Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows recovery erfolgreich entfernt? (https://www.trojaner-board.de/103659-windows-recovery-erfolgreich-entfernt.html)

nado123456 25.09.2011 15:27
Windows recovery erfolgreich entfernt?
 
Hi,

ich bitte euch einmal zu checken, ob "windows recovery" erfolgreich entfernt ist. Ich habe alles nach eurer anleitung durchgeführt (ein großes DANKE!!!!) > rkill, malware bytes, oth und tdss killer. Malware bytes findet jetzt nichts mehr, alle dateien sind wieder sichtbar und der Laptop verhält sich "normal". TDss war ohne befund.

Jetzt habe ich gerade noch defogger und otl durchgefürht. Gezippt im Anhang OTL extra und malware bytes einmal mit Befund, einmal ohne.
Danke für euer Feedback!!! NadjaOTL Logfile:
Code:
OTL logfile created on: 25.09.2011 15:50:14 - Run 2
OTL by OldTimer - Version 3.2.29.1    Folder = C:\Users\mm\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,87 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 52,74% Memory free
5,96 Gb Paging File | 4,55 Gb Available in Paging File | 76,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,29 Gb Total Space | 6,88 Gb Free Space | 5,92% Space Free | Partition Type: NTFS
Drive D: | 115,13 Gb Total Space | 35,07 Gb Free Space | 30,46% Space Free | Partition Type: NTFS
Drive E: | 516,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MM-PC | User Name: mm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.25 15:49:37 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\mm\Desktop\OTL(1).exe
PRC - [2011.04.14 18:40:02 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.09.08 10:45:10 | 001,034,752 | ---- | M] () -- C:\Programme\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
PRC - [2010.09.08 10:44:50 | 000,484,352 | ---- | M] () -- C:\Programme\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
PRC - [2010.09.08 10:42:28 | 005,185,536 | ---- | M] (Western Digital Technologies, Inc.) -- C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
PRC - [2010.09.08 10:41:36 | 000,237,056 | ---- | M] (WDC) -- C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
PRC - [2010.05.21 01:52:06 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.21 01:52:04 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2009.09.05 17:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2009.08.07 18:01:37 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.27 04:10:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.07.18 21:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2008.06.24 11:06:14 | 000,509,816 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\SmoothView\SmoothView.exe
PRC - [2008.05.09 12:49:30 | 000,716,800 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\FlashCards\TCrdMain.exe
PRC - [2008.04.24 13:03:12 | 000,430,080 | ---- | M] (TOSHIBA) -- C:\Programme\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
PRC - [2008.04.24 10:22:10 | 000,103,824 | ---- | M] (Toshiba Europe GmbH) -- C:\Programme\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
PRC - [2008.04.24 10:21:56 | 000,099,720 | ---- | M] (Toshiba Europe GmbH) -- C:\Programme\Toshiba TEMPRO\TempoSVC.exe
PRC - [2008.04.17 00:21:24 | 001,056,768 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2008.04.17 00:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2008.04.17 00:19:16 | 000,405,504 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2008.04.08 15:14:50 | 006,037,504 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) -- C:\Windows\System32\lxbkcoms.exe
PRC - [2008.02.06 15:12:56 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\SMARTLogService\TosIPCSrv.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.21 04:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.17 17:27:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\Power Saver\TPwrMain.exe
PRC - [2008.01.17 17:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe
PRC - [2007.11.21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe
PRC - [2007.07.10 09:24:10 | 000,581,632 | ---- | M] (TOSHIBA) -- C:\Programme\TOSHIBA\Toshiba Online Product Information\TOPI.exe
PRC - [2006.12.23 19:05:20 | 000,143,360 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006.12.23 19:04:42 | 000,905,216 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\PAC7302\Monitor.exe
PRC - [2006.08.23 16:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.04.15 14:20:52 | 001,712,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\58bea48c9d09de96a11ddc58e75245e3\Microsoft.VisualBasic.ni.dll
MOD - [2011.04.15 14:17:56 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\764e4a8bba4cee63ccd677c623eb50a0\System.ServiceProcess.ni.dll
MOD - [2011.04.15 07:44:30 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\95b780b82a20fb7c463b78f034329df5\System.Runtime.Remoting.ni.dll
MOD - [2011.04.15 07:42:57 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\fb9f4da6dd18b147baca425a0f5fe3b5\System.Configuration.ni.dll
MOD - [2011.04.15 07:40:56 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\7b1cc9a5490437cd5c0d5fb5ea3c0e34\System.Xml.ni.dll
MOD - [2011.04.15 07:40:29 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd2b1592d28bd0eed480f40d5f63b86c\System.Windows.Forms.ni.dll
MOD - [2011.04.15 07:40:14 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e9f88677c9a7357c3ce76cdaae8d4654\System.Drawing.ni.dll
MOD - [2011.04.15 07:38:02 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\97c2ac49a9c95561cac8493c5c864043\PresentationCore.ni.dll
MOD - [2011.04.15 07:37:36 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\db936f39676a3a2300ae7b58ad80e699\WindowsBase.ni.dll
MOD - [2011.04.15 07:37:31 | 007,949,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\d55579c9c2c8ca58c6379eda52a97c9e\System.ni.dll
MOD - [2011.04.15 07:37:01 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\70df10917822b8ef1379b9820e7281c1\mscorlib.ni.dll
MOD - [2011.04.14 18:40:02 | 001,874,904 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.04.05 22:15:06 | 006,053,536 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2010.05.04 16:36:28 | 000,970,752 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2009.12.12 16:12:03 | 000,141,824 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.09.04 23:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008.07.27 20:03:15 | 000,372,736 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
MOD - [2008.07.27 20:03:08 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2008.07.27 20:03:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.03.06 11:14:54 | 005,121,912 | ---- | M] () -- C:\Programme\TOSHIBA\FlashCards\BlackPng.dll
MOD - [2007.12.25 13:03:40 | 000,015,184 | ---- | M] () -- C:\Programme\TOSHIBA\PCDiag\NotifyPCD.dll
MOD - [2007.12.14 22:40:00 | 000,090,112 | ---- | M] () -- C:\Programme\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
MOD - [2006.12.01 18:55:42 | 000,009,216 | ---- | M] () -- C:\Programme\TOSHIBA\TBS\NotifyTBS.dll
MOD - [2006.10.10 11:44:16 | 000,009,728 | ---- | M] () -- C:\Programme\TOSHIBA\TOSHIBA Assist\NotifyX.dll
MOD - [2006.10.07 12:57:04 | 000,053,248 | ---- | M] () -- C:\Programme\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.09.08 10:45:10 | 001,034,752 | ---- | M] () [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe -- (WDFME)
SRV - [2010.09.08 10:44:50 | 000,484,352 | ---- | M] () [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe -- (WDSC)
SRV - [2010.09.08 10:41:36 | 000,237,056 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2009.08.07 18:01:37 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.07.18 21:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2008.04.24 10:21:56 | 000,099,720 | ---- | M] (Toshiba Europe GmbH) [Auto | Running] -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe -- (TempoMonitoringService)
SRV - [2008.04.17 00:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2008.02.19 10:12:18 | 000,537,256 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbkcoms.exe -- (lxbk_device)
SRV - [2008.02.06 15:12:56 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.17 17:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2007.11.21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2006.08.23 16:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009.12.07 21:05:57 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.09.29 09:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 09:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 09:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.13 21:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.29 01:24:44 | 000,530,816 | ---- | M] (Line 6) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L6UX1.sys -- (L6UX1)
DRV - [2008.11.19 18:09:10 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 18:09:08 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 18:09:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.07.18 19:52:16 | 000,279,376 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)
DRV - [2008.04.15 10:05:08 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.12.26 10:20:32 | 000,290,304 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2007.11.09 15:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2007.10.17 22:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.09.10 08:50:56 | 000,457,984 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PAC7302.SYS -- (PAC7302)
DRV - [2007.04.23 11:50:50 | 000,025,896 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\RtlProt.sys -- (RtlProt)
DRV - [2006.11.20 14:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2006.11.02 09:41:50 | 000,983,552 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.10.18 11:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2897: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.449: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2955: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1675: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\mm\AppData\Roaming\Move Networks\plugins\071803000001\npqmp071803000001.dll (Move Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.28 20:19:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.23 23:41:01 | 000,000,000 | ---D | M]
 
[2011.03.28 08:07:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mm\AppData\Roaming\mozilla\Extensions
[2010.04.19 12:39:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mm\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.05.28 20:19:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.11.15 21:24:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2008.12.30 12:04:09 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2010.11.15 21:24:52 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.09.04 08:08:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.11.15 21:24:24 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [00TCrdMain] C:\Programme\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HSON] C:\Programme\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [PAC7302_Monitor] C:\Windows\PixArt\PAC7302\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SmoothView] C:\Programme\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba Registration] C:\Programme\TOSHIBA\Registration\ToshibaRegistration.exe (Toshiba)
O4 - HKLM..\Run: [Toshiba TEMPO] C:\Programme\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [TPwrMain] C:\Programme\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [TOSCDSPD] TOSCDSPD.EXE File not found
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefox - Verknüpfung.lnk = C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
O4 - Startup: C:\Users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook starten.lnk = C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: line6.net ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2F423C37-5272-4536-8314-2FD9E60A4B89}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{808F7D18-2BC9-4898-BC72-45ADC6D0309A}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\mm\Pictures\diverse\diesel.jpg
O24 - Desktop BackupWallPaper: C:\Users\mm\Pictures\diverse\diesel.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\AutoPlay\cOmmAnd - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\AutoRun\command - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\ExpLore\Command - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\OPen\commAnd - "" = F:\altbvk.exe
O33 - MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\Shell - "" = AutoRun
O33 - MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\AUTOplAY\cOmmand - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\AutoRun\command - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\exploRE\ComMAnd - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\Open\CommAnd - "" = F:\edkr.pif
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\1\Command - "" = F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\2\Command - "" = F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.25 15:49:36 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\mm\Desktop\OTL(1).exe
[2011.09.25 13:42:38 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\mm\Desktop\mbam-setup-1.51.2.1300.exe
[2009.03.15 16:50:47 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\lxbkusb1.dll
[2009.03.15 16:50:47 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbkinpa.dll
[2009.03.15 16:50:47 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbkiesc.dll
[2009.03.15 16:50:47 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXBKhcp.dll
[2009.03.15 16:50:46 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkserv.dll
[2009.03.15 16:50:46 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbkpmui.dll
[2009.03.15 16:50:46 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbklmpm.dll
[2009.03.15 16:50:46 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbkprox.dll
[2009.03.15 16:50:46 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbkpplc.dll
[2009.03.15 16:50:45 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbkhbn3.dll
[2009.03.15 16:50:45 | 000,385,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkih.exe
[2009.03.15 16:50:44 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomc.dll
[2009.03.15 16:50:44 | 000,537,256 | ---- | C] ( ) -- C:\Windows\System32\lxbkcoms.exe
[2009.03.15 16:50:44 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomm.dll
[2009.03.15 16:50:44 | 000,381,608 | ---- | C] ( ) -- C:\Windows\System32\lxbkcfg.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Users\mm\AppData\Local\*.tmp files -> C:\Users\mm\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.25 15:49:37 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\mm\Desktop\OTL(1).exe
[2011.09.25 15:40:20 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.25 15:30:05 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.25 15:30:01 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.25 15:30:01 | 000,003,216 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.25 15:29:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.25 15:29:55 | 3082,813,440 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.25 15:28:39 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.09.25 15:26:18 | 000,000,000 | ---- | M] () -- C:\Users\mm\defogger_reenable
[2011.09.25 15:25:04 | 000,050,477 | ---- | M] () -- C:\Users\mm\Desktop\Defogger.exe
[2011.09.25 13:42:47 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\mm\Desktop\mbam-setup-1.51.2.1300.exe
[2011.09.25 13:34:26 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.09.25 13:34:26 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.09.25 13:34:26 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.09.25 13:34:26 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.25 13:30:53 | 001,008,092 | ---- | M] () -- C:\Users\mm\Desktop\rkill.com
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Users\mm\AppData\Local\*.tmp files -> C:\Users\mm\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.25 15:26:18 | 000,000,000 | ---- | C] () -- C:\Users\mm\defogger_reenable
[2011.09.25 15:25:04 | 000,050,477 | ---- | C] () -- C:\Users\mm\Desktop\Defogger.exe
[2011.09.25 13:30:49 | 001,008,092 | ---- | C] () -- C:\Users\mm\Desktop\rkill.com
[2011.05.29 17:17:24 | 000,000,136 | ---- | C] () -- C:\ProgramData\~32169720r
[2011.05.29 17:17:24 | 000,000,104 | ---- | C] () -- C:\ProgramData\~32169720
[2011.05.29 17:16:55 | 000,000,400 | ---- | C] () -- C:\ProgramData\32169720
[2010.10.01 17:12:09 | 000,000,354 | ---- | C] () -- C:\Windows\System32\Remover.ini
[2010.06.23 11:43:53 | 000,004,096 | ---- | C] () -- C:\Users\mm\AppData\Local\keyfile3.drm
[2010.03.18 22:25:24 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010.01.25 22:28:36 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.01.25 19:30:30 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2010.01.25 19:30:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2009.12.04 20:37:08 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.12.04 20:37:07 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009.12.04 20:37:00 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.07.31 12:48:35 | 000,350,208 | ---- | C] () -- C:\Windows\System32\Rivet200.dll
[2009.04.13 21:31:12 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.04.13 21:31:12 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.03.15 16:55:32 | 000,000,237 | ---- | C] () -- C:\Windows\Lexstat.ini
[2009.03.15 16:50:47 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxbkutil.dll
[2009.03.15 16:50:47 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXBKinst.dll
[2009.02.24 17:19:53 | 000,000,680 | ---- | C] () -- C:\Users\mm\AppData\Local\d3d9caps.dat
[2008.12.27 19:18:20 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.12.27 13:35:34 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.12.19 17:27:31 | 000,068,608 | ---- | C] () -- C:\Users\mm\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.12.15 14:20:37 | 000,131,072 | ---- | C] () -- C:\Windows\System32\EnumDevLib.dll
[2008.12.10 12:03:10 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2008.12.10 12:03:10 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2008.12.10 12:03:10 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2008.12.10 12:03:10 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2008.08.11 16:09:58 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.08.11 16:09:58 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.08.11 16:09:58 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.08.11 16:09:58 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.08.11 16:09:58 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.08.11 16:09:58 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008.08.11 16:01:25 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008.08.11 15:46:57 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2008.08.11 15:46:57 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll
[2008.08.11 15:46:55 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin
[2008.08.11 15:46:54 | 000,492,496 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2008.08.11 15:00:09 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.01.21 09:15:58 | 000,618,430 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.01.21 04:24:14 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2007.03.20 16:44:02 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP7302.ini
[2007.02.07 18:57:50 | 000,039,899 | ---- | C] () -- C:\Windows\System32\rtsicis.ini
[2007.01.22 09:49:34 | 000,344,064 | ---- | C] () -- C:\Windows\System32\lxbkcoin.dll
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,386,992 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2005.10.05 13:19:32 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxbkvs.dll
[2005.09.13 17:27:10 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxbkcnv5.dll
[2005.09.13 17:27:10 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxbkcnv4.dll
[2003.02.20 19:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2011.03.30 16:53:13 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\AliceHilfe
[2011.09.25 14:31:46 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Audacity
[2010.05.16 16:20:25 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Canon
[2010.02.02 19:40:22 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\GetRightToGo
[2011.01.24 18:38:13 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Idbie
[2010.03.16 21:37:37 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\LG Electronics
[2011.01.26 15:51:28 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Mifeu
[2008.12.18 15:28:12 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\myphotobook
[2010.11.15 21:39:53 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\OpenOffice.org
[2011.05.10 17:20:22 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\PACE Anti-Piracy
[2010.04.11 11:51:48 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Research in Motion
[2010.04.19 12:38:58 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Thunderbird
[2011.03.30 17:52:16 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\ToDo Sync Helper
[2008.12.25 14:38:46 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\TOSHIBA
[2009.01.23 17:58:52 | 000,000,000 | ---D | M] -- C:\Users\mm\AppData\Roaming\Ulead Systems
[2011.09.25 15:28:43 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2008.12.15 14:21:11 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2008.08.11 13:43:54 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.12.15 14:09:50 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.03.15 16:49:56 | 000,000,000 | ---D | M] -- C:\drivers
[2008.08.11 15:38:16 | 000,000,000 | ---D | M] -- C:\Intel
[2011.02.23 19:28:07 | 000,000,000 | ---D | M] -- C:\Klett
[2010.11.12 13:13:25 | 000,000,000 | ---D | M] -- C:\Meine Webseiten
[2008.01.21 04:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.05.29 15:22:24 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.09.25 13:52:05 | 000,000,000 | ---D | M] -- C:\ProgramData
[2008.12.15 14:09:50 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.03.17 20:43:46 | 000,000,000 | ---D | M] -- C:\Sounds
[2011.09.25 13:42:22 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2008.12.15 14:21:33 | 000,000,000 | ---D | M] -- C:\Toshiba
[2008.12.15 14:13:00 | 000,000,000 | R--D | M] -- C:\Users
[2011.09.25 13:40:50 | 000,000,000 | ---D | M] -- C:\Windows
[2008.08.11 16:34:48 | 000,000,000 | ---D | M] -- C:\Works
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2011.01.16 16:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\mm\AppData\Local\Temp\RarSFX3\procs\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2005.08.16 02:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\mm\AppData\Local\Temp\RarSFX3\h\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\mm\AppData\Local\Temp\RarSFX3\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\mm\AppData\Local\Temp\RarSFX3\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-09-25 11:42:39

< End of report >
--- --- ---

cosinus 26.09.2011 11:55
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


nado123456 27.09.2011 20:57
Hallo!
Danke für die Anleitung, ich hoffe ich habe alles richtig gemacht.
Hier ist der Inhalt der log.txt:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=55e028b12fc4204486283678403d09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-27 05:40:49
# local_time=2011-09-27 07:40:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 0 92654630 0 0
# compatibility_mode=5892 16776573 100 100 980 154672051 0 0
# compatibility_mode=8192 67108863 100 0 332 332 0 0
# scanned=167440
# found=4
# cleaned=0
# scan_time=5925
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\e649f74-23b97867 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\2fa55376-478d8cf9 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\f220df9-22d66f64 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\fa8f07a-49f74daa probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=55e028b12fc4204486283678403d09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-27 07:51:08
# local_time=2011-09-27 09:51:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 5413 92662803 1800 0
# compatibility_mode=5892 16776573 100 100 7583 154680224 0 0
# compatibility_mode=8192 67108863 100 0 8505 8505 0 0
# scanned=167457
# found=4
# cleaned=0
# scan_time=5572
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\e649f74-23b97867 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\2fa55376-478d8cf9 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\f220df9-22d66f64 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\fa8f07a-49f74daa probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean) 00000000000000000000000000000000 I

cosinus 27.09.2011 21:09
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found
O4 - HKLM..\Run: [NWEReboot]  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\AutoPlay\cOmmAnd - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\AutoRun\command - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\ExpLore\Command - "" = F:\altbvk.exe
O33 - MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\Shell\OPen\commAnd - "" = F:\altbvk.exe
O33 - MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\Shell - "" = AutoRun
O33 - MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\AUTOplAY\cOmmand - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\AutoRun\command - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\exploRE\ComMAnd - "" = F:\edkr.pif
O33 - MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\Shell\Open\CommAnd - "" = F:\edkr.pif
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\1\Command - "" = F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\2\Command - "" = F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\.\RECYCLER\Lcass.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\USBAutoRun.exe
[2011.05.29 17:17:24 | 000,000,136 | ---- | C] () -- C:\ProgramData\~32169720r
[2011.05.29 17:17:24 | 000,000,104 | ---- | C] () -- C:\ProgramData\~32169720
[2011.05.29 17:16:55 | 000,000,400 | ---- | C] () -- C:\ProgramData\32169720
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

nado123456 28.09.2011 14:40
OK, hier ist das logfile.
Was gibt es jetzt zu tun?
Nochmals vielen Dank!

processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\cfFncEnabler.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NWEReboot deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
File F:\altbvk.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
File F:\altbvk.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
File F:\altbvk.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72dd624b-f936-11dd-b6f7-00216382b0f9}\ not found.
File F:\altbvk.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffdb320-3130-11df-a1cb-001e336ec435}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffdb320-3130-11df-a1cb-001e336ec435}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffdb320-3130-11df-a1cb-001e336ec435}\ not found.
File G:\USBAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
File F:\edkr.pif not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
File F:\edkr.pif not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
File F:\edkr.pif not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8459dc4a-cea2-11dd-8079-001e336ec435}\ not found.
File F:\edkr.pif not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ not found.
File F:\.\RECYCLER\Lcass.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ not found.
File F:\.\RECYCLER\Lcass.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1a741fd-1c63-11df-afb0-00216382b0f9}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\.\RECYCLER\Lcass.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\USBAutoRun.exe not found.
C:\ProgramData\~32169720r moved successfully.
C:\ProgramData\~32169720 moved successfully.
C:\ProgramData\32169720 moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

cosinus 28.09.2011 15:21
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

nado123456 29.09.2011 14:33
Ich habe TDSSKiller ausgeführt,
es sagt es gibt keine Funde.
Wenn ich auf "report" klicke, öffnet sich ein neues fenster mit dem report,
aber ich kann es nicht mit rechtem mausklick kopieren.
Deshalb weiss ich nicht, wie ich den log posten kann?!
Viele Grüße

cosinus 29.09.2011 14:42
Das Log liegt direkt auf C:

nado123456 29.09.2011 15:49
Oh, ok. hier ist es!

cosinus 29.09.2011 18:45
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

nado123456 29.09.2011 21:21
Hier ist die combifix datei:
Viele Grüße!

Combofix Logfile:
Code:
ComboFix 11-09-29.06 - mm 29.09.2011  22:08:52.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.2939.1355 [GMT 2:00]
ausgeführt von:: c:\users\mm\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\google\common\google updater\googleupdaterservice.exe
c:\users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery
c:\users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Uninstall Windows Vista Recovery.lnk
c:\users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Windows Vista Recovery.lnk
c:\users\mm\Desktop\Windows Vista Recovery.lnk
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-28 bis 2011-09-29  ))))))))))))))))))))))))))))))
.
.
2011-09-29 20:14 . 2011-09-29 20:14        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-09-29 13:16 . 2011-09-29 13:16        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B9A32567-9FB7-42F1-A924-5B764791B3FC}\offreg.dll
2011-09-28 13:31 . 2011-09-28 13:31        --------        d-----w-        C:\_OTL
2011-09-27 16:11 . 2011-09-21 07:00        7269712        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B9A32567-9FB7-42F1-A924-5B764791B3FC}\mpengine.dll
2011-09-27 15:56 . 2011-09-27 15:56        --------        d-----w-        c:\program files\ESET
2011-09-25 14:15 . 2011-09-25 14:15        --------        d-----w-        c:\program files\7-Zip
2011-09-25 11:47 . 2011-04-14 14:24        75264        ----a-w-        c:\windows\system32\drivers\dfsc.sys
2011-09-25 11:47 . 2011-07-06 14:56        213504        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-09-25 11:47 . 2011-04-29 12:49        79360        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-09-25 11:47 . 2011-04-29 12:49        105984        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-09-25 11:47 . 2011-06-02 12:59        2042368        ----a-w-        c:\windows\system32\win32k.sys
2011-09-25 11:47 . 2011-04-21 13:16        273408        ----a-w-        c:\windows\system32\drivers\afd.sys
2011-09-25 11:47 . 2011-04-29 12:49        146432        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-09-25 11:47 . 2011-04-29 12:49        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-09-25 11:47 . 2011-05-02 16:00        766464        ----a-w-        c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2011-09-25 11:47 . 2010-12-20 15:39        563200        ----a-w-        c:\windows\system32\oleaut32.dll
2011-09-25 11:47 . 2011-05-02 15:58        738816        ----a-w-        c:\windows\system32\inetcomm.dll
2011-09-25 11:47 . 2011-04-20 14:47        375808        ----a-w-        c:\windows\system32\winsrv.dll
2011-09-25 11:47 . 2011-04-20 14:44        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2011-09-25 11:43 . 2011-04-29 14:54        276992        ----a-w-        c:\windows\system32\schannel.dll
2011-09-25 11:20 . 2011-09-25 11:20        0        ----a-w-        c:\users\mm\AppData\Local\BIT4D3A.tmp
2011-09-25 11:15 . 2011-09-25 11:15        0        ----a-w-        c:\users\mm\AppData\Local\BIT453.tmp
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 15:00 . 2010-05-25 18:46        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-04-14 16:40 . 2011-05-28 18:19        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
2010-09-09 06:48 . 2009-11-16 17:50        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-11 68856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"NDSTray.exe"="NDSTray.exe" [BU]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-24 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-05-09 716800]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-15 185896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
c:\users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
firefox - Verknpfung.lnk - c:\program files\Mozilla Firefox\firefox.exe [2011-5-28 924632]
iTunes - Verknpfung.lnk - c:\program files\iTunes\iTunes.exe [2011-4-14 9776936]
Microsoft Office Outlook starten.lnk - c:\program files\Microsoft Office\OFFICE11\OUTLOOK.EXE [2010-6-23 196440]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 135664]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 135664]
R3 L6UX1;Service - Line 6 UX1;c:\windows\system32\Drivers\L6UX1.sys [2009-01-28 530816]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-16 40960]
S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe [2008-02-19 537256]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-02-06 126976]
S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-09-08 237056]
S2 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [2010-09-08 1034752]
S2 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [2010-09-08 484352]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54 MBit/s USB 2.0 Netzwerkadapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-12-26 290304]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 10875182
*NewlyCreated* - 22029523
*NewlyCreated* - 48041077
*Deregistered* - 10875182
*Deregistered* - 22029523
*Deregistered* - 48041077
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 19:27]
.
2011-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 19:27]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: line6.net
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\mm\AppData\Roaming\Mozilla\Firefox\Profiles\r96mu4ra.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
AddRemove-Lehrer-Software Notting Hill Gate 2 - c:\users\mm\REFERE~1\Englisch\LEHRER~1\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-29 22:14
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-09-29  22:16:27
ComboFix-quarantined-files.txt  2011-09-29 20:16
.
Vor Suchlauf: 7.125.663.744 Bytes frei
Nach Suchlauf: 9.779.191.808 Bytes frei
.
- - End Of File - - 2E1273417BFFC1929EEF84123F3B2188
--- --- ---

cosinus 29.09.2011 22:02
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

nado123456 03.10.2011 20:31
Sorry, ich war am Wochenende unterwegs, deshalb hat es jetzt etwas länger gedauert.
Hier ist das GMER logfile. Ich mache dann die anderen beiden Sachen...

GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-10-03 21:27:27
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.01.0
Running: cu6hmwu8.exe; Driver: C:\Users\mm\AppData\Local\Temp\pgddypoc.sys


---- System - GMER 1.0.15 ----

SSDT            AA262504                                                                                        ZwCreateThread
SSDT            AA2624F0                                                                                        ZwOpenProcess
SSDT            AA2624F5                                                                                        ZwOpenThread
SSDT            AA2624FF                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetTimerEx + 454                                                                  820F8A78 4 Bytes  [04, 25, 26, AA] {ADD AL, 0x25; STOS BYTE ES:[EDI]}
.text          ntkrnlpa.exe!KeSetTimerEx + 624                                                                  820F8C48 4 Bytes  [F0, 24, 26, AA]
.text          ntkrnlpa.exe!KeSetTimerEx + 640                                                                  820F8C64 4 Bytes  [F5, 24, 26, AA] {CMC ; AND AL, 0x26; STOSB }
.text          ntkrnlpa.exe!KeSetTimerEx + 854                                                                  820F8E78 4 Bytes  [FF, 24, 26, AA] {JMP [ESI]; STOSB }
.text          C:\Windows\system32\DRIVERS\tos_sps32.sys                                                        section is writeable [0x89F54480, 0x3C939, 0xE8000020]
.dsrt          C:\Windows\system32\DRIVERS\tos_sps32.sys                                                        unknown last section [0x89F95900, 0x3CA, 0x48000040]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272a8aaf7                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272a8aaf7@2021a5897fdd        0xB0 0x0A 0xE9 0xCE ...
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272a8aaf7 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272a8aaf7@2021a5897fdd            0xB0 0x0A 0xE9 0xCE ...

---- EOF - GMER 1.0.15 ----
--- --- ---

nado123456 03.10.2011 20:37
So, hier ist das OSAM logfile:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:36:22 on 03.10.2011

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Mozilla Corporation Firefox 6.0.2

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"L6DriverControlPanel.cpl" - "Line 6, Inc." - C:\Windows\system32\L6DriverControlPanel.cpl
"TOSCDSPD.cpl" - "TOSHIBA" - C:\Windows\system32\TOSCDSPD.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\mm\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"pgddypoc" (pgddypoc) - ? - C:\Users\mm\AppData\Local\Temp\pgddypoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -  (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"Amazon.de" - ? - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home  (HTTP value)
"eBay - Der weltweite Online Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4  (HTTP value)
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{86529161-034E-4F8A-88D2-3C625E612E04} "Run WinHTTrack" - ? - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\mm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"firefox - Verknüpfung.lnk" - "Mozilla Corporation" - C:\Program Files\Mozilla Firefox\firefox.exe  (Shortcut exists | File exists)
"iTunes - Verknüpfung.lnk" - "Apple Inc." - C:\Program Files\iTunes\iTunes.exe  (Shortcut exists | File exists)
"Microsoft Office Outlook starten.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE  (Shortcut exists | File exists)
"OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"WDDMStatus.lnk" - "Western Digital Technologies, Inc." - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" - "Nero AG" - "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"00TCrdMain" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"CanonMyPrinter" - "CANON INC." - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
"CanonSolutionMenu" - "CANON INC." - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"FreePDF Assistant" - "shbox.de" - C:\Program Files\FreePDF_XP\fpassist.exe
"Google EULA Launcher" - " " - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
"HSON" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NDSTray.exe" - ? - NDSTray.exe  (File not found)
"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SmoothView" - "TOSHIBA Corporation" - %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"topi" - "TOSHIBA" - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
"Toshiba Registration" - "Toshiba" - C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
"Toshiba TEMPO" - "Toshiba Europe GmbH" - C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
"TPwrMain" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"ConfigFree Service" (ConfigFree Service) - "TOSHIBA CORPORATION" - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Software Updater" (gusvc) - ? - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"  (File not found)
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"Notebook Performance Tuning Service " (TempoMonitoringService) - "Toshiba Europe GmbH" - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"TOSHIBA Navi Support Service" (TNaviSrv) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
"TOSHIBA Optical Disc Drive Service" (TODDSrv) - "TOSHIBA Corporation" - C:\Windows\system32\TODDSrv.exe
"TOSHIBA Power Saver" (TosCoSrv) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
"TOSHIBA SMART Log Service" (TOSHIBA SMART Log Service) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
"WD File Management Engine" (WDFME) - ? - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe
"WD File Management Shadow Engine" (WDSC) - ? - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
"WDDMService" (WDDMService) - "WDC" - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

nado123456 03.10.2011 21:21
Mmmh, mit aswMBR gibt's Probleme.
Mitten im scan bricht's ab und der laptop fährt runter (und wieder hoch).
Was nun?

cosinus 04.10.2011 16:20
Lade aswMBR bitte neu runter und probiers nochmal.
Wichtig ist, dass du er per Rechtsklick => als Administrator ausführen startest

nado123456 06.10.2011 17:39
Ich habe aswMBR zwei mal neu geladen, mehrfach versucht auszuführen (als administrator), aber es bricht jedes mal ab, ein blauer bildschirm erscheint und der computer startet neu!

cosinus 07.10.2011 14:55
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

nado123456 08.10.2011 13:08
Ok, das hat geklappt.

cosinus 08.10.2011 17:16
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


nado123456 08.10.2011 21:54
Hier ist schon mal das malwarebytes-log, der Rest folgt morgen!


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7902

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

08.10.2011 21:10:50
mbam-log-2011-10-08 (21-10-50).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 332311
Laufzeit: 1 Stunde(n), 26 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

nado123456 09.10.2011 16:28
Hier ist das SUPERAntiSpyware log:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/09/2011 at 05:09 PM

Application Version : 5.0.1128

Core Rules Database Version : 7773
Trace Rules Database Version: 5585

Scan type : Complete Scan
Total Scan Time : 02:25:12

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)
UAC On - Limited User (Administrator User)

Memory items scanned : 852
Memory threats detected : 0
Registry items scanned : 37981
Registry threats detected : 0
File items scanned : 199617
File threats detected : 83

Adware.Tracking Cookie
C:\Users\mm\AppData\Roaming\Microsoft\Windows\Cookies\mm@doubleclick[1].txt [ /doubleclick ]
C:\USERS\MM\AppData\Roaming\Microsoft\Windows\Cookies\Low\mm@google[5].txt [ Cookie:mm@google.com/accounts/ ]
C:\USERS\MM\Cookies\mm@doubleclick[1].txt [ Cookie:mm@doubleclick.net/ ]
.doubleclick.net [ C:\USERS\MM\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
be.sitestat.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.mediabrandsww.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.kontera.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
adserver.doccheck.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.aok.122.2o7.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.bs.serving-sys.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.unitymedia.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.unitymedia.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tracking.mindshare.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\MM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\R96MU4RA.DEFAULT\COOKIES.SQLITE ]

nado123456 09.10.2011 20:48
So, und nun hier das letzte! Danke schonmal für deine rückmeldung, ich denke mal es ist jetzt alles ok? Keine bedeutsamen Funde?


ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=55e028b12fc4204486283678403d09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-27 05:40:49
# local_time=2011-09-27 07:40:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 0 92654630 0 0
# compatibility_mode=5892 16776573 100 100 980 154672051 0 0
# compatibility_mode=8192 67108863 100 0 332 332 0 0
# scanned=167440
# found=4
# cleaned=0
# scan_time=5925
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\e649f74-23b97867 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\2fa55376-478d8cf9 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\f220df9-22d66f64 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\fa8f07a-49f74daa probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=55e028b12fc4204486283678403d09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-27 07:51:08
# local_time=2011-09-27 09:51:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 5413 92662803 1800 0
# compatibility_mode=5892 16776573 100 100 7583 154680224 0 0
# compatibility_mode=8192 67108863 100 0 8505 8505 0 0
# scanned=167457
# found=4
# cleaned=0
# scan_time=5572
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\e649f74-23b97867 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\2fa55376-478d8cf9 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\f220df9-22d66f64 Java/TrojanDownloader.Agent.NBN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\mm\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\fa8f07a-49f74daa probably a variant of Win32/Agent.DYXWUMY trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=55e028b12fc4204486283678403d09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-09 06:05:46
# local_time=2011-10-09 08:05:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 100 75208 93689635 3368 0
# compatibility_mode=5892 16776573 100 100 10770 155707056 0 0
# compatibility_mode=8192 67108863 100 0 1035337 1035337 0 0
# scanned=166784
# found=0
# cleaned=0
# scan_time=9218

cosinus 10.10.2011 12:21
Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

nado123456 10.10.2011 16:48
Nein, keine Probleme mehr :singsing:. Vielen dank! Dank euren super anleitungen und deiner hilfe kann mein laptop jetzt seine 2.Karriere starten.
Gruß, Nadja

cosinus 10.10.2011 17:26
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:24 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131