| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7 : Taskbar / Browser nach Systemstart im "Windows Classic" Format , Sound ausgeschaltetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
19.01.2011, 21:08
| #1 |
 |  Windows 7 : Taskbar / Browser nach Systemstart im "Windows Classic" Format , Sound ausgeschaltet Hallo zusammen, als ich heute meinen Computer eingeschaltet habe musste ich feststellen , dass einerseits kein Sound mehr vorhanden war (lässt sich auch nicht mehr "einschalten" , da die nötige Hardware nicht erkannt werden kann - ebenso ist das Windows 7 Security Center nicht mehr aktivierbar) , zum anderen wird meine Taskbar (und auch andere Programme wie Explorer , Mozilla Browser) nun in einem sog. "Windows Classic Style" dargestellt. Es hat wohl ein ähnliches Problem in diesem Forum gegeben : "http://www.trojaner-board.de/91327-v...ten-stil.html" Leider konnte ich mein Problem mit Hilfe dieses Links nicht beheben und wende mich daher in einem seperaten Thema an euch. Lange Rede kurzer Sinn , hier sind ein paar Log-Files , die euch hoffentlich weiterhelfen können : OTL Textdatei Code:
ATTFilter OTL logfile created on: 19.01.2011 20:10:07 - Run 1 OTL by OldTimer - Version 3.2.20.2 Folder = C:\Users\***\Desktop\Documents\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 80,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 931,51 Gb Total Space | 468,61 Gb Free Space | 50,31% Space Free | Partition Type: NTFS Drive D: | 31,48 Gb Total Space | 1,92 Gb Free Space | 6,08% Space Free | Partition Type: NTFS Computer Name: *** | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Malte\Desktop\Documents\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () ========== Modules (SafeList) ========== MOD - C:\Users\***\Desktop\Documents\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com) SRV:64bit: - (SandraAgentSrv) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP2\RpcAgentSrv.exe (SiSoftware) SRV:64bit: - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (LVSrvLauncher) -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.) SRV:64bit: - (LVPrcS64) -- c:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TunngleService) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe (Tunngle.net GmbH) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (DAUpdaterSvc) -- C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare) SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV:64bit: - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\SysNative\drivers\tap0901t.sys (Tunngle.net) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (SANDRA) -- C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP2\WNt500x64\sandra.sys (SiSoftware) DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.) DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.) DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.) DRV:64bit: - (L8042Kbd) -- C:\Windows\SysNative\drivers\L8042Kbd.sys (Logitech, Inc.) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (LVPr2Mon) -- C:\Windows\SysNative\drivers\LVPr2Mon.sys () DRV:64bit: - (LVMVDrv) -- C:\Windows\SysNative\drivers\LVMVdrv.sys (Logitech Inc.) DRV:64bit: - (LVcKap64) -- C:\Windows\SysNative\drivers\LVCKap64.sys (Logitech Inc.) DRV:64bit: - (LVUSBS64) -- C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.) DRV:64bit: - (PID_0928) Logitech QuickCam Express(PID_0928) -- C:\Windows\SysNative\drivers\LV561V64.sys (Logitech Inc.) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://forums.heroesofnewerth.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 50 DE AF C8 35 15 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://forums.heroesofnewerth.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.10 21:19:31 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.10 21:19:31 | 000,000,000 | ---D | M] [2010.06.26 15:13:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Malte\AppData\Roaming\Mozilla\Extensions [2010.06.27 01:02:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Malte\AppData\Roaming\Mozilla\Firefox\Profiles\rc71ynbe.default\extensions [2011.01.17 21:32:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.01.17 21:32:57 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.08.14 17:55:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.16 17:02:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.07.17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll [2010.06.12 02:24:05 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.06.12 02:24:05 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml [2010.06.12 02:24:05 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.06.12 02:24:05 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.06.12 02:24:05 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O29:64bit: - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.02.15 18:51:23 | 000,000,057 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{e13ca5e0-81ee-11df-9fbf-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{e13ca5e0-81ee-11df-9fbf-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRunCD.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.01.19 15:01:54 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011.01.17 21:38:14 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\skypePM [2011.01.17 21:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.01.17 21:32:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2011.01.17 21:32:17 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2011.01.17 21:32:15 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Skype [2011.01.17 21:31:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.01.07 16:11:09 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Logitech [2011.01.07 16:11:04 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Leadertech [2011.01.07 16:08:12 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech [2011.01.05 21:37:00 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\SUPERAntiSpyware.com [2011.01.05 21:37:00 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2011.01.05 21:36:56 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware [2011.01.05 21:36:56 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE [2011.01.05 21:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2011.01.05 21:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.01.05 21:26:50 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.01.05 21:20:12 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Malwarebytes [2011.01.05 21:20:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.01.05 21:20:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.01.05 21:19:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.01.05 21:19:55 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.01.05 21:19:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.01.04 15:55:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KONAMI [2011.01.04 15:46:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KONAMI [2011.01.03 06:34:35 | 000,000,000 | ---D | C] -- C:\Users\Malte\Desktop\Documents\Penumbra Black Plague [2011.01.02 20:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Silent Hill [2011.01.02 20:33:59 | 000,720,896 | ---- | C] (Indigo Rose Corporation) -- C:\Windows\iun6002ev.exe [2011.01.02 20:33:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Silent Hill [2011.01.02 00:03:35 | 000,000,000 | ---D | C] -- C:\Users\Malte\Desktop\Documents\Amnesia [2011.01.02 00:02:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amnesia - The Dark Descent [2011.01.01 23:57:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amnesia - The Dark Descent [2010.12.31 17:24:43 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Local\Electronic Arts [2010.12.31 17:14:52 | 000,000,000 | ---D | C] -- C:\Users\Malte\Desktop\Documents\Electronic Arts [2010.12.31 15:59:21 | 000,000,000 | ---D | C] -- C:\Program Files\Recuva [2010.12.31 15:45:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Inspector File Recovery [2010.12.31 15:45:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Inspector File Recovery [2010.12.31 15:29:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect [2010.12.31 02:56:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mass Effect 2 [2010.12.30 15:48:48 | 000,000,000 | ---D | C] -- C:\Users\Malte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StarCraft II [2004.11.24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\Windows\SysWow64\drvc.dll [6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.01.19 20:10:32 | 000,020,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.19 20:10:32 | 000,020,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.19 20:05:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.01.19 20:05:23 | 1609,371,648 | -HS- | M] () -- C:\hiberfil.sys [2011.01.19 16:08:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat [2011.01.19 16:00:02 | 000,000,374 | ---- | M] () -- C:\Windows\tasks\At1.job [2011.01.17 21:38:27 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat [2011.01.12 20:16:35 | 000,739,790 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.01.12 20:16:35 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.01.12 20:16:35 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.01.07 16:09:59 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LMouFilt_01005.Wdf [2011.01.07 16:09:59 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LHidFilt_01005.Wdf [2011.01.07 16:09:56 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LUsbFilt_01005.Wdf [2011.01.05 21:34:50 | 000,047,122 | ---- | M] () -- C:\Users\Malte\Desktop\Documents\cc_20110105_213431.reg [2011.01.02 20:34:58 | 000,720,896 | ---- | M] (Indigo Rose Corporation) -- C:\Windows\iun6002ev.exe [2010.12.31 15:29:15 | 000,000,814 | ---- | M] () -- C:\Users\Malte\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk [6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.01.17 21:38:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.01.07 16:09:59 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LMouFilt_01005.Wdf [2011.01.07 16:09:59 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LHidFilt_01005.Wdf [2011.01.07 16:09:56 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_LUsbFilt_01005.Wdf [2011.01.05 21:34:35 | 000,047,122 | ---- | C] () -- C:\Users\Malte\Desktop\Documents\cc_20110105_213431.reg [2011.01.03 13:12:14 | 000,000,374 | ---- | C] () -- C:\Windows\tasks\At1.job [2010.12.31 15:45:55 | 000,006,200 | ---- | C] () -- C:\Windows\SysWow64\INT13EXT.VXD [2010.12.31 15:29:15 | 000,000,814 | ---- | C] () -- C:\Users\Malte\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk [2010.09.04 07:50:28 | 000,003,584 | ---- | C] () -- C:\Users\Malte\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.31 01:57:30 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll [2010.07.31 01:57:30 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll [2010.07.31 01:57:30 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll [2010.07.16 19:48:30 | 000,000,093 | ---- | C] () -- C:\Users\Malte\AppData\Local\fusioncache.dat [2010.07.16 19:14:24 | 000,734,870 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.06.29 00:14:26 | 000,040,960 | R--- | C] () -- C:\Windows\SysWow64\psfind.dll [2010.06.26 21:24:00 | 012,824,576 | ---- | C] () -- C:\ProgramData\sandra.mda [2010.04.02 16:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2008.12.19 16:15:58 | 004,338,246 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll [2008.12.17 18:41:18 | 000,884,237 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll [2008.12.17 18:22:58 | 000,093,184 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll [2008.12.17 18:22:48 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2008.12.17 18:17:34 | 000,239,247 | ---- | C] () -- C:\Windows\SysWow64\ff_theora.dll [2008.12.17 17:59:54 | 000,560,802 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll [2007.08.01 04:39:28 | 000,012,536 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS [2004.10.03 18:50:54 | 000,129,024 | ---- | C] () -- C:\Windows\SysWow64\ff_mpeg2enc.dll ========== LOP Check ========== [2010.10.24 11:21:38 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\.purple [2011.01.12 01:16:54 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Azureus [2010.12.24 22:01:42 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Bioshock [2010.06.27 02:35:01 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\BitTorrent [2010.07.19 00:36:05 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\DAEMON Tools Lite [2010.06.27 14:23:12 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\DAEMON Tools Pro [2011.01.18 23:45:42 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\HLSW [2011.01.18 23:44:24 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\ICQ [2010.11.28 16:09:35 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\IrfanView [2011.01.07 16:11:04 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Leadertech [2010.10.21 16:09:24 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Tunngle [2010.07.12 13:46:46 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\Ubisoft [2010.12.13 17:52:35 | 000,000,000 | ---D | M] -- C:\Users\Malte\AppData\Roaming\uTorrent [2011.01.19 16:00:02 | 000,000,374 | ---- | M] () -- C:\Windows\Tasks\At1.job [2010.11.28 10:19:32 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5554
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
19.01.2011 20:04:14
mbam-log-2011-01-19 (20-04-14).txt
Scan type: Quick scan
Objects scanned: 156526
Time elapsed: 1 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc\Start (Disabled.Cryptsvc) -> Bad: (4) Good: (2) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
 Edit: Ich sollte noch erwähnen , dass Programme wie der AntiVir Guard / Planer deaktiviert worden sind , genauso wie viele andere Programme , die normalerweise am Programmstart ausgeführt werden - ebenfalls der Taskmanager hat sich enorm geleert Edit #2: der gesamte "Startup-Bereich" der msconfig wurde ausgeschaltet Mfg, Jankalor Geändert von Jankalor (19.01.2011 um 21:17 Uhr) |
| Themen zu Windows 7 : Taskbar / Browser nach Systemstart im "Windows Classic" Format , Sound ausgeschaltet |
| .dll, askbar, autorun, avgntflt.sys, avira, bho, black, browser, computer, defender, desktop, disabled.cryptsvc, error, explorer, firefox, firefox.exe, format, infected, langs, location, log-files, logfile, mozilla, nvidia, object, oldtimer, otl.exe, plug-in, problem, programdata, programme, registry, scan, sched.exe, searchplugins, security, sptd.sys, start menu, superantispyware, syswow64, webcheck, windows, windows 7 security center |
Baum-Darstellung