Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Metropolitan Police - Attention! Illegal Activity was reveald - INKL. Logfile (https://www.trojaner-board.de/100522-metropolitan-police-attention-illegal-activity-reveald-inkl-logfile.html)

coka 19.06.2011 20:37
Metropolitan Police - Attention! Illegal Activity was reveald - INKL. Logfile
 
Hallo zusammen,

ich sitze hier mit einem notebook welches Opfer eines Trojaners? wurde. Mit OTLPE konnte ich Logs erstellen. So habe ich es in einem Thread hier gelesen.
Mit den Logs selbst kann ich jedoch nichts anfangen.
Der Thread der mein Problem beschreibt findet sich hier: http://www.trojaner-board.de/100508-...y-reveald.html

Und hier das Logfile:

Zitat:
OTL logfile created on: 6/19/2011 9:49:49 PM - Run
OTLPE by OldTimer - Version 3.1.46.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221.42 Gb Total Space | 133.85 Gb Free Space | 60.45% Space Free | Partition Type: NTFS
Drive D: | 11.46 Gb Total Space | 2.13 Gb Free Space | 18.57% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - [2008/10/23 15:36:14 | 000,068,865 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008/10/23 15:36:10 | 000,151,297 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/03/05 04:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (SymIMMP)
DRV - File not found [Kernel | On_Demand] -- -- (SymIM)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - [2009/05/29 12:46:58 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/05/29 12:44:26 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2009/05/29 12:44:18 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2009/04/27 13:50:46 | 000,646,392 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2008/07/17 11:01:00 | 000,269,760 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA004Vid.sys -- (OA004Vid)
DRV - [2008/06/03 03:30:24 | 000,144,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA004Ufd.sys -- (OA004Ufd)
DRV - [2007/11/08 13:03:26 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/10/08 23:21:00 | 007,626,304 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/09/09 03:12:28 | 000,176,640 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/07/09 19:27:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/06/18 11:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/05/30 09:40:42 | 000,735,232 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007/03/06 09:15:58 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007/02/16 04:50:32 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2006/06/28 04:54:00 | 000,009,472 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=HP&pf=laptop
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=HP&pf=laptop


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\Matthias_Mehringer_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Matthias_Mehringer_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.burschenverein-vagen.de/
IE - HKU\Matthias_Mehringer_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Matthias_Mehringer_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Matthias_Mehringer_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\Matthias_Mehringer_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Matthias_Mehringer_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local





O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll (ICQ Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll (Cooliris Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKU\Matthias_Mehringer_ON_C\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\Matthias_Mehringer_ON_C\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [{91A7AE27-8F84-80EC-79A6-1BACEC7D1693}] File not found
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [AdVantage] C:\Users\Matthias Mehringer\AppData\Roaming\advantage\AdVantage.exe (Vomba Network)
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [ICQ] File not found
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O8 - Extra context menu item: &AOL Toolbar-Suche - C:\Program Files\AOL\AOL Toolbar 5.0\resources\de-DE\local\search.html ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O9 - Extra Button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll (Cooliris Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20100511075017 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Matthias_Mehringer_ON_C Winlogon: Shell - (C:\Users\Matthias Mehringer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X09K8IJX\info[1].exe) - C:\Users\Matthias Mehringer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X09K8IJX\info[1].exe ()
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/23 12:58:18 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Matthias Mehringer\Documents\*.tmp files -> C:\Users\Matthias Mehringer\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/19 14:41:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/19 14:20:31 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 14:20:31 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 14:20:26 | 000,000,358 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2011/06/19 14:20:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/19 13:57:40 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/19 13:40:57 | 000,028,570 | ---- | M] () -- C:\Users\Matthias Mehringer\AppData\Roaming\nvModes.001
[2011/06/19 13:40:55 | 000,000,163 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2011/06/19 10:17:22 | 000,000,452 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{4552F422-79F3-43CD-8EDA-EC29989478BB}.job
[2011/06/15 12:21:40 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011/06/13 07:59:32 | 000,007,268 | ---- | M] () -- C:\Users\Matthias Mehringer\AppData\Local\d3d9caps.dat
[2011/06/03 10:49:26 | 000,002,631 | ---- | M] () -- C:\Users\Matthias Mehringer\Desktop\Microsoft Office Word 2007.lnk
[2011/05/23 12:58:08 | 252,434,556 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/05/21 05:50:13 | 000,028,570 | ---- | M] () -- C:\Users\Matthias Mehringer\AppData\Roaming\nvModes.dat
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Matthias Mehringer\Documents\*.tmp files -> C:\Users\Matthias Mehringer\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/23 12:58:08 | 252,434,556 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/04/27 14:02:32 | 000,000,089 | ---- | C] () -- C:\Windows\System32\MSBII.dll
[2011/04/27 13:48:08 | 000,032,768 | ---- | C] () -- C:\Windows\System32\WKAuxil.dll
[2011/04/27 13:48:06 | 000,338,944 | ---- | C] () -- C:\Windows\System32\lffpx7.dll
[2011/04/27 13:48:06 | 000,118,784 | ---- | C] () -- C:\Windows\System32\lfkodak.dll
[2011/04/27 13:47:38 | 000,017,920 | ---- | C] () -- C:\Windows\System32\implode.dll
[2011/04/27 13:47:35 | 003,782,416 | ---- | C] () -- C:\Windows\System32\mso97.dll
[2009/10/22 13:45:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/09/26 14:03:08 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/26 14:03:07 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/01/24 12:21:56 | 000,007,268 | ---- | C] () -- C:\Users\Matthias Mehringer\AppData\Local\d3d9caps.dat
[2008/11/29 12:41:47 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/10/07 07:38:16 | 000,000,000 | ---- | C] () -- C:\Users\Matthias Mehringer\AppData\Roaming\wklnhst.dat
[2008/10/06 08:40:13 | 000,007,680 | ---- | C] () -- C:\Users\Matthias Mehringer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/09/28 09:01:29 | 000,028,570 | ---- | C] () -- C:\Users\Matthias Mehringer\AppData\Roaming\nvModes.001
[2008/09/26 13:08:57 | 000,028,570 | ---- | C] () -- C:\Users\Matthias Mehringer\AppData\Roaming\nvModes.dat
[2008/05/13 03:30:57 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2007/11/06 20:17:04 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2007/11/06 20:17:04 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2007/11/06 20:17:04 | 000,126,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2007/11/06 20:17:04 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,389,544 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/03/09 18:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

========== LOP Check ==========

[2011/06/19 13:42:20 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\advantage
[2010/07/29 11:05:54 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\Ewguso
[2011/04/27 14:28:58 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\GetRightToGo
[2010/08/03 14:50:51 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\Hoymw
[2009/05/23 05:20:09 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\ICQ Toolbar
[2009/04/21 14:24:32 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\temp
[2008/10/07 07:38:38 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\Template
[2011/04/27 13:21:58 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\Uniblue
[2009/04/27 14:25:44 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\WhenU
[2008/09/25 16:34:35 | 000,000,000 | ---D | M] -- C:\Users\Matthias Mehringer\AppData\Roaming\WildTangent
[2008/09/25 16:05:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008/09/25 16:05:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2008/09/25 16:15:07 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2008/09/25 16:05:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2009/08/16 14:58:36 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2008/09/25 16:05:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/09/25 16:05:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2008/10/08 15:48:59 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent
[2007/11/06 13:10:40 | 000,000,000 | ---D | M] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010/04/27 13:36:35 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/14 12:41:55 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/06/18 14:30:38 | 000,000,000 | ---D | M] -- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/04/27 13:21:43 | 000,000,000 | -H-D | M] -- C:\ProgramData\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
[2011/06/19 14:20:26 | 000,000,358 | ---- | M] () -- C:\Windows\Tasks\RegistryBooster.job
[2011/06/19 14:20:30 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/06/19 10:17:22 | 000,000,452 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{4552F422-79F3-43CD-8EDA-EC29989478BB}.job

========== Purity Check ==========


< End of report >

markusg 19.06.2011 20:41
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein:

Code:
:OTL
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [{91A7AE27-8F84-80EC-79A6-1BACEC7D1693}] File not found
O4 - HKU\Matthias_Mehringer_ON_C..\Run: [AdVantage] C:\Users\Matthias Mehringer\AppData\Roaming\advantage\AdVantage.exe (Vomba Network)
O20 - HKU\Matthias_Mehringer_ON_C Winlogon: Shell - (C:\Users\Matthias Mehringer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X09K8IJX\info[1].exe)
- C:\Users\Matthias Mehringer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X09K8IJX\info[1].exe ()
:Files
C:\Users\Matthias Mehringer\AppData\Roaming\advantage
C:\Users\Matthias Mehringer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X09K8IJX\info[1].exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits in meinem post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

coka 19.06.2011 21:03
Die Bahn könnte sich ein Beispiel an dir nehmen Danke.
File is uploaded!

Gruß Phil

markusg 20.06.2011 09:49
kein problem.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131