Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Trojaner: Age of Empires 2 AutoRun/setup

Trojaner: Age of Empires 2 AutoRun/setup


Plagegeister aller Art und deren Bekämpfung: Trojaner: Age of Empires 2 AutoRun/setup

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 31.12.2010, 13:05   #1
andreasb.
 
Trojaner: Age of Empires 2 AutoRun/setup - Standard

Trojaner: Age of Empires 2 AutoRun/setup


Mein Bruder hat sich Age of Empires 2 bei Amazon in einer gebrachten Version gekauft, als ich es heute installieren wollte kam bei mir nach der Installation eine Warnmeldung von meinem Kaspersky Internet Security scanner das ein Trojaner gefunden wurde.
Die Meldung war:

Verdächtiges Verhalten wurde erkannt
Microsoft Age of Empires 2 AutoRun/Setup
C:\USERS\*****\APPDATA\LOCAL\TEMP\EBU4E8D.EXE
Geufunden: PDM.Trojan.generic

und dann wie immer: gefunden, beendet, quarantäne, gelöscht, ich bekommen noch eine Meldung:
Intsallation von Hooks verboten,
und jetzt findet er auch nichts mehr, sonst sah der zustand der CD eigentlich in Ordnung aus nur auf der Rückseite sind 3 kleine Kratzer nebeneinander, auf der Addon CD sind keine Kratzer.
Bei Google gab es viele themen in denen es um einen grafikfehler bei vista / 7 ging, und ich habe einen Beitrag gefunden indem es darum ging das man mit einer älteren Version von Kaspersky Age of Empires 2 nicht starten kann.


Noch ein paar Details zu meinem System falls es wichtig ist:
Intel Core i5 2,66 GHz
4 GB RAM (3GB können genuzt werden)
Radeon HD 4850 512MB
1 TB HD
Windows 7 Home Premium 32Bit
Kaspersky Internet Security 2011



OTL Systemscan:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 31.12.2010 12:28:56 - Run 1
OTL by OldTimer - Version 3.2.18.2     Folder = C:\Users\******\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 205,19 Gb Total Space | 69,60 Gb Free Space | 33,92% Space Free | Partition Type: NTFS
Drive F: | 726,00 Gb Total Space | 584,53 Gb Free Space | 80,51% Space Free | Partition Type: HFS
 
Computer Name: ******-WINPC | User Name: ****** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\******\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Boot Camp\Bootcamp.exe (Apple Inc.)
PRC - C:\Windows\System32\AppleOSSMgr.exe ()
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Parallels\Parallels Tools\Services\prl_tools_service.exe (Parallels Holdings, Ltd. and its affiliates.)
PRC - C:\Programme\Parallels\Parallels Tools\prl_cc.exe (Parallels Holdings, Ltd. and its affiliates.)
PRC - C:\Programme\Parallels\Parallels Tools\Services\prl_tools.exe (Parallels Holdings, Ltd. and its affiliates.)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe (Kaspersky Lab ZAO)
PRC - C:\Windows\System32\AppleTimeSrv.exe (Apple Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Stardock\MyColors\WBVista.exe ()
PRC - C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation)
PRC - C:\Programme\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe (Hewlett-Packard Co.)
PRC - c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\******\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AppleOSSMgr) -- C:\Windows\System32\AppleOSSMgr.exe ()
SRV - (Futuremark SystemInfo Service) -- C:\Program Files\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe (Futuremark Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (Parallels Coherence Service) -- C:\Programme\Parallels\Parallels Tools\Services\coherence.exe (Parallels Holdings, Ltd. and its affiliates.)
SRV - (Parallels Tools Service) -- C:\Programme\Parallels\Parallels Tools\Services\prl_tools_service.exe (Parallels Holdings, Ltd. and its affiliates.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (aspnet_state) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetTcpActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetPipeActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetMsmqActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (AppleTimeSrv) -- C:\Windows\System32\AppleTimeSrv.exe (Apple Inc.)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (WindowBlinds) -- C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation)
SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (AppleHFS) -- C:\Windows\System32\drivers\AppleHFS.sys (Apple Inc.)
DRV - (MacHALDriver) -- C:\Windows\System32\drivers\MacHALDriver.sys (Apple Inc.)
DRV - (AppleMNT) -- C:\Windows\System32\drivers\AppleMNT.sys (Apple Inc.)
DRV - (KeyAgent) -- C:\Windows\System32\drivers\KeyAgent.sys (Apple Inc.)
DRV - (CirrusFilter) -- C:\Windows\System32\drivers\CS420x86.sys (Cirrus Logic)
DRV - (applewtp) -- C:\Windows\System32\drivers\applewtp.sys (Apple Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (prl_fs) -- C:\Windows\System32\drivers\prl_fs.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_time) -- C:\Windows\System32\drivers\prl_time.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_tg) -- C:\Windows\system32\DRIVERS\prl_tg.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_pv32) -- C:\Windows\system32\DRIVERS\prl_pv32.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_mouf) -- C:\Windows\System32\drivers\prl_mouf.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_memdev) -- C:\Programme\Parallels\Parallels Tools\Drivers\prl_memdev\prl_memdev.sys ()
DRV - (prl_dd) Parallels Display Adapter (WDDM) -- C:\Windows\System32\drivers\prl_kmdd.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_eth5) -- C:\Windows\System32\drivers\prl_eth5.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (prl_boot) -- C:\Windows\System32\drivers\prl_boot.sys (Parallels Holdings, Ltd. and its affiliates.)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (kl2) -- C:\Windows\System32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) -- C:\Windows\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV - (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM) -- C:\Windows\System32\drivers\ac97intc.sys (Intel Corporation)
DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (AppleBtBc) -- C:\Windows\System32\drivers\AppleBtBc.sys (Apple Inc.)
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (applebmt) -- C:\Windows\System32\drivers\applebmt.sys (Apple Inc.)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (IRRemoteFlt) -- C:\Windows\System32\drivers\IRFilter.sys (Apple Inc.)
DRV - (KeyMagic) -- C:\Windows\System32\drivers\KeyMagic.sys (Apple Inc.)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation)
DRV - (mcdbus) -- C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0F B4 CD 8D 18 FF CA 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: KavAntiBanner@Kaspersky.ru:11.0.0.232
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.0.232
FF - prefs.js..extensions.enabledItems: {4176DFF4-4698-11DE-BEEB-45DA55D89593}:0.8.6
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.1
FF - prefs.js..extensions.enabledItems: auntie12@hellokitty.com:0.1
FF - prefs.js..extensions.enabledItems: videosurf_enhanced@videosurf.com:0.76
FF - prefs.js..extensions.enabledItems: {b41cb5f0-2e52-11de-8c30-0800200c9a66}:2.1
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.06.17 18:41:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.13 21:20:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.13 21:20:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2010.07.21 14:47:25 | 000,000,000 | ---D | M]
 
[2010.11.03 22:22:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Extensions
[2010.12.31 12:23:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions
[2010.11.18 20:07:36 | 000,000,000 | ---D | M] (AniWeather) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}
[2010.11.03 22:23:39 | 000,000,000 | ---D | M] (Black Stratini) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\{b41cb5f0-2e52-11de-8c30-0800200c9a66}
[2010.12.23 22:10:58 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.11.18 20:07:38 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010.11.04 16:52:05 | 000,000,000 | ---D | M] (Real Fullscreen) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\auntie12@hellokitty.com
[2010.11.04 16:52:05 | 000,000,000 | ---D | M] (VideoSurf Videos at a Glance) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\9su2qu45.default\extensions\videosurf_enhanced@videosurf.com
[2010.11.04 15:28:32 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.11.04 15:28:33 | 000,000,000 | ---D | M] (Kaspersky Anti-Banner) -- C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru
[2010.11.04 15:28:32 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.11.04 15:28:33 | 000,000,000 | ---D | M] (Kaspersky Anti-Banner) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\KAVANTIBANNER@KASPERSKY.RU
[2010.11.04 15:28:32 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\LINKFILTER@KASPERSKY.RU
[2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.29 11:45:05 | 000,000,848 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       .psf
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apple_KbdMgr] C:\Programme\Boot Camp\Bootcamp.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Parallels Shared Internet Applications] C:\Program Files\Parallels\Parallels Tools\SIA\SharedIntApp.exe (Parallels Holdings, Ltd. and its affiliates.)
O4 - HKLM..\Run: [Parallels Tools Center] C:\Program Files\Parallels\Parallels Tools\prl_cc.exe (Parallels Holdings, Ltd. and its affiliates.)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = C:\Users\******\AppData\Local\Temp\is-R9DLD.tmp\ATR1.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:  = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: .psf ([]* in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0a405f46-6cdc-11df-af36-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0a405f46-6cdc-11df-af36-806e6f6e6963}\Shell\AutoRun\command - "" = D:\LaunchEAWG.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.31 12:28:12 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\******\Desktop\OTL.exe
[2010.12.29 22:58:53 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\Risen
[2010.12.29 19:44:42 | 000,000,000 | ---D | C] -- C:\Windows\1C4551A64743409391E41477CD655043.TMP
[2010.12.29 19:27:38 | 000,000,000 | ---D | C] -- C:\Programme\Deep Silver
[2010.12.29 19:25:26 | 000,000,000 | ---D | C] -- C:\Users\******\Desktop\Risen-Demo-PC-EFIGS-V2
[2010.12.27 11:04:46 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Futuremark Shared
[2010.12.16 10:13:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.16 10:13:17 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.12.16 10:13:17 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.12.16 10:13:15 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.16 10:13:15 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.16 10:13:15 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.16 10:13:15 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
[2010.12.16 10:13:10 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.16 10:13:09 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.16 10:13:09 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.12.16 10:13:09 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.16 10:13:09 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.16 10:13:09 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.12.16 10:13:09 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.12.16 10:13:09 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.12.16 10:13:08 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.12.16 10:13:08 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.16 10:13:08 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.12.16 10:13:06 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2010.12.16 10:13:05 | 000,101,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.16 10:13:04 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.13 21:19:43 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime
[2010.12.09 16:40:18 | 000,000,000 | ---D | C] -- C:\Users\******\Desktop\EMPIRE AT WAR MODS
[2010.12.09 16:30:55 | 447,234,131 | ---- | C] (Thrawn's Revenge Mod Team                                    ) -- C:\Users\******\Desktop\trsetup.exe
[2010.12.01 19:45:19 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\Idealgewichtsrechner
[2010.12.01 19:06:18 | 000,000,000 | ---D | C] -- C:\Users\******\Desktop\VB
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.31 12:28:14 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\******\Desktop\OTL.exe
[2010.12.31 12:18:12 | 000,000,252 | -HS- | M] () -- C:\Windows\KLIF.spi
[2010.12.31 11:40:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.31 11:36:36 | 000,014,800 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.31 11:36:36 | 000,014,800 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.31 11:29:56 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.31 10:28:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.31 10:28:47 | 2407,944,192 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.30 19:12:15 | 000,761,444 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.12.30 19:12:15 | 000,716,762 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.12.30 19:12:15 | 000,171,830 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.12.30 19:12:15 | 000,144,784 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.12.29 22:58:48 | 000,002,112 | ---- | M] () -- C:\Users\Public\Desktop\Risen Demo.lnk
[2010.12.25 18:10:19 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_applewtp_01005.Wdf
[2010.12.18 13:48:01 | 000,007,609 | ---- | M] () -- C:\Users\******\AppData\Local\resmon.resmoncfg
[2010.12.16 16:42:02 | 000,302,008 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.12.13 21:19:48 | 000,001,825 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.12.09 17:03:19 | 000,002,350 | ---- | M] () -- C:\Users\Public\Desktop\Launch Thrawns Revenge.lnk
[2010.12.09 16:39:24 | 447,234,131 | ---- | M] (Thrawn's Revenge Mod Team                                    ) -- C:\Users\******\Desktop\trsetup.exe
[2010.12.08 10:10:28 | 000,114,243 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat
[2010.12.08 10:10:28 | 000,097,859 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat
[2010.12.02 16:17:30 | 419,886,521 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.31 12:18:04 | 000,000,252 | -HS- | C] () -- C:\Windows\KLIF.spi
[2010.12.31 11:33:01 | 010,626,586 | ---- | C] () -- C:\Users\******\Desktop\FoC-Mappack_5_setup.exe
[2010.12.29 22:58:48 | 000,002,112 | ---- | C] () -- C:\Users\Public\Desktop\Risen Demo.lnk
[2010.12.25 18:10:19 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_applewtp_01005.Wdf
[2010.12.13 21:19:48 | 000,001,825 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.12.09 17:03:19 | 000,002,350 | ---- | C] () -- C:\Users\Public\Desktop\Launch Thrawns Revenge.lnk
[2010.12.02 16:17:30 | 419,886,521 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.11.02 20:07:49 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.30 10:47:43 | 000,015,176 | ---- | C] () -- C:\Windows\System32\drivers\prl_memdev.sys
[2010.07.10 18:56:04 | 000,697,328 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2010.06.04 13:09:14 | 000,007,609 | ---- | C] () -- C:\Users\******\AppData\Local\resmon.resmoncfg
[2010.06.03 18:21:35 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.06.03 10:01:31 | 000,001,624 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2010.05.29 12:14:53 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.05.29 12:14:53 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.05.29 11:45:03 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.09 08:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll

< End of report >
--- --- ---
Geändert von andreasb. (31.12.2010 um 13:57 Uhr)

Alt 02.01.2011, 11:56   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Trojaner: Age of Empires 2 AutoRun/setup - Standard

Trojaner: Age of Empires 2 AutoRun/setup


Ist das ne Original-CD? Kann man ja von ausgehen, wenn es gebraucht bei Amazon gekauft wurde. Wenn ja, kann man hier von einem Fehlalarm ausgehen.

Du kannst trotzdem mal Malwarebytes ausführen (bitte Vollscan!) und das Log posten.
__________________

__________________
Alt 11.01.2011, 22:26   #3
andreasb.
 
Trojaner: Age of Empires 2 AutoRun/setup - Standard

Trojaner: Age of Empires 2 AutoRun/setup


Ok Danke für die schnelle Antwort, lag wohl eher an Windows 7 oder an Kaspersky denn bei meinem Bruder auf XP läufts jetzt.
__________________
Antwort

Themen zu Trojaner: Age of Empires 2 AutoRun/setup
adblock, adobe, avp.exe, bho, black, bonjour, corp./icp, defender, display adapter, downloader, firefox, firefox.exe, fontcache, format, google, home, home premium, installation, internet, intranet, kaspersky, langs, location, logfile, mozilla, nicht starten, nvstor.sys, oldtimer, otl.exe, parallels, plug-in, programdata, registry, rojaner gefunden, scan, searchplugins, security, security scan, security scanner, server, software, sptd.sys, start menu, starten, system, taskhost.exe, tastatur, trojaner, trojaner gefunden, usb, vista, webcheck


« Scheinantivirprogramm "System Tool", alle .exe blockiert ! | Herausfinden inwiefern man auspioniert wurde? »


Ähnliche Themen: Trojaner: Age of Empires 2 AutoRun/setup


  1. Avira findet Trojaner TR/Autorun.BS.28
    Log-Analyse und Auswertung - 30.01.2015 (11)
  2. Trojaner FlashPlayerpro-setup.exe, Acrobat,
    Plagegeister aller Art und deren Bekämpfung - 06.07.2014 (1)
  3. Snapdo und DivX Setup und DivX-Setup
    Plagegeister aller Art und deren Bekämpfung - 20.11.2013 (22)
  4. Trojaner bei Setup Zugriff erlaubt
    Plagegeister aller Art und deren Bekämpfung - 02.08.2011 (9)
  5. Autorun blockiert C:\autorun.inf frisches System
    Plagegeister aller Art und deren Bekämpfung - 30.08.2010 (6)
  6. trojaner win32.autorun.tmp
    Mülltonne - 03.08.2010 (3)
  7. "autorun.inf ist der Trojaner: TR/Autorun.TE" Meldung beim Anschluss eines USB Sticks
    Plagegeister aller Art und deren Bekämpfung - 21.03.2010 (19)
  8. Trojaner legt Virenprogramme lahm, verhindert Installation mbam-setup.exe
    Plagegeister aller Art und deren Bekämpfung - 05.01.2010 (3)
  9. Trojaner legt Virenprogramme lahm, verhindert auch die Installation des mbam-setup
    Antiviren-, Firewall- und andere Schutzprogramme - 05.01.2010 (15)
  10. autorun.inf - TR/Autorun.SJ.1 Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 05.01.2010 (1)
  11. TROJANER Flut! W32/Delf.EKEH, INI/AutoRun.CYI, WSCommCntr1.exe, BAT/Autorun.IZJ
    Plagegeister aller Art und deren Bekämpfung - 06.11.2009 (3)
  12. autorun.inf: Trojan.Autorun-271 FOUND - USB-Stick
    Log-Analyse und Auswertung - 11.03.2009 (1)
  13. autorun.inf - boot.com - anscheinend trojaner
    Log-Analyse und Auswertung - 01.02.2009 (2)
  14. Autorun.inf -> Trojaner?
    Log-Analyse und Auswertung - 17.11.2008 (0)
  15. O4 - HKLM\..\Run: [zzGBK] D:\setup.exe = Trojaner?
    Log-Analyse und Auswertung - 29.01.2007 (2)
  16. Trojaner erstellt setup.exe
    Plagegeister aller Art und deren Bekämpfung - 27.08.2006 (6)
  17. autom. Setup.exe und autorun.ini erstellt
    Plagegeister aller Art und deren Bekämpfung - 29.07.2006 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Trojaner: Age of Empires 2 AutoRun/setup - Mein Bruder hat sich Age of Empires 2 bei Amazon in einer gebrachten Version gekauft, als ich es heute installieren wollte kam bei mir nach der Installation eine Warnmeldung von - Trojaner: Age of Empires 2 AutoRun/setup...
Archiv
Du betrachtest: Trojaner: Age of Empires 2 AutoRun/setup auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55