| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Malwarebytes findet Trojan.Bancos + RiskWare.Tool.CK + Trojan.Agent.CK...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.05.2011, 01:01
| #1 |
 |  Malwarebytes findet Trojan.Bancos + RiskWare.Tool.CK + Trojan.Agent.CK... Hallo Experten Team! Hier der ewige PC Anfänger!  Ich bekomme den Trojan.Bancos nicht weg den mir Malwarebytes nur bei vollständigen scan seit anzeigt. Dachte ich hätte ihn vor ca 3-4 Monaten beseitigt...aber weder spybot noch malware haben ihn gekillt Hier die Malware und OTL Logs:[/B] Scan type: Full scan (C:\|D:\|E:\|) Objects scanned: 238030 Time elapsed: 37 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: d:\downloads\programme\Diverses\XPLite\Patch\patch.exe (Trojan.Bancos) -> Quarantined and deleted successfully. d:\downloads\programme\programme\o&o defrag\keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. d:\downloads\Style\windowblinds\wb55patch.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully. e:\smartdownload.exe (Adware.Casino) -> Quarantined and deleted successfully. OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.05.2011 01:04:12 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\***\Desktop Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.014,00 Mb Total Physical Memory | 497,00 Mb Available Physical Memory | 49,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 71,00% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 20,00 Gb Total Space | 1,89 Gb Free Space | 9,47% Space Free | Partition Type: NTFS Drive D: | 30,00 Gb Total Space | 23,44 Gb Free Space | 78,15% Space Free | Partition Type: NTFS Drive E: | 61,79 Gb Total Space | 55,23 Gb Free Space | 89,39% Space Free | Partition Type: NTFS Computer Name: TOSHIBA | User Name: *** | NOT logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Opera\opera.exe (Opera Software) PRC - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) PRC - E:\Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) PRC - E:\TMMonitor.exe (ArcSoft, Inc.) PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - E:\Programme\Samsung\EmoDio\SMSTray.exe (SAMSUNG ELECTRONICS) PRC - E:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION) PRC - C:\Programme\Toshiba\TOSHIBA Applet\THotkey.exe (TOSHIBA) PRC - C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation) PRC - C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation) PRC - C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation) PRC - C:\Programme\Toshiba\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation) PRC - C:\Programme\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) PRC - C:\Programme\Synaptics\SynTP\Toshiba.exe (Synaptics, Inc.) PRC - C:\Programme\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation) PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) PRC - C:\Programme\Toshiba\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation) PRC - C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\***\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.01 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51 FF - HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.04.24 10:29:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: E:\Programme\components [2011.03.28 18:51:42 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: E:\Programme\plugins [2011.04.24 10:17:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.04.24 10:29:54 | 000,000,000 | ---D | M] [2010.05.14 22:12:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions [2011.05.02 10:43:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\echmi1dn.default\extensions [2010.06.07 11:27:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\echmi1dn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.04.22 12:14:38 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\echmi1dn.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE} [2011.04.22 12:14:42 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\echmi1dn.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2011.03.14 11:54:05 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\echmi1dn.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2010.05.14 22:14:55 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.04.24 10:29:54 | 000,000,000 | ---D | M] (Firefox Synchronisation Extension) -- C:\PROGRAMME\NOKIA\NOKIA OVI SUITE\CONNECTORS\BOOKMARKS CONNECTOR\FIREFOXEXTENSION [2010.05.14 22:15:06 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAMME\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2010.05.15 00:22:11 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAMME\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.20 15:17:57 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAMME\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.08 06:00:53 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAMME\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.15 00:25:21 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAMME\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} O1 HOSTS File: ([2004.08.10 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (dsWebAllowBHO Class) - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Programme\Windows Desktop Search\dsWebAllow.dll (Microsoft Corporation) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (CNisExtBho Class) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - File not found O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - File not found O2 - BHO: (MSN Suche Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar Suite\msntb.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (MSN Suche Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar Suite\msntb.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\ShellBrowser: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - File not found O3 - HKCU\..\Toolbar\WebBrowser: (Norton Internet Security 2006) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - File not found O3 - HKCU\..\Toolbar\WebBrowser: (MSN Suche Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar Suite\msntb.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [avgnt] E:\Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation) O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation) O4 - HKLM..\Run: [IR_SERVER] File not found O4 - HKLM..\Run: [NDSTray.exe] File not found O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [SmoothView] C:\Programme\Toshiba\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [SMSTray] E:\Programme\Samsung\EmoDio\SMSTray.exe (SAMSUNG ELECTRONICS) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TFncKy] File not found O4 - HKLM..\Run: [THotkey] C:\Programme\Toshiba\TOSHIBA Applet\THotkey.exe (TOSHIBA) O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [Tvs] C:\Programme\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation) O4 - HKCU..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE (SEIKO EPSON CORPORATION) O4 - HKCU..\Run: [PC Suite Tray] File not found O4 - HKCU..\Run: [SpybotSD TeaTimer] E:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKCU..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\TMMonitor.lnk = E:\TMMonitor.exe (ArcSoft, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &MSN Suche - C:\Programme\MSN Toolbar Suite\msntb.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1273846840203 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.250.99 193.189.244.205 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\TOSHIBA SATELLITE.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\TOSHIBA SATELLITE.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.13 16:57:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2007.05.09 11:51:00 | 000,002,623 | ---- | M] () - E:\autofill.conf -- [ NTFS ] O33 - MountPoints2\{1998baba-d987-11df-bae5-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{1998baba-d987-11df-bae5-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1998baba-d987-11df-bae5-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{315a2a6e-ef6a-11df-bb31-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{315a2a6e-ef6a-11df-bb31-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{315a2a6e-ef6a-11df-bb31-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{4289bb38-162a-11e0-bbb2-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{4289bb38-162a-11e0-bbb2-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4289bb38-162a-11e0-bbb2-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{49832d33-5f57-11df-b922-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{49832d33-5f57-11df-b922-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{49832d33-5f57-11df-b922-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{49832d35-5f57-11df-b922-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{49832d35-5f57-11df-b922-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{49832d35-5f57-11df-b922-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{4bf27274-5f59-11df-b923-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{4bf27274-5f59-11df-b923-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4bf27274-5f59-11df-b923-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{713b9fda-d180-11df-bac6-0018de4f0474}\Shell - "" = AutoRun O33 - MountPoints2\{713b9fda-d180-11df-bac6-0018de4f0474}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{713b9fda-d180-11df-bac6-0018de4f0474}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{dd3fa792-dc4a-11df-baed-0018de4f0474}\Shell\AutoRun\command - "" = G:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.05.11 01:00:59 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe [2011.04.30 19:12:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\G-Style [2011.04.24 19:11:38 | 000,016,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll [2011.04.24 18:41:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\*** [2011.04.24 10:26:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF [2011.04.24 10:26:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles [2006.09.14 11:48:14 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\DLLVGA.dll [6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.05.11 01:00:59 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\OTL.exe [2011.05.11 00:50:00 | 000,000,358 | ---- | M] () -- C:\WINDOWS\tasks\Check Updates for MSN Search Toolbar.job [2011.05.10 23:27:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.05.10 23:27:27 | 1063,309,312 | -HS- | M] () -- C:\hiberfil.sys [2011.05.05 17:15:35 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf [2011.05.01 00:22:31 | 000,002,022 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\G-Style2.axp [2011.04.30 22:08:44 | 000,005,120 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.04.27 03:00:36 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.04.24 10:29:15 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.04.24 10:28:57 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2011.04.24 10:26:59 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.04.24 10:17:22 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk [2011.04.16 08:41:06 | 000,133,280 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.04.16 02:31:05 | 000,458,766 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.04.16 02:31:05 | 000,441,124 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.04.16 02:31:05 | 000,084,280 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.04.16 02:31:05 | 000,071,060 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.04.14 09:14:18 | 000,007,720 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\***.rtf [6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.05 17:15:35 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf [2011.05.01 00:22:27 | 000,002,022 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\G-Style2.axp [2011.04.24 10:26:59 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.04.14 09:14:18 | 000,007,720 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Eigene Dateien\***.rtf [2010.09.19 15:05:09 | 000,695,578 | ---- | C] () -- C:\WINDOWS\unins000.exe [2010.09.19 15:05:09 | 000,001,287 | ---- | C] () -- C:\WINDOWS\unins000.dat [2010.09.04 05:39:02 | 000,005,120 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.06.27 00:22:24 | 000,073,832 | ---- | C] () -- C:\WINDOWS\System32\SuperFrameSplitter.dll [2010.06.27 00:22:24 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\RTKDABMWare.dll [2010.05.14 22:28:58 | 000,029,696 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db [2010.05.14 22:12:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010.05.14 14:46:18 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2009.04.16 13:24:14 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll [2009.04.16 13:24:14 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2009.04.16 13:24:14 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2009.04.16 13:24:14 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\Ogg.dll [2006.09.14 18:34:45 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2006.09.14 18:34:44 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006.09.14 18:34:43 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006.09.14 18:34:43 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006.09.14 18:34:41 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006.09.14 18:34:41 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2006.09.14 18:34:38 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2006.09.14 18:34:38 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2006.09.14 18:34:37 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2006.09.14 18:34:26 | 000,121,995 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2006.09.14 14:30:22 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006.09.14 14:14:50 | 000,000,562 | ---- | C] () -- C:\WINDOWS\TBTdetect.ini [2006.09.14 13:54:01 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.09.14 13:50:38 | 000,127,184 | ---- | C] () -- C:\WINDOWS\Unwise.exe [2006.09.14 12:18:00 | 000,000,222 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006.09.14 12:10:35 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2006.09.14 12:10:34 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2006.09.14 12:10:34 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2006.09.14 12:10:34 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2006.09.14 12:10:34 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2006.09.14 12:10:34 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2006.09.14 11:57:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI [2006.09.14 11:56:57 | 000,036,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\CSIIDecoder_kern_i386.sys [2006.09.14 11:56:57 | 000,029,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys [2006.09.14 11:48:14 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\TCtrlIO.dll [2006.09.14 11:40:34 | 000,010,161 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini [2006.09.14 11:40:34 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini [2006.09.14 11:40:33 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini [2006.09.14 11:40:33 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll [2006.09.14 11:38:34 | 000,000,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTHDAEQ1.dat [2006.09.14 11:38:34 | 000,000,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTHDAEQ0.dat [2006.09.14 11:38:32 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2006.09.14 11:38:32 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2006.09.13 17:48:16 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.09.13 17:47:28 | 000,133,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2006.09.13 17:00:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2006.09.13 16:53:35 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.09.13 16:41:43 | 000,159,744 | ---- | C] () -- C:\WINDOWS\MakeMrk.exe [2006.09.13 16:41:43 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll [2006.09.13 16:41:43 | 000,000,083 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2006.09.13 16:41:31 | 000,458,766 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2006.09.13 16:41:31 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2006.09.13 16:41:31 | 000,084,280 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2006.09.13 16:41:31 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2006.09.13 16:40:54 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006.09.13 16:40:53 | 000,441,124 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006.09.13 16:40:53 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006.09.13 16:40:53 | 000,071,060 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006.09.13 16:40:53 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006.09.13 16:40:52 | 000,004,631 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2006.09.13 16:40:50 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2006.09.13 16:40:47 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2006.09.13 16:40:42 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006.09.13 16:40:42 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006.09.13 16:40:37 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006.09.13 16:40:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2006.01.30 23:15:42 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2005.09.02 14:44:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll [2005.08.05 14:26:04 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2005.07.22 21:30:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll [2004.07.20 17:04:00 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll [2004.01.15 14:43:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll ========== LOP Check ========== [2010.08.17 06:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG [2010.11.10 00:53:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON [2011.04.02 08:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2010.11.06 00:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mAirList [2011.04.02 08:46:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2011.04.02 08:59:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2010.10.20 15:11:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RavensburgerTipToi [2010.07.01 20:16:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010.05.14 22:32:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canneverbe_Limited [2010.06.19 02:00:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\InterVideo [2010.10.02 10:20:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\MusicNet [2011.04.02 09:05:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Nokia [2010.07.07 03:38:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org [2010.05.14 16:26:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Opera [2011.04.02 09:38:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\PC Suite [2010.10.27 14:47:06 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\SMSData [2010.05.14 23:40:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Tonium [2010.05.14 22:57:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\toshiba [2010.05.14 22:57:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Windows Desktop Search [2011.05.11 00:50:00 | 000,000,358 | ---- | M] () -- C:\WINDOWS\Tasks\Check Updates for MSN Search Toolbar.job ========== Purity Check ========== < End of report > Wie gefährlich sind die oben 3 genannten denn,was tun sie und wie beseitigen?  im voraus! |
| Themen zu Malwarebytes findet Trojan.Bancos + RiskWare.Tool.CK + Trojan.Agent.CK... |
| .dll, 0x00000001, adobe, adware.casino, antivir, antivirus, avg, avira, bho, bonjour, einstellungen, error, explorer, firefox, format, helper, homepage, location, logfile, mozilla, oldtimer, opera, pdf, plug-in, programme, realtek, riskware.tool.ck, safer networking, scan, security, software, suche, was tun |
Baum-Darstellung