| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.12.2010, 15:39
| #1 | ||
 |  "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" Hallo Leute, leider habe ich mir irgendwie Malware und ein Rootkit eingefangen. Wirklich aufgefallen ist es mir erst als eine Nachricht der Windows Firewall kam und bei der Installation einiger Programme (iTunes, MS Office) eine Fehlermeldung aufgrund der Zugriffsberechtigung zu dem Ordner C:\ProgramData\Microsoft\Windows kam. Darauf habe ich dann Avast Antivirus installiert und der Scan hat auch einige Malware und Rootkits gefunden und entfernt. Leider funktioniert das Setup der o.g. Programme immernoch nicht und ich bin mir nicht sicher ob eventuell noch ein Virus vorhanden ist. Da ich nicht weiß wie ich die das Protokoll von avast als txt öffne hab ich mal einen Screenshot gemacht.  Danach kam ich erst auf die Idee mich an das Board zu wenden. Ich hab die Anweisungen soweit befolgt, doch leider hängt sich die OTL.exe bei Manual File Scan - Getting folder Structure auf und beendet sich dann mit der Fehlermeldung out of memory. Hier hab ich noch den Malwarebytes Log: Zitat:
Zitat:
Gruß Rocktier |
|
26.12.2010, 20:24
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle davon posten. Du findest diese im Reiter Logdatein in Malwarebytes.
__________________
__________________ |
|
01.01.2011, 16:18
| #3 | ||
| | "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" Hier sind die beiden Logs die ich finden konnte von Malewarebytes:
__________________Zitat:
Zitat:
Gruß Rocktier |
|
02.01.2011, 11:20
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.01.2011, 14:15
| #5 | |||
| | "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" So hab auch einmal mit externer Festplatte angeklemmt laufen lassen, hier die Malewarebytes Logs: Zitat:
Zitat:
Zitat:
OTL Logfile: Code:
ATTFilter OTL logfile created on: 08.01.2011 13:26:38 - Run 1 OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Johannes\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 80,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 167,43 Gb Free Space | 35,95% Space Free | Partition Type: NTFS Drive D: | 596,17 Gb Total Space | 595,31 Gb Free Space | 99,86% Space Free | Partition Type: NTFS Drive H: | 841,13 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: JOHANNES-PC | User Name: Johannes | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Johannes\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software) PRC - C:\Program Files (x86)\Last.fm\LastFM.exe (Last.fm) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software) PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe () PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe () ========== Modules (SafeList) ========== MOD - C:\Users\Johannes\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (PnkBstrA) -- C:\windows\SysNative\PnkBstrA.exe File not found SRV:64bit: - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV:64bit: - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV:64bit: - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (NMSAccess) -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe () SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation) DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation) DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation) DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (StarOpen) -- C:\windows\SysWow64\drivers\StarOpen.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 59 8C 72 A9 F5 4D CB 01 [binary data] IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.25 16:07:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.25 16:07:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.12.25 16:07:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.12.25 16:07:55 | 000,000,000 | ---D | M] [2010.03.27 22:11:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Johannes\AppData\Roaming\mozilla\Extensions [2010.03.27 20:39:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Johannes\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.01.05 11:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Johannes\AppData\Roaming\mozilla\Firefox\Profiles\1ipm00yq.default\extensions [2010.12.31 19:45:41 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Johannes\AppData\Roaming\mozilla\Firefox\Profiles\1ipm00yq.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.12.31 18:53:01 | 000,001,056 | ---- | M] () -- C:\Users\Johannes\AppData\Roaming\Mozilla\Firefox\Profiles\1ipm00yq.default\searchplugins\icqplugin.xml [2010.03.27 22:11:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.10.13 20:18:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.10.13 20:18:13 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.10.13 20:18:13 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.10.13 20:18:13 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.10.13 20:18:13 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - Reg Error: Key error. File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.03.22 17:17:28 | 000,000,175 | R--- | M] () - H:\autorun.inf -- [ UDF ] O33 - MountPoints2\{93a6f51c-39e3-11df-b4d6-0021855ada2d}\Shell - "" = AutoRun O33 - MountPoints2\{93a6f51c-39e3-11df-b4d6-0021855ada2d}\Shell\AutoRun\command - "" = H:\setup.exe -- [2010.03.12 08:05:40 | 001,377,656 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{93a6f51c-39e3-11df-b4d6-0021855ada2d}\Shell\configure\command - "" = H:\setup.exe -- [2010.03.12 08:05:40 | 001,377,656 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{93a6f51c-39e3-11df-b4d6-0021855ada2d}\Shell\install\command - "" = H:\setup.exe -- [2010.03.12 08:05:40 | 001,377,656 | R--- | M] (Microsoft Corporation) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.01.08 13:06:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Johannes\Desktop\OTL.exe [2011.01.04 19:22:44 | 007,075,267 | ---- | C] (Ted Lauterbach) -- C:\Users\Johannes\Desktop\suteF.exe [2011.01.01 16:08:25 | 000,000,000 | -HSD | C] -- C:\windows\Installer [2011.01.01 09:49:32 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\taskschd.dll [2011.01.01 09:49:32 | 000,524,288 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wmicmiplugin.dll [2011.01.01 09:49:32 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\taskschd.dll [2011.01.01 09:49:32 | 000,473,600 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\taskcomp.dll [2011.01.01 09:49:32 | 000,464,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\taskeng.exe [2011.01.01 09:49:32 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\taskcomp.dll [2011.01.01 09:49:32 | 000,285,696 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\schtasks.exe [2011.01.01 09:49:32 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\schtasks.exe [2011.01.01 09:49:27 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\SysNative\atmfd.dll [2011.01.01 09:49:27 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\SysWow64\atmfd.dll [2011.01.01 09:49:27 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\windows\SysNative\atmlib.dll [2011.01.01 09:49:27 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\windows\SysWow64\atmlib.dll [2011.01.01 09:49:24 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\CPFilters.dll [2011.01.01 09:49:24 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\CPFilters.dll [2011.01.01 09:49:24 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msdri.dll [2011.01.01 09:49:24 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\MSNP.ax [2011.01.01 09:49:24 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mpg2splt.ax [2011.01.01 09:49:24 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MSNP.ax [2011.01.01 09:49:24 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mpg2splt.ax [2011.01.01 09:49:15 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\webio.dll [2011.01.01 09:49:15 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\webio.dll [2011.01.01 09:49:04 | 000,112,000 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\consent.exe [2011.01.01 09:49:04 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\Diskdump.sys [2011.01.01 09:48:57 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll [2011.01.01 09:48:57 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\msfeeds.dll [2011.01.01 09:48:57 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\iepeers.dll [2011.01.01 09:48:57 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll [2011.01.01 09:48:57 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\iepeers.dll [2011.01.01 09:48:57 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll [2011.01.01 09:48:57 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll [2011.01.01 09:48:57 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll [2011.01.01 09:48:57 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\licmgr10.dll [2011.01.01 09:48:57 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\licmgr10.dll [2011.01.01 09:48:57 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\msfeedssync.exe [2011.01.01 09:48:57 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeedssync.exe [2011.01.01 09:48:56 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\html.iec [2011.01.01 09:48:56 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\html.iec [2010.12.31 19:34:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2010.12.31 19:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AC3Filter [2010.12.31 19:12:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AC3Filter [2010.12.31 01:39:10 | 000,000,000 | ---D | C] -- C:\Users\Johannes\Desktop\WhiteOne [2010.12.28 18:28:54 | 000,000,000 | ---D | C] -- C:\Users\Johannes\AppData\Roaming\vlc [2010.12.28 18:28:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2010.12.25 16:09:24 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2010.12.25 16:09:23 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2010.12.25 16:07:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2010.12.25 16:07:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2010.12.25 16:06:31 | 000,000,000 | ---D | C] -- C:\Users\Johannes\AppData\Local\LogMeIn Hamachi [2010.12.25 16:06:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2010.12.25 16:06:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2010.12.25 15:54:16 | 000,000,000 | ---D | C] -- C:\Neuer Ordner [2010.12.25 14:49:18 | 000,000,000 | ---D | C] -- C:\windows\ERDNT [2010.12.25 14:48:55 | 000,000,000 | ---D | C] -- C:\windows\pss [2010.12.25 14:48:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT [2010.12.25 14:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT [2010.12.25 14:40:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\MFtools [2010.12.25 14:27:44 | 000,000,000 | ---D | C] -- C:\Users\Johannes\AppData\Roaming\Malwarebytes [2010.12.25 14:27:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys [2010.12.25 14:27:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2010.12.25 14:27:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.12.25 14:27:36 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2010.12.25 14:27:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.12.25 14:19:22 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010.12.25 14:00:50 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2010.12.25 14:00:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2010.12.24 14:48:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 2D [2010.12.24 14:48:01 | 000,000,000 | ---D | C] -- C:\Counter-Strike 2D [2010.12.23 02:08:16 | 000,020,048 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswFsBlk.sys [2010.12.23 02:08:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus [2010.12.23 02:08:15 | 000,121,936 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSP.sys [2010.12.23 02:08:14 | 000,028,752 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswRdr.sys [2010.12.23 02:08:13 | 000,051,280 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswTdi.sys [2010.12.23 02:08:09 | 000,061,008 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswMonFlt.sys [2010.12.23 02:07:24 | 000,167,592 | ---- | C] (AVAST Software) -- C:\windows\SysWow64\aswBoot.exe [2010.12.23 02:07:24 | 000,038,848 | ---- | C] (AVAST Software) -- C:\windows\avastSS.scr [2010.12.23 02:06:03 | 000,000,000 | ---D | C] -- C:\Programme\Alwil Software [2010.12.23 02:06:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software [2010.12.22 18:50:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Lunch Design [2010.12.22 18:50:49 | 000,000,000 | ---D | C] -- C:\games [2010.12.22 12:54:29 | 000,000,000 | ---D | C] -- C:\Users\Johannes\iIoMoUTk,ýΡËdcumuday.exe [2010.12.20 11:43:49 | 000,000,000 | ---D | C] -- C:\Users\Johannes\temp [2010.12.20 10:21:44 | 000,000,000 | ---D | C] -- C:\Users\Johannes\kurLAxGl*Q'*Ëdcumuday.exe [2010.12.19 14:19:41 | 000,000,000 | ---D | C] -- C:\Users\Johannes\qkpGOgklÎdŸËdcumuday.exe [2010.12.18 21:41:36 | 000,000,000 | ---D | C] -- C:\Users\Johannes\tmp [2010.12.18 21:38:18 | 000,000,000 | ---D | C] -- C:\Users\Johannes\win [2010.12.15 14:02:15 | 000,000,000 | ---D | C] -- C:\Users\Johannes\windows [2010.12.15 08:05:14 | 000,000,000 | ---D | C] -- C:\Users\Johannes\nWxsqMeCÐk&œËdcumuday.exe ========== Files - Modified Within 30 Days ========== [2011.01.08 13:26:02 | 000,001,112 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2011.01.08 13:06:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Johannes\Desktop\OTL.exe [2011.01.08 11:33:09 | 000,014,224 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.08 11:33:09 | 000,014,224 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.08 11:26:01 | 000,001,108 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2011.01.08 11:25:51 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2011.01.08 11:25:47 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys [2011.01.05 17:38:49 | 087,092,964 | ---- | M] () -- C:\Users\Johannes\Desktop\VICKI LEEKX -- VICKI LEEKX MIXTAPE.mp3 [2011.01.04 19:24:33 | 000,071,540 | ---- | M] () -- C:\Users\Johannes\Desktop\A.sav [2011.01.04 19:22:47 | 007,075,267 | ---- | M] (Ted Lauterbach) -- C:\Users\Johannes\Desktop\suteF.exe [2011.01.02 21:00:36 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.01.01 15:42:50 | 000,409,936 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2010.12.31 13:16:30 | 001,498,506 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2010.12.31 13:16:30 | 000,655,802 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2010.12.31 13:16:30 | 000,616,348 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2010.12.31 13:16:30 | 000,130,434 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2010.12.31 13:16:30 | 000,106,728 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2010.12.31 01:39:00 | 000,034,683 | ---- | M] () -- C:\Users\Johannes\Desktop\WhiteOne.zip [2010.12.28 18:28:33 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.12.25 14:23:36 | 001,635,734 | ---- | M] () -- C:\Users\Johannes\Documents\cc_20101225_142302.reg [2010.12.23 02:08:09 | 000,000,000 | ---- | M] () -- C:\windows\SysWow64\config.nt [2010.12.22 18:50:50 | 000,000,745 | ---- | M] () -- C:\Users\Johannes\Desktop\Icy Tower.lnk [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys [2010.12.20 18:08:40 | 000,024,152 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2010.12.18 09:38:08 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk ========== Files Created - No Company Name ========== [2011.01.05 17:37:46 | 087,092,964 | ---- | C] () -- C:\Users\Johannes\Desktop\VICKI LEEKX -- VICKI LEEKX MIXTAPE.mp3 [2011.01.04 19:23:11 | 000,071,540 | ---- | C] () -- C:\Users\Johannes\Desktop\A.sav [2011.01.02 21:00:36 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.12.31 19:12:59 | 000,580,096 | ---- | C] () -- C:\windows\SysNative\ac3filter64.acm [2010.12.31 19:12:59 | 000,497,664 | ---- | C] () -- C:\windows\SysWow64\ac3filter.acm [2010.12.31 01:39:00 | 000,034,683 | ---- | C] () -- C:\Users\Johannes\Desktop\WhiteOne.zip [2010.12.28 18:28:33 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.12.25 14:23:03 | 001,635,734 | ---- | C] () -- C:\Users\Johannes\Documents\cc_20101225_142302.reg [2010.12.23 02:08:09 | 000,000,000 | ---- | C] () -- C:\windows\SysWow64\config.nt [2010.12.22 18:50:50 | 000,000,745 | ---- | C] () -- C:\Users\Johannes\Desktop\Icy Tower.lnk [2010.12.18 09:38:08 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk [2010.11.23 17:29:20 | 000,007,605 | ---- | C] () -- C:\Users\Johannes\AppData\Local\Resmon.ResmonCfg [2010.07.23 13:50:38 | 000,000,331 | ---- | C] () -- C:\windows\game.ini [2010.04.14 20:05:13 | 000,007,168 | ---- | C] () -- C:\windows\SysWow64\drivers\StarOpen.sys [2010.04.08 13:22:22 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2009.11.06 09:58:04 | 000,178,975 | ---- | C] () -- C:\windows\SysWow64\xlive.dll.cat [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll [2002.08.23 09:00:00 | 000,375,296 | ---- | C] () -- C:\windows\SysWow64\WSIHK32.DLL [2002.08.23 09:00:00 | 000,132,096 | ---- | C] () -- C:\windows\SysWow64\WSIWIN32.DLL[/QUOTE] [QUOTE]OTL Extras logfile created on: 08.01.2011 13:26:38 - Run 1 OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Johannes\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 80,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 167,43 Gb Free Space | 35,95% Space Free | Partition Type: NTFS Drive D: | 596,17 Gb Total Space | 595,31 Gb Free Space | 99,86% Space Free | Partition Type: NTFS Drive H: | 841,13 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: JOHANNES-PC | User Name: Johannes | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software) .url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software) .url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d j && icacls "%1" /grant administratoren:F /t (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d j && icacls "%1" /grant administratoren:F /t (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0C682623-8F66-46A8-B9B3-93FE1E66A001}" = iTunes "{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode "{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition) "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 260.99 "{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 260.99 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 260.99 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "CCleaner" = CCleaner "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "WinRAR archiver" = WinRAR [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM) "{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6 "{19910E33-E495-42F9-84FF-7569931CC021}_is1" = Mafia 2 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15 "{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth "{52D1D62C-FEAB-4580-849E-1DB624BADBBD}" = DiRT2 "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2 "{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed(TM) Hot Pursuit "{849F6C2A-3F9C-4731-B659-8C606B706CF0}_is1" = Counter-Strike 2D 0.1.1.8 "{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher "{8ED35B48-AFBD-4F32-8271-2257AD8B907E}_is1" = Grand Theft Auto IV - Episodes From Liberty City "{9A200E68-D5F4-4E70-910F-2871753A0E2B}" = Worms World Party "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch "{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi "{D20559F7-7755-4811-BCD5-7F344BEC2215}" = QIP Infium 9040 Jeak-Edition "{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.3.22 Game "{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support "{FD416706-875C-4B0B-A23A-9E740DAE029E}" = Tom Clancy's Rainbow Six Vegas 2 "812A5AC8-50DA-43D8-B36E-30CDD7FCCAA1_is1" = Outlook Backup Assistant 5 (Testversion) "AC3Filter_is1" = AC3Filter 1.63b "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "AnyDVD" = AnyDVD "Audacity_is1" = Audacity 1.2.6 "avast5" = avast! Free Antivirus "Call of Duty: Black Ops_is1" = Call of Duty: Black Ops "CloneDVD2" = CloneDVD2 "DivX Setup.divx.com" = DivX-Setup "ERUNT_is1" = ERUNT 1.1j "FMSLogo" = FMSLogo "Google Chrome" = Google Chrome "hon" = Heroes of Newerth "Icy Tower v1.4_is1" = Icy Tower v1.4 "ImgBurn" = ImgBurn "InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch "InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "JDownloader" = JDownloader "KLS Mail Backup_is1" = KLS Mail Backup 1.9.7.6 "LAME for Audacity_is1" = LAME v3.98.2 for Audacity "LastFM_is1" = Last.fm 1.5.4.27091 "LogMeIn Hamachi" = LogMeIn Hamachi "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13) "Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7) "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "OpenAL" = OpenAL "Opera 11.00.1156" = Opera 11.00 "PunkBusterSvc" = PunkBuster Services "Rainlendar2" = Rainlendar2 (remove only) "ST6UNST #1" = Outlook Express Freebie Backup "Steam App 10" = Counter-Strike "Steam App 240" = Counter-Strike: Source "TmNationsForever_is1" = TmNationsForever Update 2010-03-15 "vbcpp40" = VisiBroker for Cpp 4.5 "VLC media player" = VLC media player 1.1.5 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "GeoGebra WebStart" = GeoGebra WebStart "Google Translator" = Google Translator "TeamSpeak 3 Client" = TeamSpeak 3 Client ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 08.01.2011 07:07:02 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11303 Description = Error - 08.01.2011 07:07:03 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11303 Description = Error - 08.01.2011 07:08:57 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:08:57 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:08:58 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:13:51 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:13:52 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:13:53 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11310 Description = Error - 08.01.2011 07:16:12 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11303 Description = Error - 08.01.2011 07:16:14 | Computer Name = Johannes-PC | Source = MsiInstaller | ID = 11303 Description = [ OSession Events ] Error - 25.05.2010 15:45:55 | Computer Name = Johannes-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = [ System Events ] Error - 22.12.2010 08:08:28 | Computer Name = Johannes-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147024713. Error - 22.12.2010 08:08:58 | Computer Name = Johannes-PC | Source = Microsoft-Windows-Bits-Client | ID = 16392 Description = Fehler beim Starten des BITS-Dienstes. Fehler: 2147942583. Error - 22.12.2010 08:08:58 | Computer Name = Johannes-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147024713. Error - 22.12.2010 08:09:28 | Computer Name = Johannes-PC | Source = Microsoft-Windows-Bits-Client | ID = 16392 Description = Fehler beim Starten des BITS-Dienstes. Fehler: 2147942583. Error - 22.12.2010 08:09:28 | Computer Name = Johannes-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147024713. Error - 22.12.2010 08:09:58 | Computer Name = Johannes-PC | Source = Microsoft-Windows-Bits-Client | ID = 16392 Description = Fehler beim Starten des BITS-Dienstes. Fehler: 2147942583. Error - 22.12.2010 08:09:58 | Computer Name = Johannes-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147024713. Error - 22.12.2010 08:10:28 | Computer Name = Johannes-PC | Source = Microsoft-Windows-Bits-Client | ID = 16392 Description = Fehler beim Starten des BITS-Dienstes. Fehler: 2147942583. Error - 22.12.2010 08:10:28 | Computer Name = Johannes-PC | Source = Service Control Manager | ID = 7024 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147024713. Error - 22.12.2010 08:10:58 | Computer Name = Johannes-PC | Source = Microsoft-Windows-Bits-Client | ID = 16392 Description = Fehler beim Starten des BITS-Dienstes. Fehler: 2147942583. < End of report > Hoffe mal du kannst was mit den Logs anfangen. Danke für deine Hilfe. Gruß |
|
08.01.2011, 21:00
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows"Zitat:
 da muss man sich auch nicht mehr über Schädlinge wundern  Die (Be)nutzung von Cracks, Serials und Keygens ist illegal, somit gibt es im Trojaner-Board keinen weiteren Support mehr. Für Dich geht es hier weiter => Neuaufsetzen des Systems Bitte auch alle Passwörter abändern (für E-Mail-Konten, StudiVZ, Ebay...einfach alles!) da nicht selten in dieser dubiosen Software auch Keylogger und Backdoorfunktionen stecken. Danach nie wieder sowas anrühren!
__________________ --> "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" |
|
| Themen zu "muxyi.exe" und Fehler bei Rechte zu "C:\ProgramData\Microsoft\Windows" |
| adobe, antivirus, avast, avast antivirus, avast!, bho, bonjour, cdburnerxp, desktop, diagnostics, explorer, fehler, fehlermeldung, firewall, google, hijack, hijackthis, hängt, installation, logfile, malware, nicht sicher, nvidia, object, otl.exe, plug-in, problem, programdata, rootkit, scan, software, syswow64, windows |
Linear-Darstellung
