente und Einstellungen\Admiral_TF\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 48,15 Gb Total Space | 20,03 Gb Free Space | 41,60% Space Free | Partition Type: NTFS Drive D: | 7,75 Gb Total Space | 7,48 Gb Free Space | 96,55% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: FROMMI Current User Name: Admiral_TF Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010.09.08 21:03:03 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admiral_TF\Eigene Dateien\Downloads\OTL.exe PRC - [2010.09.08 08:41:06 | 012,479,152 | ---- | M] (Mozilla Messaging) -- C:\Programme\Mozilla Thunderbird\thunderbird.exe PRC - [2010.08.25 20:03:02 | 002,424,560 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2010.07.24 16:29:23 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2009.12.26 11:14:42 | 000,604,488 | ---- | M] (TuneUp Software) -- C:\WINDOWS\system32\TUProgSt.exe PRC - [2009.08.13 11:43:54 | 003,276,288 | ---- | M] (The Author of QIP) -- C:\Programme\jeak.de\QIP 2005\qip.exe PRC - [2009.08.05 21:52:11 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2009.06.09 15:53:04 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2009.05.06 21:51:12 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009.04.30 13:23:26 | 000,090,112 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe PRC - [2006.03.23 19:48:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe PRC - [2006.03.03 17:28:18 | 000,136,736 | ---- | M] (Infineon Technologies AG) -- C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe PRC - [2005.07.05 21:35:20 | 000,266,240 | ---- | M] () -- C:\Programme\TrafficCounter\TrafficCounter.exe PRC - [2005.06.29 21:06:54 | 000,043,008 | ---- | M] (Cognizance Corporation) -- C:\Programme\HPQ\IAM\Bin\asghost.exe PRC - [2005.05.20 11:11:06 | 000,925,696 | R--- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\Core\smax4pnp.exe ========== Modules (SafeList) ========== MOD - [2010.09.08 21:03:03 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admiral_TF\Eigene Dateien\Downloads\OTL.exe MOD - [2008.04.14 08:51:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2010.08.13 09:13:32 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R) SRV - [2010.03.29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R) SRV - [2009.12.26 11:23:28 | 000,361,288 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag) SRV - [2009.12.26 11:14:42 | 000,604,488 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc) SRV - [2009.08.05 21:52:11 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009.06.09 15:53:04 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.04.30 13:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service) SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.10.26 13:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM) SRV - [2006.03.23 19:48:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\UltraStar Deluxe\zlportio.sys -- (zlportio) DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009.12.11 13:49:48 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.10.05 18:56:52 | 000,006,144 | ---- | M] (Promethean Technologies Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\activmouse.sys -- (prmvmouse) DRV - [2009.06.09 15:53:04 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.05.05 18:25:12 | 000,055,936 | ---- | M] (Promethean Technologies Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\activhidsermini.sys -- (ActivHidSerMini) DRV - [2009.04.30 17:01:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.11.08 11:55:18 | 000,101,376 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2008.05.27 11:41:46 | 000,122,152 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017mdm.sys -- (s0017mdm) DRV - [2008.05.27 11:41:46 | 000,117,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017unic.sys -- (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) DRV - [2008.05.27 11:41:46 | 000,111,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017obex.sys -- (s0017obex) DRV - [2008.05.27 11:41:46 | 000,090,536 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017bus.sys -- (s0017bus) Sony Ericsson Device 0017 driver (WDM) DRV - [2008.05.27 11:41:46 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017mdfl.sys -- (s0017mdfl) DRV - [2008.05.27 11:41:44 | 000,115,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017mgmt.sys -- (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) DRV - [2008.05.27 11:41:44 | 000,025,768 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s0017nd5.sys -- (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) DRV - [2008.04.14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB-Audiotreiber (WDM) DRV - [2008.04.13 23:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008.01.09 13:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri) DRV - [2007.10.16 08:29:00 | 000,989,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV) DRV - [2007.10.16 08:28:20 | 000,211,200 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL) DRV - [2007.10.16 08:28:16 | 000,731,136 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2007.02.02 22:03:25 | 001,975,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006.06.19 00:38:18 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2006.05.03 14:18:06 | 000,178,176 | R--- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService) DRV - [2006.03.31 17:41:40 | 000,193,056 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2006.03.30 15:39:48 | 000,130,432 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) DRV - [2006.01.19 12:55:58 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX) DRV - [2005.11.30 12:12:36 | 000,162,560 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2005.11.29 18:56:28 | 000,036,768 | ---- | M] (Infineon Technologies AG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\psd.sys -- (PersonalSecureDrive) DRV - [2005.10.26 11:01:02 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink (TM) DRV - [2005.10.21 13:19:34 | 000,036,352 | R--- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2005.09.19 15:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb) DRV - [2005.09.19 15:24:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey) DRV - [2005.09.19 15:23:52 | 000,007,808 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.n24.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official" FF - prefs.js..extensions.enabledItems: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}:1.0 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=" FF - HKLM\software\mozilla\Firefox\Extensions\\{ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}: C:\WINDOWS\system32\5005 [2010.06.26 11:16:59 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.07 11:25:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.07 12:03:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.09.08 08:41:07 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2010.09.07 12:03:17 | 000,000,000 | ---D | M] [2009.03.01 12:56:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Extensions [2009.08.05 06:16:37 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Extensions\{33cb9019-c295-46dd-be21-8c4936574bee} [2010.08.20 23:01:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.09.07 20:53:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions [2010.04.05 11:44:10 | 000,000,000 | ---D | M] (Screengrab) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2010.06.03 11:32:59 | 000,000,000 | ---D | M] (Flagfox) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2010.04.28 16:21:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009.04.04 16:08:32 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{7C06F9C2-B0D0-47b4-93B8-116C919084BA} [2010.06.03 11:32:59 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{9fb7d178-155a-4318-9173-1a8eaaea7fe4} [2010.07.31 09:22:57 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.03.12 21:39:32 | 000,000,000 | ---D | M] (COMPUTERBILD-Abzockschutz) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{d49175b3-3fd8-43b8-b28e-da5d47f3c398} [2009.10.12 22:52:42 | 000,000,000 | ---D | M] (My IP Tool [de]) -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\{E67D096F-5FAD-40bc-8CC2-26F0CD152A35} [2010.02.07 11:28:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\linkalert.conlan@addons.mozilla.com [2009.04.04 15:54:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Mozilla\Firefox\Profiles\s6gq2gb9.default\extensions\timestatus@webdesigns.ms11.net [2010.09.07 20:53:02 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.06.28 20:35:02 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.06.28 20:35:02 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.06.28 20:35:02 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.06.28 20:35:02 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.06.28 20:35:02 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.18 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.) O2 - BHO: (HP Credential Manager for ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [SoundMAX] C:\Programme\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [QIP2005] C:\Programme\jeak.de\QIP 2005\qip.exe (The Author of QIP) O4 - HKCU..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - Startup: C:\Dokumente und Einstellungen\Admiral_TF\Startmenü\Programme\Autostart\Traffic Counter.lnk = C:\Programme\TrafficCounter\TrafficCounter.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\Hp\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\appconf32.exe) - C:\WINDOWS\System32\appconf32.exe File not found O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\IfxWlxEN: DllName - IfxWlxEN.dll - C:\WINDOWS\System32\IfxWlxEN.dll (Infineon Technologies AG) O20 - Winlogon\Notify\OneCard: DllName - C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll - C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll (Cognizance Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.03.01 11:34:05 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001.07.28 01:07:00 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2004.04.30 17:01:00 | 000,000,053 | -HS- | M] () - D:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{226fd637-25a4-11de-8e1c-0017082fbf82}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found O33 - MountPoints2\{2ae7bf98-0e51-11df-9006-0017082fbf82}\Shell - "" = AutoRun O33 - MountPoints2\{2ae7bf98-0e51-11df-9006-0017082fbf82}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2ae7bf98-0e51-11df-9006-0017082fbf82}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{919d703e-0f50-11df-9009-0017082fbf82}\Shell - "" = AutoRun O33 - MountPoints2\{919d703e-0f50-11df-9009-0017082fbf82}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{919d703e-0f50-11df-9009-0017082fbf82}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{919d703f-0f50-11df-9009-0017082fbf82}\Shell - "" = AutoRun O33 - MountPoints2\{919d703f-0f50-11df-9009-0017082fbf82}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{919d703f-0f50-11df-9009-0017082fbf82}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: bootconf - (C:\WINDOWS\system32\asr_uirt.dll) - C:\WINDOWS\system32\asr_uirt.dll () O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.09.08 12:57:45 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Admiral_TF\Recent [2010.09.08 09:03:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com [2010.09.08 09:03:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admiral_TF\Anwendungsdaten\SUPERAntiSpyware.com [2010.09.08 09:03:28 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware [2010.09.07 12:02:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2010.09.07 11:56:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee [2010.01.06 17:52:01 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpeBC.dll [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.09.08 21:00:02 | 000,000,502 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job [2010.09.08 20:47:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.09.08 20:43:19 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.09.08 20:43:13 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.09.08 20:43:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.09.08 20:43:00 | 2012,663,808 | -HS- | M] () -- C:\hiberfil.sys [2010.09.08 12:57:59 | 006,291,456 | ---- | M] () -- C:\Dokumente und Einstellungen\Admiral_TF\NTUSER.DAT [2010.09.08 12:27:16 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2010.09.08 12:27:14 | 000,000,031 | ---- | M] () -- C:\WINDOWS\popcinfo.dat [2010.09.08 09:33:05 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2010.09.07 20:12:37 | 000,384,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Admiral_TF\Desktop\Ausgaben2007.xls [2010.09.06 09:10:57 | 000,038,912 | ---- | M] () -- C:\Dokumente und Einstellungen\Admiral_TF\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.09.05 20:54:36 | 000,046,592 | ---- | M] () -- C:\WINDOWS\System32\asr_uirt.dll [2010.09.05 14:12:35 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.09.03 14:43:37 | 000,010,876 | ---- | M] () -- C:\Dokumente und Einstellungen\Admiral_TF\Desktop\FAB.docx [2010.09.02 06:29:32 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Admiral_TF\ntuser.ini [2010.08.12 09:38:13 | 000,293,272 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.08.12 09:34:01 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010.08.12 09:02:51 | 000,998,144 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.08.12 09:02:51 | 000,448,970 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.08.12 09:02:51 | 000,432,690 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.08.12 09:02:51 | 000,080,488 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.08.12 09:02:51 | 000,067,646 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.09.05 20:54:36 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\asr_uirt.dll [2010.09.03 14:43:36 | 000,010,876 | ---- | C] () -- C:\Dokumente und Einstellungen\Admiral_TF\Desktop\FAB.docx [2010.01.16 18:53:20 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll [2010.01.10 18:59:22 | 000,000,054 | ---- | C] () -- C:\WINDOWS\setihome.ini [2009.10.22 17:44:36 | 000,223,016 | ---- | C] () -- C:\WINDOWS\libactivboardex.dll [2009.10.22 17:44:16 | 000,252,696 | ---- | C] () -- C:\WINDOWS\ActivDRV.dll [2009.05.15 20:30:15 | 000,000,212 | ---- | C] () -- C:\WINDOWS\pdf2word.INI [2009.05.06 10:33:41 | 000,000,103 | ---- | C] () -- C:\WINDOWS\System32\hptrace.ini [2009.05.06 10:32:57 | 000,013,806 | ---- | C] () -- C:\WINDOWS\hpdj5100.ini [2009.04.18 21:20:41 | 000,219,136 | ---- | C] () -- C:\WINDOWS\sqlite3_engine.dll [2009.03.04 20:49:03 | 000,038,912 | ---- | C] () -- C:\Dokumente und Einstellungen\Admiral_TF\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.03.01 22:41:42 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2009.03.01 18:34:53 | 000,094,274 | R--- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [2009.03.01 18:21:34 | 000,030,064 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2009.03.01 13:13:40 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009.03.01 12:27:16 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\std201mt.dll [2009.03.01 12:25:41 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll [2009.03.01 12:25:41 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll [2007.04.27 10:43:58 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll [2004.01.13 20:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll [2003.03.24 06:03:00 | 000,279,552 | ---- | C] () -- C:\WINDOWS\System32\FGWVB32.DLL [2001.10.28 18:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [1998.05.07 04:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll [1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll < End of report > Geändert von fromlo (08.09.2010 um 22:12 Uhr) Grund: Anhang war doof |
| Themen zu BDS/Papras.PK & TR.Banker - Trojaner eingefangen |
| 0x00000001, acroiehelpe, anti-malware, appconf32.exe, ask toolbar, ask.com, askbar, avgntflt.sys, beiträge, components, eingefangen, excel.exe, firefox.exe, gefangen, gen, location, log, mozilla thunderbird, oldtimer, otl.txt, plug-in, poste, searchplugins, stolen.data, thema, troja, trojaner, trojaner eingefangen, xmldm |
Baum-Darstellung