TR/Crypt.ZPACK.Gen-Avira sprint ständig an und kann den Trojaner nicht löschen

Fisch2010 · 27.12.2010, 20:16

Hallo Forum,
auch ich bin seit gestern Inhaber eines Trojaners /Virus: Der Avira-Scanner springt ständig auf und warnt mich vor der Datei: vsgavlkehsnmocx.dll in der der TR/Crypt.ZPACK.Gen gefunden wurde. Das angebotene "Löschen'" brachte nichts, so dass er ständig die Fehlermeldung bringt.
Habe das gleiche Problem bei einem anderen User gesehen, wollte aber, da darauf hingewiesen wurde, selber nochmal die Logfiles posten:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5404

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

27.12.2010 19:58:52
mbam-log-2010-12-27 (19-58-52).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 158590
Laufzeit: 7 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
c:\Users\michael hering\AppData\Local\Temp\elktbhtoiquewyn.exe (Trojan.FakeAlert) -> 3832 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ElkTBhTOiqUEWYN.exe (Trojan.FakeAlert) -> Value: ElkTBhTOiqUEWYN.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{B922D405-6D13-4A2B-AE89-08A030DA4402} (Adware.WidgiToolbar) -> Value: {B922D405-6D13-4A2B-AE89-08A030DA4402} -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\michael hering\AppData\Local\Temp\elktbhtoiquewyn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\pdfforge toolbar\pdfforgetoolbarie.dll (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
OTL sagt folgendes.OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 27.12.2010 19:27:35 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Michael Hering\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,29 Gb Total Space | 314,30 Gb Free Space | 69,03% Space Free | Partition Type: NTFS
Drive D: | 10,47 Gb Total Space | 1,79 Gb Free Space | 17,06% Space Free | Partition Type: NTFS
 
Computer Name: BGS-NOTEBOO-MH | User Name: Michael Hering | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael Hering\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Michael Hering\AppData\Local\Temp\ElkTBhTOiqUEWYN.exe (iWin software)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Users\Michael Hering\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\SMINST\BLService.exe ()
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Michael Hering\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_fa807195\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (Recovery Service for Windows) -- C:\Program Files\SMINST\BLService.exe ()
SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SRTSPX) -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSPX.SYS File not found
DRV - (SRTSP) -- C:\Windows\System32\drivers\NIS\1000000.07D\SRTSP.SYS File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS File not found
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (HpqKbFiltr) -- C:\Windows\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Presario&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bgs-kleinlinden.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.lusd.hessen.de;10.9.131.*;10.198.*;*.schulverwaltung.hessen.de;*.local;<local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 10.9.131.101:80
 
========== FireFox ==========
 
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"
FF - prefs.js..browser.startup.homepage: "spiegel.de"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.9.1.14019
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.1.0625
FF - prefs.js..extensions.enabledItems: optout@google.com:1.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:4.9.4
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:1.3.2
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.ftp: "10.9.131.101"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.gopher: "10.9.131.101"
FF - prefs.js..network.proxy.gopher_port: 80
FF - prefs.js..network.proxy.http: "10.9.131.101"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.no_proxies_on: "*.lusd.hessen.de,10.9.131.*,10.198.*,*.schulverwaltung.hessen.de,localhost,127.0.0.1"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "10.9.131.101"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "10.9.131.101"
FF - prefs.js..network.proxy.ssl_port: 80
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.11 13:18:29 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.11 13:18:29 | 000,000,000 | ---D | M]
 
[2009.08.18 12:34:26 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Extensions
[2010.12.27 18:39:42 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions
[2010.12.25 11:34:23 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.09.11 16:31:04 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.10.15 21:38:57 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.06.30 17:43:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2010.12.25 11:34:26 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.11.13 16:48:25 | 000,000,000 | ---D | M] (SearchPreview) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2009.12.11 20:37:42 | 000,000,000 | ---D | M] (Sothink SWF Catcher) -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010.08.06 11:39:53 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\info@youtube-mp3.org
[2010.02.19 06:39:59 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\optout@google.com
[2010.10.18 08:53:15 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\toolbar@ask.com
[2010.10.01 19:30:29 | 000,000,000 | ---D | M] -- C:\Users\Michael Hering\AppData\Roaming\mozilla\Firefox\Profiles\6nmo0vug.default\extensions\youtube2mp3@mondayx.de
[2010.12.20 20:48:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009.08.15 18:40:00 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2010.05.24 19:35:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.01 21:03:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.01 19:29:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.12.20 20:48:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009.08.15 18:40:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
[2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.23 23:58:17 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.23 23:58:17 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.23 23:58:17 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.23 23:58:17 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.23 23:58:18 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.10.01 21:42:11 | 000,000,766 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1 localhost
O1 - Hosts: 17.250.236.65 phobos.apple.com
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll File not found
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe File not found
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ElkTBhTOiqUEWYN.exe] C:\Users\MICHAE~1\AppData\Local\Temp\ElkTBhTOiqUEWYN.exe (iWin software)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Michael Hering\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Michael Hering\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Michael Hering\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Michael Hering\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{f10c0717-cab2-11de-a93e-00238be0bd4f}\Shell - "" = AutoRun
O33 - MountPoints2\{f10c0717-cab2-11de-a93e-00238be0bd4f}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.27 18:47:37 | 000,000,000 | ---D | C] -- C:\Users\Michael Hering\AppData\Roaming\Malwarebytes
[2010.12.27 18:47:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.12.27 18:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.12.27 18:47:28 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.12.27 18:47:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.12.20 20:47:58 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.12.20 20:47:58 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.12.20 20:47:58 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.12.20 11:19:42 | 000,000,000 | ---D | C] -- C:\Users\Michael Hering\AppData\Roaming\NeroDCTemplates
[2010.12.17 19:29:59 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.17 19:29:43 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.12.17 19:29:43 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.12.17 19:29:43 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.12.17 19:29:38 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.17 19:29:20 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.17 19:29:20 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.17 19:29:20 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.17 19:29:12 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.17 19:29:12 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.12.17 19:29:11 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.17 19:29:11 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.12.17 19:29:11 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.12.17 19:29:10 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.12.17 19:29:10 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.12.17 19:29:10 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.17 19:29:10 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.17 19:29:10 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.17 19:29:10 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.12.17 19:29:10 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.12.17 19:29:10 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.12.17 19:29:10 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.12.17 19:29:10 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.12.17 19:29:10 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.12.17 19:29:10 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.12.17 19:28:36 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.15 10:01:28 | 000,000,000 | ---D | C] -- C:\Users\Michael Hering\Desktop\Bilder Schule
[2010.12.14 15:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\Freecom Network Storage Assistant
[2010.11.29 15:02:50 | 000,000,000 | ---D | C] -- C:\Users\Michael Hering\AppData\Roaming\dvdcss
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.27 18:47:32 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.27 18:47:09 | 000,264,626 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.12.27 18:47:09 | 000,264,626 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.12.27 18:31:56 | 000,019,456 | ---- | M] () -- C:\Users\Michael Hering\AppData\Local\WebpageIcons.db
[2010.12.27 18:29:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.27 11:05:32 | 000,000,857 | ---- | M] () -- C:\ProgramData\hpqp.ini
[2010.12.27 11:04:56 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.27 11:04:56 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.27 11:04:44 | 3186,544,640 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.27 10:19:05 | 000,000,436 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7A1E171F-022C-4689-BBE5-63B6416CE2E8}.job
[2010.12.25 10:23:03 | 000,130,572 | ---- | M] () -- C:\Users\Michael Hering\Desktop\2093.png
[2010.12.20 22:50:15 | 000,038,912 | ---- | M] () -- C:\Users\Michael Hering\Documents\tour.doc
[2010.12.20 20:59:19 | 000,000,915 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Freecom Network Storage Assistant.lnk
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.12.20 11:54:06 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010.12.18 18:16:44 | 000,408,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.12.12 21:54:42 | 000,048,645 | ---- | M] () -- C:\Users\Michael Hering\Desktop\OpenHouse_D.jpg
[2010.12.06 22:51:08 | 000,040,134 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Schweineruecken.pdf
[2010.12.06 22:50:41 | 000,040,540 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Birnensauce.pdf
[2010.12.06 22:22:59 | 000,044,711 | ---- | M] () -- C:\Users\Michael Hering\Desktop\BologneseRagout.pdf
[2010.12.06 22:22:46 | 000,045,708 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Bulgursalat.pdf
[2010.12.06 22:22:25 | 000,044,309 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Lammspiesse.pdf
[2010.12.06 22:17:38 | 000,044,799 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Bierkrustenbraten.pdf
[2010.12.06 22:14:13 | 000,039,984 | ---- | M] () -- C:\Users\Michael Hering\Desktop\Cassoulet.pdf
[2010.11.30 22:18:35 | 000,027,648 | ---- | M] () -- C:\Users\Michael Hering\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Files Created - No Company Name ==========
 
[2010.12.27 18:47:32 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.25 10:23:02 | 000,130,572 | ---- | C] () -- C:\Users\Michael Hering\Desktop\2093.png
[2010.12.14 15:26:32 | 000,000,915 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Freecom Network Storage Assistant.lnk
[2010.12.12 21:54:41 | 000,048,645 | ---- | C] () -- C:\Users\Michael Hering\Desktop\OpenHouse_D.jpg
[2010.12.06 22:51:08 | 000,040,134 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Schweineruecken.pdf
[2010.12.06 22:50:41 | 000,040,540 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Birnensauce.pdf
[2010.12.06 22:22:46 | 000,045,708 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Bulgursalat.pdf
[2010.12.06 22:22:25 | 000,044,309 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Lammspiesse.pdf
[2010.12.06 22:18:40 | 000,044,711 | ---- | C] () -- C:\Users\Michael Hering\Desktop\BologneseRagout.pdf
[2010.12.06 22:17:38 | 000,044,799 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Bierkrustenbraten.pdf
[2010.12.06 22:14:13 | 000,039,984 | ---- | C] () -- C:\Users\Michael Hering\Desktop\Cassoulet.pdf
[2010.09.14 15:09:39 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2010.06.03 19:31:36 | 000,019,456 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\WebpageIcons.db
[2010.01.07 00:14:01 | 000,000,021 | ---- | C] () -- C:\ProgramData\hpqp.txt
[2009.11.15 22:21:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.11.15 19:15:34 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.09.16 09:46:40 | 000,007,592 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\d3d9caps.dat
[2009.08.31 09:49:24 | 000,000,000 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\FnF4.txt
[2009.08.19 12:06:05 | 000,000,135 | ---- | C] () -- C:\Windows\WMMATH5.INI
[2009.08.19 12:05:13 | 000,027,648 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.15 18:39:44 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.08.15 17:45:08 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.15 17:04:19 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.08.15 14:40:21 | 000,000,000 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\QSwitch.txt
[2009.08.15 14:40:21 | 000,000,000 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\DSwitch.txt
[2009.08.15 14:40:21 | 000,000,000 | ---- | C] () -- C:\Users\Michael Hering\AppData\Local\AtStart.txt
[2009.08.15 14:40:11 | 000,349,001 | ---- | C] () -- C:\ProgramData\HPWALog.txt
[2009.06.23 03:17:06 | 000,264,626 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.06.23 03:12:10 | 000,000,032 | ---- | C] () -- C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
[2009.06.23 03:11:46 | 000,000,105 | ---- | C] () -- C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
[2009.06.23 03:11:38 | 000,000,032 | ---- | C] () -- C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
[2009.06.23 03:11:04 | 000,000,032 | ---- | C] () -- C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
[2009.06.23 03:09:47 | 000,000,032 | ---- | C] () -- C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
[2009.06.23 03:09:11 | 000,000,857 | ---- | C] () -- C:\ProgramData\hpqp.ini
[2009.06.23 03:07:33 | 000,264,626 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.02.28 08:48:04 | 000,000,109 | ---- | C] () -- C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
[2009.02.28 08:44:02 | 000,000,110 | ---- | C] () -- C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
[2009.02.28 08:42:41 | 000,000,105 | ---- | C] () -- C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
[2009.02.28 08:41:42 | 000,000,107 | ---- | C] () -- C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
[2009.02.10 14:33:16 | 000,181,248 | ---- | C] () -- C:\Windows\System32\HPEPCEnm.dll
[2009.02.10 14:33:02 | 000,163,840 | ---- | C] () -- C:\Windows\System32\hppatusg01.dll
[2008.12.11 11:27:24 | 000,332,963 | ---- | C] () -- C:\Users\Michael Hering\AppData\Roaming\com.kennettnet.MusicRescue4.Profiles.plist
[2008.12.11 10:53:20 | 002,585,453 | ---- | C] () -- C:\Users\Michael Hering\AppData\Roaming\com.kennettnet.MusicRescue4.plist
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
 
< End of report >

--- --- ---
sowieOTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 27.12.2010 19:27:35 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Michael Hering\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,29 Gb Total Space | 314,30 Gb Free Space | 69,03% Space Free | Partition Type: NTFS
Drive D: | 10,47 Gb Total Space | 1,79 Gb Free Space | 17,06% Space Free | Partition Type: NTFS
 
Computer Name: BGS-NOTEBOO-MH | User Name: Michael Hering | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1279021512-3695608062-2819096045-1000]
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00992732-6268-4096-9A9C-3B01BC3FFEC7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{198C3F81-FF41-4A56-B624-FC6EAFCD7063}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2140184B-EA8A-42D3-8E31-0C1D041A8782}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{22D7DBF7-F437-4E2A-BB3E-ADF306B7A7B9}" = lport=139 | protocol=6 | dir=in | app=system | 
"{26666AB0-C72A-4E3F-83B4-61C2CDDBFBD9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{2D757EC3-E2ED-40DC-AE25-755B89A5D241}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{363CB1A9-71C2-462F-B35D-0B12C9A93CC7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{384316C2-D7C0-40FB-B882-BB9BB94FE120}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{45BDE2D4-4597-4E84-9EE3-CBCC1FF61F71}" = rport=138 | protocol=17 | dir=out | app=system | 
"{4C674311-3D0C-47B5-9322-88A5B052536B}" = rport=139 | protocol=6 | dir=out | app=system | 
"{5A19E239-7818-406C-A4B2-1CA5C3CB3D2C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{78DC14DF-B162-4A0C-A0DB-22D1C5CF9955}" = rport=137 | protocol=17 | dir=out | app=system | 
"{7CCF8AC4-3D3B-44A5-91C2-DA8EEF44D965}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{8A383D00-1E52-415F-A1E1-40C669A54E4A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{8BA37011-7378-49EB-B0DB-FA791938B3D4}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{925F065C-4732-4825-AE49-D95AC1194F6D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{B07EC05D-C7CF-44A1-B993-F497596D560A}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{BEA8905F-298F-4B30-A2A2-4ED9AB0C23C6}" = rport=445 | protocol=6 | dir=out | app=system | 
"{D7A23C13-EE68-44D2-BD57-5F133BF98836}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E56D0DCE-D655-41EA-80D4-29B570FD7859}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{E9A3FECE-86FE-45F0-B0D4-56501D5917C3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02FE2B4A-7843-4CCC-85F9-B300AC2F25BB}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{04F75757-2DAD-4796-9322-BA860C3A2C5B}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{086D96F1-2757-42B7-B0F9-C4D57101AEBE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{18AB8A7A-8DB4-4503-A2E6-9326570781E8}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{20924DFA-C357-4338-BA8F-4C6DAE917680}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{3A533F4E-C78E-4BDB-B47D-76C5F8C0BDBF}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{3EA10501-7A2E-4237-9570-2BF639EB1E34}" = protocol=17 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe | 
"{452C2B2E-B20D-429A-A48F-3E6F59890A63}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{4A002994-133D-4103-A7C0-862F526E7882}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{824DD4B3-4314-4940-BCB3-4B94761FC2BB}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{83B22DDE-28E7-4C2D-8FAB-E7F6928566A1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{A17AA536-5F7D-4540-A1DA-E7269C14C709}" = protocol=6 | dir=in | app=c:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe | 
"{A2378AE6-D5A4-4F88-9F61-9A01B59F5990}" = protocol=6 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe | 
"{ACC9FB77-7E55-4312-9BBF-D7D3E6B26353}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 
"{B055C796-2324-4452-8573-5C07F9B371EB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{B0822FC0-A0AA-448E-8EDE-8851E4F3F683}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B5A32877-4618-4CCF-9D05-836789C4EF64}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{BD8C3CC8-5165-4B55-AD3E-E55171BDED58}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 
"{BF7EE5CC-A2F2-4838-9552-C266ABCF76B8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C4790A36-0DBF-4B80-B97D-4F1B6D733E7A}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 
"{E555856F-0AD2-4C74-A7FE-A7F1AADF102D}" = protocol=17 | dir=in | app=c:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe | 
"{E810957E-D896-42A0-A44D-92924386209C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{E9186B7A-66A0-4A5A-B3CB-4DC71A1E3DAB}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"TCP Query User{12700C24-B749-4E1C-962F-01B69BBC6A5E}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{44DBC23C-D5D5-47EF-ABD3-E0D03C395599}C:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{6068886C-649D-4744-831B-5B520DE31716}C:\program files\freecom network storage assistant\fnsa.exe" = protocol=6 | dir=in | app=c:\program files\freecom network storage assistant\fnsa.exe | 
"TCP Query User{7F4A2041-091D-4CEC-BDEA-C6201B536E50}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{B6C5F969-F483-424B-97A2-D46CD38D7DE6}C:\program files\freecom network storage assistant\fnsa.exe" = protocol=6 | dir=in | app=c:\program files\freecom network storage assistant\fnsa.exe | 
"TCP Query User{DF37B089-C787-4424-80B8-626897765D8C}C:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe" = protocol=6 | dir=in | app=c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe | 
"TCP Query User{F6462B56-6A09-48B0-836B-A9663657F4F9}C:\program files\filezilla ftp client\filezilla.exe" = protocol=6 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe | 
"UDP Query User{1855BDF3-04CB-4EEA-BF00-CE625EADE1A2}C:\program files\freecom network storage assistant\fnsa.exe" = protocol=17 | dir=in | app=c:\program files\freecom network storage assistant\fnsa.exe | 
"UDP Query User{3BFC37BD-732D-431B-903D-C2D733B6B729}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{5FBA82D3-DF47-4800-8CF5-B4D03AAD8EC2}C:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\michael hering\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{64B57EDF-E9ED-43D9-95FC-4080F7076EE0}C:\program files\freecom network storage assistant\fnsa.exe" = protocol=17 | dir=in | app=c:\program files\freecom network storage assistant\fnsa.exe | 
"UDP Query User{7497BD71-D205-447E-882C-39C710E10F28}C:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe" = protocol=17 | dir=in | app=c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe | 
"UDP Query User{8C48F9A2-F149-481C-8A9C-8385C301A508}C:\program files\filezilla ftp client\filezilla.exe" = protocol=17 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe | 
"UDP Query User{BD4C79EB-52FA-48B7-A9F9-E44A16F58EF0}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}" = Adobe Setup
"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{17050C48-16CB-4500-A102-CEAD750CE11E}" = HP User Guides 0138
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 23
"{279DB581-239C-4E13-97F8-0F48E40BE75C}" = Windows Live Messenger
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3364BD16-5A28-4862-86A1-A8FF5FD23919}" = Music Rescue
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 M1
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.7
"{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CF71043-F81B-4CAA-ABDA-9F24378E71DE}" = Externe Notenerfassung ENC 3.1
"{4EF8BE6A-899C-4196-94E7-297C5F7A203E}" = pdfforge Toolbar v1.1.1
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57A5AEC1-97FC-474D-92C4-908FCC2253D4}" = HP Customer Experience Enhancements
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{732A3F80-008B-4350-BD58-EC5AE98707B8}" = HP Common Access Service Library
"{7527CD9F-894E-47B3-9AFB-3E680E007051}" = HP Proactive Services
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{975C8028-51D8-44A9-9585-82E9810FE96A}" = hp LaserJet 1000
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9EDBB857-8028-49CD-B9C9-0B4D10CD1031}" = Nero 8
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5842AC3-59C7-4DDD-BB33-54FE544DB3DA}" = Komponenten der Betriebssystemkommunikation
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E5E29403-3D25-40C6-892B-F9FEE2A95585}" = HP Wireless Assistant
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E8020EC7-5DD8-80C9-7237-7B2E9BDA8CC6}" = muvee Reveal
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3D Shadow by Lokas Software" = 3D Shadow by Lokas Software
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe_acce07fd2c8fe7f9e3f26243e626578" = Adobe Dreamweaver CS4
"Avira AntiVir Desktop" = Avira AntiVir Professional
"Blitzrechnen" = Blitzrechnen
"Budenberg_is1" = Budenberg Software Mehrplatz 5/09 WIN
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"FileZilla Client" = FileZilla Client 3.3.5.1
"FLV Player" = FLV Player 2.0 (build 25)
"Freecom Network Storage Assistant_is1" = Freecom Network Storage Assistant 1.50
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"Klett Service-CD Einblicke" = Klett Service-CD Einblicke
"Klett Service-CD Schnittpunkt" = Klett Service-CD Schnittpunkt
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"Photo! Web Album_is1" = Photo! Web Album 1.2
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 5" = TeamViewer 5
"VisualLightBox" = VisualLightBox
"VLC media player" = VLC media player 1.0.5
"xp-AntiSpy" = xp-AntiSpy 3.96-5
"Zahlenmauer" = Zahlenmauer
"Zattoo4" = Zattoo4 4.0.5
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 27.12.2010 06:05:29 | Computer Name = BGS-Noteboo-MH | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.12.2010 08:06:08 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 27.12.2010 08:06:08 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7217292
 
Error - 27.12.2010 08:06:08 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7217292
 
Error - 27.12.2010 08:06:24 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 27.12.2010 08:06:24 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7233080
 
Error - 27.12.2010 08:06:24 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7233080
 
Error - 27.12.2010 08:06:39 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 27.12.2010 08:06:39 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7248773
 
Error - 27.12.2010 08:06:39 | Computer Name = BGS-Noteboo-MH | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7248773
 
[ System Events ]
Error - 25.12.2010 19:22:47 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 25.12.2010 19:27:04 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.12.2010 03:47:00 | Computer Name = BGS-Noteboo-MH | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 26.12.2010 um 08:44:54 unerwartet heruntergefahren.
 
Error - 27.12.2010 05:14:37 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.12.2010 05:14:37 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.12.2010 05:14:37 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 27.12.2010 06:05:29 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.12.2010 06:05:29 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.12.2010 06:05:29 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 27.12.2010 08:06:07 | Computer Name = BGS-Noteboo-MH | Source = Service Control Manager | ID = 7011
Description = 
 
 
< End of report >

--- --- ---

Könnt ihr mir helfen, diesen Plagegeist wieder loszuwerden. Scheint ja relativ neu zu sein, wenn man danach googelt.
Danke

cosinus · 27.12.2010, 20:58

Zitat:

Art des Suchlaufs: Quick-Scan

Hallo und

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Fisch2010 · 28.12.2010, 01:31

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5404

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

28.12.2010 01:29:47
mbam-log-2010-12-28 (01-29-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 397490
Laufzeit: 3 Stunde(n), 22 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{B922D405-6D13-4A2B-AE89-08A030DA4402}\COMPONENTS\PDFFORGETOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: PDFFORGETOOLBARFF.DLL -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files\mozilla firefox\extensions\{b922d405-6d13-4a2b-ae89-08a030da4402}\components\pdfforgetoolbarff.dll (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
c:\program files\pdfforge toolbar\widgihelper.exe (Adware.WidgiToolbar) -> Quarantined and deleted successfully.
c:\Users\michael hering\Desktop\chik materialien gesamt\unterrichtseinheiten\NRW\sauer macht lustig (nrw)\Tutorium\simreaction\simreaction.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\Users\michael hering\Desktop\sicherung usb 08062010\PC-Kram\lanis_update_5_1\basisprogramme\fixstartmodul.exe (Spyware.Passwords) -> Quarantined and deleted successfully.

cosinus · 28.12.2010, 09:39

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
PRC - C:\Users\Michael Hering\AppData\Local\Temp\ElkTBhTOiqUEWYN.exe (iWin software)
SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe File not found
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS File not found
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS File not found
O4 - HKCU..\Run: [ElkTBhTOiqUEWYN.exe] C:\Users\MICHAE~1\AppData\Local\Temp\ElkTBhTOiqUEWYN.exe (iWin software)
:Files
C:\Program Files\Norton Internet Security
C:\ProgramData\Norton
:Commands
[purity]
[resethosts]
[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Fisch2010 · 28.12.2010, 10:37

Files\Folders moved on Reboot...
C:\Users\Michael Hering\AppData\Local\Temp\ehmsas.txt moved successfully.

Registry entries deleted on Reboot...

cosinus · 28.12.2010, 18:13

Mehr kam da nicht? Poste das Fixlog bitte vollständig!!

Fisch2010 · 29.12.2010, 12:02

Habe es nochmal probiert und da kam tatsächlich ein wesentlich längerer Bericht:
All processes killed
========== OTL ==========
No active process named ElkTBhTOiqUEWYN.exe was found!
Error: No service named Norton Internet Security was found to stop!
Service\Driver key Norton Internet Security not found.
File C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe File not found not found.
Error: No service named NAVEX15 was found to stop!
Service\Driver key NAVEX15 not found.
File C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS File not found not found.
Error: No service named NAVENG was found to stop!
Service\Driver key NAVENG not found.
File C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS File not found not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ElkTBhTOiqUEWYN.exe not found.
File C:\Users\MICHAE~1\AppData\Local\Temp\ElkTBhTOiqUEWYN.exe not found.
========== FILES ==========
File\Folder C:\Program Files\Norton Internet Security not found.
File\Folder C:\ProgramData\Norton not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Michael Hering
->Temp folder emptied: 1393316 bytes
->Temporary Internet Files folder emptied: 36337 bytes
->Java cache emptied: 43080531 bytes
->FireFox cache emptied: 74732656 bytes
->Flash cache emptied: 111143 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11720482 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 125,00 mb

OTL by OldTimer - Version 3.2.18.0 log created on 12292010_115334

Files\Folders moved on Reboot...
C:\Users\Michael Hering\AppData\Local\Temp\ehmsas.txt moved successfully.

Registry entries deleted on Reboot...

cosinus · 29.12.2010, 14:06

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

28.12.2010, 18:13	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	TR/Crypt.ZPACK.Gen-Avira sprint ständig an und kann den Trojaner nicht löschen Mehr kam da nicht? Poste das Fixlog bitte vollständig!! __________________ --> TR/Crypt.ZPACK.Gen-Avira sprint ständig an und kann den Trojaner nicht löschen

TR/Crypt.ZPACK.Gen-Avira sprint ständig an und kann den Trojaner nicht löschen

Plagegeister aller Art und deren Bekämpfung: TR/Crypt.ZPACK.Gen-Avira sprint ständig an und kann den Trojaner nicht löschen