Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA Trojaner - Noch ein Befall (https://www.trojaner-board.de/102205-bka-trojaner-noch-befall.html)

Vassago 08.08.2011 13:08
BKA Trojaner - Noch ein Befall
 
Hallo,

leider hat sich meine Schwester auch mit diesem Viech infiziert

Ich habe per OTL einen Scan bereits laufenlassen, hier der Log.

Code:
OTL logfile created on: 8/8/2011 3:54:22 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 75.74 Mb Free Space | 75.75% Space Free | Partition Type: NTFS
Drive D: | 176.41 Gb Total Space | 140.24 Gb Free Space | 79.50% Space Free | Partition Type: NTFS
Drive E: | 41.38 Gb Total Space | 41.30 Gb Free Space | 99.79% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/03/17 10:51:09 | 000,435,008 | ---- | M] (TuneUp Software) [On_Demand] -- D:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2011/01/12 12:35:12 | 001,051,968 | ---- | M] (TuneUp Software) [Auto] -- D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011/01/12 12:32:10 | 000,030,016 | ---- | M] (TuneUp Software) [Auto] -- D:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/11/21 05:49:24 | 000,247,608 | ---- | M] () [Auto] -- D:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009/08/13 15:58:10 | 000,044,312 | ---- | M] () [Auto] -- D:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/05/07 07:53:36 | 000,642,560 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- D:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/06/09 21:43:18 | 001,271,808 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/10/14 01:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand] -- D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/09/28 05:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand] -- D:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/13 19:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/10 09:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2009/05/01 09:41:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\July_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKU\July_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\July_ON_D\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\July_ON_D\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\July_ON_D\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKU\July_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\July_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.6&q="
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: D:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/06/22 00:51:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/22 00:51:53 | 000,000,000 | ---D | M]
 
[2010/07/20 16:26:18 | 000,000,000 | ---D | M] (No name found) -- D:\Users\July\AppData\Roaming\Mozilla\Extensions
[2011/08/08 05:21:38 | 000,000,000 | ---D | M] (No name found) -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\extensions
[2011/06/20 14:06:37 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010/10/11 11:19:56 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/03/04 02:52:01 | 000,002,342 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icq-search.xml
[2011/03/24 01:07:37 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-1.xml
[2011/05/01 12:50:18 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-2.xml
[2011/05/06 11:59:20 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-3.xml
[2011/06/22 00:52:02 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-4.xml
[2011/06/20 04:45:18 | 000,000,168 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.gif
[2011/06/20 04:45:18 | 000,000,618 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.src
[2011/03/30 09:14:34 | 000,001,042 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.xml
[2011/08/08 05:21:38 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\Mozilla Firefox\extensions
[2011/02/12 12:59:59 | 000,000,000 | ---D | M] (Skype extension) -- D:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/03/04 08:36:58 | 000,000,000 | ---D | M] (Java Console) -- D:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/03/04 08:36:49 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/04 02:51:45 | 000,001,392 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/03/04 02:51:45 | 000,002,344 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/03/04 02:51:45 | 000,006,805 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/03/04 02:51:45 | 000,001,178 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/03/04 02:51:45 | 000,001,105 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\July_ON_D\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O4 - HKU\July_ON_D..\Run: [avupdate] D:\Users\July\AppData\Roaming\jashla.exe (aIKf)
O4 - HKU\July_ON_D..\Run: [RESTART_STICKY_NOTES] D:\Windows\System32\StikyNot.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\July_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\July_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\July_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O8 - Extra context menu item: Add to Google Photos Screensa&ver - D:\windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - D:\Users\July\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{6c1d97b7-f71f-11df-ad83-00245463c769}\Shell - "" = AutoRun
O33 - MountPoints2\{6c1d97b7-f71f-11df-ad83-00245463c769}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{6cc5be3b-d369-11df-8edd-f67bcb2c2229}\Shell - "" = AutoRun
O33 - MountPoints2\{6cc5be3b-d369-11df-8edd-f67bcb2c2229}\Shell\AutoRun\command - "" = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/08 07:09:01 | 000,232,448 | ---- | C] (aIKf) -- D:\Users\July\AppData\Roaming\jashla.exe
[2011/08/05 07:22:40 | 000,000,000 | ---D | C] -- D:\Users\July\Desktop\Kleiderkreisel
[2011/07/30 05:54:30 | 000,000,000 | ---D | C] -- D:\Users\July\Desktop\Neuer Ordner
[2011/07/29 16:56:52 | 000,000,000 | ---D | C] -- D:\Users\July\Desktop\Hochzeit
[2011/07/29 16:56:35 | 000,000,000 | ---D | C] -- D:\Users\July\Desktop\28 Jul 2011
[2011/07/13 10:01:51 | 000,271,872 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\conhost.exe
[2011/07/13 10:01:51 | 000,169,984 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\winsrv.dll
[2011/07/13 10:01:51 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011/07/13 10:01:51 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011/07/13 10:01:51 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011/07/13 10:01:51 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011/07/13 09:53:10 | 002,334,208 | ---- | C] (Microsoft Corporation) -- D:\windows\System32\win32k.sys
[2010/08/25 13:59:08 | 000,004,096 | ---- | C] ( ) -- D:\windows\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/08 07:41:12 | 000,067,584 | --S- | M] () -- D:\windows\bootstat.dat
[2011/08/08 07:17:00 | 000,001,094 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/08 07:09:01 | 000,232,448 | ---- | M] (aIKf) -- D:\Users\July\AppData\Roaming\jashla.exe
[2011/08/08 04:38:16 | 000,001,090 | ---- | M] () -- D:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/05 07:44:03 | 000,654,166 | ---- | M] () -- D:\windows\System32\perfh007.dat
[2011/08/05 07:44:03 | 000,616,008 | ---- | M] () -- D:\windows\System32\perfh009.dat
[2011/08/05 07:44:03 | 000,130,006 | ---- | M] () -- D:\windows\System32\perfc007.dat
[2011/08/05 07:44:03 | 000,106,388 | ---- | M] () -- D:\windows\System32\perfc009.dat
[2011/08/03 10:30:18 | 000,014,512 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/03 10:30:18 | 000,014,512 | -H-- | M] () -- D:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/02 03:59:47 | 1579,630,592 | -HS- | M] () -- D:\hiberfil.sys
[2011/07/14 04:36:30 | 000,370,608 | ---- | M] () -- D:\windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2011/03/15 15:08:51 | 000,252,928 | ---- | C] () -- D:\windows\System32\DShowRdpFilter.dll
[2011/02/12 13:02:15 | 000,000,056 | -H-- | C] () -- D:\windows\System32\ezsidmv.dat
[2011/02/02 12:52:45 | 000,005,632 | ---- | C] () -- D:\Users\July\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/06 08:27:32 | 000,004,096 | -H-- | C] () -- D:\Users\July\AppData\Local\keyfile3.drm
[2010/09/14 10:27:01 | 000,000,400 | ---- | C] () -- D:\windows\ODBC.INI
[2010/07/21 15:07:11 | 000,000,002 | ---- | C] () -- D:\windows\HotFixList.ini
[2010/07/21 14:51:42 | 000,131,368 | ---- | C] () -- D:\ProgramData\FullRemove.exe
[2010/07/20 16:09:05 | 000,000,812 | ---- | C] () -- D:\windows\System32\drivers\scdskr01.dat
[2010/07/20 16:09:05 | 000,000,541 | ---- | C] () -- D:\windows\System32\drivers\scdhkr01.dat
[2010/07/20 16:09:05 | 000,000,500 | ---- | C] () -- D:\windows\System32\drivers\RSTable.dat
[2010/07/20 16:09:05 | 000,000,036 | ---- | C] () -- D:\windows\System32\drivers\scdstr01.dat
[2010/04/21 12:08:14 | 000,982,240 | ---- | C] () -- D:\windows\System32\igkrng500.bin
[2010/04/21 12:08:14 | 000,439,308 | ---- | C] () -- D:\windows\System32\igcompkrng500.bin
[2010/04/21 12:08:14 | 000,092,356 | ---- | C] () -- D:\windows\System32\igfcg500m.bin
[2010/04/21 11:29:46 | 000,000,151 | ---- | C] () -- D:\windows\System32\GfxUI.exe.config
[2010/04/21 11:22:50 | 000,208,896 | ---- | C] () -- D:\windows\System32\iglhsip32.dll
[2010/04/21 11:22:50 | 000,143,360 | ---- | C] () -- D:\windows\System32\iglhcp32.dll
[2009/12/05 16:22:03 | 000,654,166 | ---- | C] () -- D:\windows\System32\perfh007.dat
[2009/12/05 16:22:03 | 000,295,922 | ---- | C] () -- D:\windows\System32\perfi007.dat
[2009/12/05 16:22:03 | 000,130,006 | ---- | C] () -- D:\windows\System32\perfc007.dat
[2009/12/05 16:22:03 | 000,038,104 | ---- | C] () -- D:\windows\System32\perfd007.dat
[2009/12/05 16:01:49 | 000,004,608 | ---- | C] () -- D:\windows\System32\HdmiCoin.dll
[2009/12/05 16:01:47 | 000,134,592 | ---- | C] () -- D:\windows\System32\igfcg500.bin
[2009/12/04 23:17:31 | 000,307,200 | ---- | C] () -- D:\windows\SetDisplayResolution.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,370,608 | ---- | C] () -- D:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,616,008 | ---- | C] () -- D:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,106,388 | ---- | C] () -- D:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\windows\System32\mlang.dat
[2009/05/01 10:24:14 | 000,000,184 | ---- | C] () -- D:\windows\System32\drivers\osdauth.dat
[2009/05/01 09:41:06 | 000,000,020 | ---- | C] () -- D:\windows\System32\drivers\OSDSig.dat
 
========== LOP Check ==========
 
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2011/05/06 11:59:15 | 000,000,000 | ---D | M] -- D:\ProgramData\ICQ
[2010/09/11 03:05:16 | 000,000,000 | ---D | M] -- D:\ProgramData\Partner
[2009/12/04 23:18:15 | 000,000,000 | ---D | M] -- D:\ProgramData\SAMSUNG
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2010/12/08 13:14:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2010/07/20 17:42:46 | 000,000,000 | ---D | M] -- D:\ProgramData\tmp
[2010/09/14 10:28:58 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software
[2010/07/22 01:28:57 | 000,000,000 | ---D | M] -- D:\ProgramData\WinClon
[2010/08/11 14:03:16 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/09/14 10:28:12 | 000,000,000 | -HSD | M] -- D:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/09/29 00:16:31 | 000,032,604 | ---- | M] () -- D:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 120 bytes -> D:\ProgramData\Temp:E1F04E8D
< End of report >


Einen Extra Log habe ich nicht, obwohl ich OTL so gestartet habe, wie hier bereits in einigen Threads angegeben wurde.

Ich hoffe, es passt soweit.

Liebe Gruesse

cosinus 09.08.2011 15:26
Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\July_ON_D\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - D:\Program Files\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O4 - HKU\July_ON_D..\Run: [avupdate] D:\Users\July\AppData\Roaming\jashla.exe (aIKf)
[2011/06/20 14:06:37 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010/10/11 11:19:56 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/03/04 02:52:01 | 000,002,342 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icq-search.xml
[2011/03/24 01:07:37 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-1.xml
[2011/05/01 12:50:18 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-2.xml
[2011/05/06 11:59:20 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-3.xml
[2011/06/22 00:52:02 | 000,000,950 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin-4.xml
[2011/06/20 04:45:18 | 000,000,168 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.gif
[2011/06/20 04:45:18 | 000,000,618 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.src
[2011/03/30 09:14:34 | 000,001,042 | ---- | M] () -- D:\Users\July\AppData\Roaming\Mozilla\Firefox\Profiles\6dlm4zoj.default\searchplugins\icqplugin.xml
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{6c1d97b7-f71f-11df-ad83-00245463c769}\Shell - "" = AutoRun
O33 - MountPoints2\{6c1d97b7-f71f-11df-ad83-00245463c769}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{6cc5be3b-d369-11df-8edd-f67bcb2c2229}\Shell - "" = AutoRun
O33 - MountPoints2\{6cc5be3b-d369-11df-8edd-f67bcb2c2229}\Shell\AutoRun\command - "" = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta
@Alternate Data Stream - 120 bytes -> D:\ProgramData\Temp:E1F04E8D
:Commands
[purity]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131