Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Mozilla startet sich beim Hochfahren (https://www.trojaner-board.de/107391-mozilla-startet-beim-hochfahren.html)

randulin 01.01.2012 20:46
Mozilla startet sich beim Hochfahren
 
Hallo,

seit wenigen Tagen hab ich das Phänomen, dass sich Mozilla automatisch startet, wenn ich den Rechner hochfahre. Mein Standardbrowser ist Chrome. Ich hab daraufhin Spybot Search and Destroy installiert und nach einem Scan fand er auch einige unschöne Cookies, die ich alle entfernt hab. Der Virenscanner MSE fand überhaupt nichts.

Ich hab schon nach dem Mozilla-problem gegoogelt, aber konnte nicht genau mein Problem, bzw. Problemlösung finden. Und jetzt liegt auch der Gedanke nahe, dass da noch viel blödere Sachen dahinter stecken könnten.. Es wäre super nett, wenn irgendwer mal über meine OTL File drüber schauen könnte.

VIelen Dank.


OTL logfile created on: 01.01.2012 20:02:10 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Rebi\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,87 Gb Total Physical Memory | 1,90 Gb Available Physical Memory | 49,26% Memory free
7,73 Gb Paging File | 5,50 Gb Available in Paging File | 71,18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,62 Gb Total Space | 104,52 Gb Free Space | 71,28% Space Free | Partition Type: NTFS
Drive D: | 151,37 Gb Total Space | 48,81 Gb Free Space | 32,24% Space Free | Partition Type: NTFS

Computer Name: REBI-PC | User Name: Rebi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.01.01 20:01:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe
PRC - [2012.01.01 19:31:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.11.12 13:41:00 | 000,704,568 | ---- | M] (Conexant Systems, Inc) -- C:\Programme\CONEXANT\SAII\SmartAudio.exe
PRC - [2009.01.26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2007.09.11 15:50:28 | 000,804,144 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
PRC - [2007.09.07 11:06:46 | 001,070,384 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
PRC - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
PRC - [2007.03.09 19:00:18 | 001,167,360 | ---- | M] (Lenovo (Beijing) Limited) -- C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe


========== Modules (No Company Name) ==========

MOD - [2011.12.31 15:07:22 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\dd759df05fad8dc6d3404e8e02b40819\Microsoft.VisualBasic.ni.dll
MOD - [2011.12.31 14:59:50 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b559a471eef00081f0b5c2719d1d9623\System.Runtime.Remoting.ni.dll
MOD - [2011.12.07 12:16:28 | 000,411,192 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
MOD - [2011.12.07 12:16:27 | 003,767,864 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll
MOD - [2011.12.07 12:14:56 | 000,122,952 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avutil-51.dll
MOD - [2011.12.07 12:14:55 | 000,222,280 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avformat-53.dll
MOD - [2011.12.07 12:14:53 | 001,746,504 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\avcodec-53.dll
MOD - [2011.12.07 08:22:33 | 008,593,056 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll
MOD - [2011.12.07 08:22:33 | 008,593,056 | ---- | M] () -- C:\Users\Rebi\AppData\Local\Google\Chrome\APPLIC~1\160912~1.63\gcswf32.dll
MOD - [2011.10.28 16:37:46 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\273292e88c7b60ecbae9d85e94cd097e\WindowsFormsIntegration.ni.dll
MOD - [2011.10.28 16:35:42 | 000,220,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\2c2215e99c21daeec6bf697cf7bcf103\CustomMarshalers.ni.dll
MOD - [2011.10.28 16:21:09 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll
MOD - [2011.10.28 16:20:43 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll
MOD - [2011.10.28 16:20:30 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011.10.28 16:20:24 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011.10.28 16:20:21 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll
MOD - [2011.10.28 16:20:12 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011.10.28 16:20:07 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011.10.28 16:20:04 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011.10.28 16:20:03 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011.10.28 16:19:58 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 02:57:39 | 000,069,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
MOD - [2009.07.14 18:58:15 | 000,167,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll
MOD - [2005.06.24 19:05:02 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011.04.27 16:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011.04.27 16:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2011.12.24 12:01:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011.06.10 05:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.04.27 14:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.02.02 14:52:02 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.12.17 23:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2009.12.17 21:59:28 | 000,086,120 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.11.24 13:21:26 | 000,708,608 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009.10.19 00:40:50 | 000,028,176 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV:64bit: - [2009.09.17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.08.09 22:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 54 02 12 CC 93 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.18 18:49:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011.12.18 18:50:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rebi\AppData\Roaming\mozilla\Extensions
[2011.12.18 18:49:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.30 18:41:37 | 000,003,747 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Rebi\AppData\Local\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Rebi\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Auf den Amazon-Wunschzettel = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.7_0\
CHR - Extension: Google-Suche = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Google Mail = C:\Users\Rebi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

O1 HOSTS File: ([2011.12.30 18:48:30 | 000,440,010 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15127 more lines...
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [EnergyCut] C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe (Lenovo(beijing) Limited)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk = C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
O4 - Startup: C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe (AVM Berlin)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\FRITZ!DSL\sarah.dll (AVM Berlin)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93C37204-3657-4DC9-9420-9CF2BD68817D}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell - "" = AutoRun
O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\AutoRun\command - "" = H:\SETUP.EXE
O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\configure\command - "" = H:\SETUP.EXE
O33 - MountPoints2\{160c37d7-0317-11e1-9fb5-705ab6672a0c}\Shell\install\command - "" = H:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.01.01 20:01:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe
[2012.01.01 19:31:17 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe
[2011.12.30 18:42:54 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\AVG2012
[2011.12.30 18:41:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011.12.30 18:40:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.12.30 18:39:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.12.30 18:39:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.12.30 18:39:48 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2011.12.30 18:34:16 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011.12.25 18:38:27 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\2011_12_24 -
[2011.12.25 03:44:13 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Local\FRITZ!
[2011.12.24 12:33:44 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2011.12.24 12:05:29 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2011.12.24 12:01:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
[2011.12.24 11:14:34 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CdCoverCreator
[2011.12.24 11:14:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CdCoverCreator
[2011.12.24 11:14:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CdCoverCreator
[2011.12.23 18:12:55 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Canneverbe Limited
[2011.12.23 18:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2011.12.23 18:12:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP
[2011.12.18 18:49:57 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\Mozilla
[2011.12.18 18:49:57 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Local\Mozilla
[2011.12.18 18:49:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.12.14 13:47:23 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.14 13:47:23 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.14 13:47:21 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.14 13:47:20 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.14 13:47:19 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.14 13:47:19 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.14 13:47:16 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011.12.14 13:47:16 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011.12.14 13:47:16 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011.12.14 13:47:15 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011.12.14 13:47:14 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011.12.14 04:23:54 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.14 04:23:50 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.14 04:23:50 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.13 21:59:41 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\2011_12_09
[2011.12.13 15:32:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011.12.13 15:32:20 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011.12.04 20:17:09 | 000,000,000 | ---D | C] -- C:\Users\Rebi\AppData\Roaming\FRITZ!
[2011.12.03 18:45:16 | 000,000,000 | ---D | C] -- C:\Users\Rebi\Desktop\HammerHead
[2011.12.03 14:47:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!DSL
[2011.12.03 14:47:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVM
[2011.12.03 14:46:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2011.12.03 14:46:25 | 000,069,120 | R--- | C] (AVM Berlin) -- C:\Windows\SysWow64\avmadd32.dll
[2011.12.03 14:46:25 | 000,016,384 | R--- | C] (AVM Berlin GmbH) -- C:\Windows\SysWow64\avmprmon.dll
[2011.12.03 14:46:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
[2011.12.03 14:46:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!BoxPrint
[2011.12.03 14:46:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FRITZ!Box

========== Files - Modified Within 30 Days ==========

[2012.01.01 20:10:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000UA.job
[2012.01.01 20:01:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rebi\Desktop\OTL.exe
[2012.01.01 19:31:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Rebi\Desktop\HiJackThis204.exe
[2012.01.01 19:29:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.01 15:45:45 | 000,016,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.01 15:45:45 | 000,016,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.01 15:37:54 | 3113,365,504 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.31 19:29:39 | 001,505,034 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.31 19:29:39 | 000,656,266 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.31 19:29:39 | 000,618,108 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.31 19:29:39 | 000,131,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.31 19:29:39 | 000,107,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.30 18:48:30 | 000,440,010 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011.12.30 18:40:37 | 000,001,258 | ---- | M] () -- C:\Users\Rebi\Desktop\Spybot - Search & Destroy.lnk
[2011.12.28 11:39:40 | 734,212,096 | ---- | M] () -- C:\Users\Rebi\Desktop\1989
[2011.12.28 10:40:17 | 000,345,821 | ---- | M] () -- C:\Users\Rebi\Desktop\23648.pdf
[2011.12.28 10:35:34 | 000,921,834 | ---- | M] () -- C:\Users\Rebi\Desktop\oas.pdf
[2011.12.28 09:05:22 | 732,125,184 | ---- | M] () -- C:\Users\Rebi\Desktop\1988
[2011.12.26 20:46:23 | 786,393,088 | ---- | M] () -- C:\Users\Rebi\Desktop\2010
[2011.12.25 03:42:26 | 002,272,080 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.24 13:10:02 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000Core.job
[2011.12.24 12:44:42 | 000,357,216 | ---- | M] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101 Kopie.jpg
[2011.12.24 12:38:06 | 000,001,052 | ---- | M] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
[2011.12.24 11:57:22 | 000,257,212 | ---- | M] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101.jpeg
[2011.12.24 11:34:49 | 000,124,825 | ---- | M] () -- C:\Users\Rebi\Desktop\swing.ccc
[2011.12.24 11:30:02 | 000,070,969 | ---- | M] () -- C:\Users\Rebi\Desktop\artworks-000003049932-g3u3dv-crop.jpg
[2011.12.24 11:29:39 | 000,106,412 | ---- | M] () -- C:\Users\Rebi\Desktop\al_jawala___the_ride.jpg
[2011.12.24 11:29:15 | 000,016,914 | ---- | M] () -- C:\Users\Rebi\Desktop\111118_elektro_swing_ada-215x301.jpg
[2011.12.23 22:46:05 | 000,002,273 | ---- | M] () -- C:\Users\Rebi\Desktop\zzz.m3u
[2011.12.23 19:18:49 | 000,003,308 | ---- | M] () -- C:\Users\Rebi\Desktop\1.axp
[2011.12.22 19:41:44 | 874,333,946 | ---- | M] () -- C:\Users\Rebi\Desktop\Dance Cardio Workout.zip
[2011.12.19 10:57:05 | 000,002,598 | ---- | M] () -- C:\Users\Rebi\Documents\ZertiSchlüss.pfx
[2011.12.19 10:52:36 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.12.16 18:57:04 | 006,091,287 | ---- | M] () -- C:\Users\Rebi\Desktop\Ben Folds Five and Selections From Naked Baby Photos (Songbook).pdf
[2011.12.06 15:57:04 | 721,327,605 | ---- | M] () -- C:\Users\Rebi\Desktop\01 Complete Body Workout.m4v
[2011.12.04 20:17:45 | 000,001,234 | ---- | M] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
[2011.12.03 18:45:17 | 000,000,043 | ---- | M] () -- C:\END
[2011.12.03 14:47:07 | 000,002,471 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk

========== Files Created - No Company Name ==========

[2011.12.30 18:40:37 | 000,001,258 | ---- | C] () -- C:\Users\Rebi\Desktop\Spybot - Search & Destroy.lnk
[2011.12.28 11:31:20 | 734,212,096 | ---- | C] () -- C:\Users\Rebi\Desktop\1989
[2011.12.28 10:40:20 | 000,345,821 | ---- | C] () -- C:\Users\Rebi\Desktop\23648.pdf
[2011.12.28 10:35:39 | 000,921,834 | ---- | C] () -- C:\Users\Rebi\Desktop\oas.pdf
[2011.12.28 08:40:39 | 732,125,184 | ---- | C] () -- C:\Users\Rebi\Desktop\1988
[2011.12.26 20:20:07 | 786,393,088 | ---- | C] () -- C:\Users\Rebi\Desktop\2010
[2011.12.24 12:44:36 | 000,357,216 | ---- | C] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101 Kopie.jpg
[2011.12.24 12:38:06 | 000,001,052 | ---- | C] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
[2011.12.24 12:14:19 | 000,001,137 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS3.lnk
[2011.12.24 12:10:50 | 000,001,223 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Stock Photos CS3.lnk
[2011.12.24 12:08:37 | 000,001,403 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit 2.lnk
[2011.12.24 12:08:12 | 000,001,192 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS3.lnk
[2011.12.24 12:04:04 | 000,001,099 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS3.lnk
[2011.12.24 11:57:28 | 000,257,212 | ---- | C] () -- C:\Users\Rebi\Desktop\musiccomesfromtheheadphones-554101.jpeg
[2011.12.24 11:34:49 | 000,124,825 | ---- | C] () -- C:\Users\Rebi\Desktop\swing.ccc
[2011.12.24 11:30:04 | 000,070,969 | ---- | C] () -- C:\Users\Rebi\Desktop\artworks-000003049932-g3u3dv-crop.jpg
[2011.12.24 11:29:42 | 000,106,412 | ---- | C] () -- C:\Users\Rebi\Desktop\al_jawala___the_ride.jpg
[2011.12.24 11:29:18 | 000,016,914 | ---- | C] () -- C:\Users\Rebi\Desktop\111118_elektro_swing_ada-215x301.jpg
[2011.12.23 22:17:23 | 000,002,273 | ---- | C] () -- C:\Users\Rebi\Desktop\zzz.m3u
[2011.12.23 19:18:49 | 000,003,308 | ---- | C] () -- C:\Users\Rebi\Desktop\1.axp
[2011.12.23 18:12:47 | 000,001,899 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2011.12.22 19:23:43 | 874,333,946 | ---- | C] () -- C:\Users\Rebi\Desktop\Dance Cardio Workout.zip
[2011.12.19 10:57:02 | 000,002,598 | ---- | C] () -- C:\Users\Rebi\Documents\ZertiSchlüss.pfx
[2011.12.18 18:49:52 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.12.16 18:56:19 | 006,091,287 | ---- | C] () -- C:\Users\Rebi\Desktop\Ben Folds Five and Selections From Naked Baby Photos (Songbook).pdf
[2011.12.06 15:42:52 | 721,327,605 | ---- | C] () -- C:\Users\Rebi\Desktop\01 Complete Body Workout.m4v
[2011.12.04 20:17:45 | 000,001,234 | ---- | C] () -- C:\Users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
[2011.12.03 18:45:17 | 000,000,043 | ---- | C] () -- C:\END
[2011.12.03 14:47:07 | 000,002,471 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk
[2011.11.05 20:03:25 | 000,003,584 | ---- | C] () -- C:\Users\Rebi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.03 11:07:28 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.10.26 11:49:59 | 001,500,444 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

< End of report >

markusg 02.01.2012 16:04
hi,
1. spybot deinstalieren, nicht mehr sonderlich zeitgemäß, kann außerdem reinigung stören, pc neustarten.
2.
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

randulin 02.01.2012 16:13
Vielen Dank für deine Antwort. Soll ich meine Backups von Spybot wiederherstellen bevor ich es deinstalliere?

randulin 02.01.2012 17:13
So. Spybot ist deinstalliert. Scan wurde ausgeführt. Kurzer Hinweis: Chrome war doch nicht der Standardbrowser, nachdem ich das umgestellt hab, hat sich Firefox auch nicht wieder automatisch geöffnet. Ich finds trotzdem komisch.

Hier mein Log:


Combofix Logfile:
Code:
ComboFix 12-01-02.01 - Rebi 02.01.2012  16:47:27.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3959.2607 [GMT 1:00]
ausgeführt von:: c:\users\Rebi\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\{95591882-0B23-445D-B709-2D115214A714}.xps
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Leo.gadget
c:\users\Rebi\AppData\Local\Microsoft\Windows\Temporary Internet Files\wetter.info.gadget
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-02 bis 2012-01-02  ))))))))))))))))))))))))))))))
.
.
2012-01-02 15:56 . 2012-01-02 15:56        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-02 15:37 . 2012-01-02 15:37        69000        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{90D52915-24F6-4A2D-B4E5-205EAF3A3DE3}\offreg.dll
2012-01-01 14:39 . 2011-11-21 11:40        8822856        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{90D52915-24F6-4A2D-B4E5-205EAF3A3DE3}\mpengine.dll
2011-12-30 17:42 . 2011-12-30 17:42        --------        d-----w-        c:\users\Rebi\AppData\Roaming\AVG2012
2011-12-30 17:41 . 2011-12-30 17:41        --------        d--h--w-        c:\programdata\Common Files
2011-12-30 17:39 . 2012-01-02 15:36        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy
2011-12-30 17:39 . 2012-01-02 15:36        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2011-12-30 17:39 . 2011-12-30 21:18        --------        d-----w-        c:\programdata\AVG2012
2011-12-30 17:34 . 2011-12-30 21:15        --------        d-----w-        c:\programdata\MFAData
2011-12-25 02:44 . 2011-12-25 02:44        --------        d-----w-        c:\users\Rebi\AppData\Local\FRITZ!
2011-12-24 11:33 . 2011-12-24 11:33        --------        d-----w-        c:\programdata\FLEXnet
2011-12-24 11:05 . 2011-12-24 11:05        --------        d-----w-        c:\windows\SysWow64\spool
2011-12-24 11:01 . 2011-12-24 11:01        --------        d-----w-        c:\program files (x86)\Common Files\Macrovision Shared
2011-12-24 10:14 . 2011-12-24 10:14        --------        d-----w-        c:\program files (x86)\CdCoverCreator
2011-12-23 17:12 . 2011-12-23 17:12        --------        d-----w-        c:\users\Rebi\AppData\Roaming\Canneverbe Limited
2011-12-23 17:12 . 2011-12-23 17:12        --------        d-----w-        c:\programdata\Canneverbe Limited
2011-12-23 17:12 . 2011-12-23 17:12        --------        d-----w-        c:\program files (x86)\CDBurnerXP
2011-12-18 17:49 . 2011-12-18 17:49        --------        d-----w-        c:\users\Rebi\AppData\Local\Mozilla
2011-12-17 18:33 . 2011-11-21 11:40        8822856        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-12-14 03:23 . 2011-10-26 05:21        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2011-12-14 03:23 . 2011-11-24 04:52        3145216        ----a-w-        c:\windows\system32\win32k.sys
2011-12-14 03:23 . 2011-10-15 06:31        723456        ----a-w-        c:\windows\system32\EncDec.dll
2011-12-14 03:23 . 2011-10-15 05:38        534528        ----a-w-        c:\windows\SysWow64\EncDec.dll
2011-12-14 03:23 . 2011-11-05 05:32        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-12-14 03:23 . 2011-11-05 04:26        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
2011-12-13 14:32 . 2011-12-13 14:32        --------        d-----w-        c:\program files\7-Zip
2011-12-04 19:17 . 2012-01-02 15:45        --------        d-----w-        c:\users\Rebi\AppData\Roaming\FRITZ!
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-19 09:52 . 2011-11-24 09:17        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-28 15:07 . 2011-10-28 15:07        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2011-10-28 15:07 . 2011-10-28 15:07        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2011-10-28 15:07 . 2011-10-28 15:07        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-10-28 15:07 . 2011-10-28 15:07        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2011-10-28 15:07 . 2011-10-28 15:07        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2011-10-28 15:07 . 2011-10-28 15:07        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2011-10-28 15:07 . 2011-10-28 15:07        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2011-10-28 15:07 . 2011-10-28 15:07        367104        ----a-w-        c:\windows\SysWow64\html.iec
2011-10-28 15:07 . 2011-10-28 15:07        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2011-10-28 15:07 . 2011-10-28 15:07        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2011-10-28 15:07 . 2011-10-28 15:07        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2011-10-28 15:07 . 2011-10-28 15:07        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2011-10-28 15:07 . 2011-10-28 15:07        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2011-10-28 15:07 . 2011-10-28 15:07        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2011-10-28 15:07 . 2011-10-28 15:07        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2011-10-28 15:07 . 2011-10-28 15:07        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2011-10-28 15:07 . 2011-10-28 15:07        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2011-10-28 15:07 . 2011-10-28 15:07        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2011-10-28 15:07 . 2011-10-28 15:07        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2011-10-28 15:07 . 2011-10-28 15:07        76800        ----a-w-        c:\windows\system32\tdc.ocx
2011-10-28 15:07 . 2011-10-28 15:07        49664        ----a-w-        c:\windows\system32\imgutil.dll
2011-10-28 15:07 . 2011-10-28 15:07        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2011-10-28 15:07 . 2011-10-28 15:07        222208        ----a-w-        c:\windows\system32\msls31.dll
2011-10-28 15:07 . 2011-10-28 15:07        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2011-10-28 15:07 . 2011-10-28 15:07        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2011-10-28 15:07 . 2011-10-28 15:07        12288        ----a-w-        c:\windows\system32\mshta.exe
2011-10-28 15:07 . 2011-10-28 15:07        114176        ----a-w-        c:\windows\system32\admparse.dll
2011-10-28 15:07 . 2011-10-28 15:07        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2011-10-28 15:07 . 2011-10-28 15:07        85504        ----a-w-        c:\windows\system32\iesetup.dll
2011-10-28 15:07 . 2011-10-28 15:07        603648        ----a-w-        c:\windows\system32\vbscript.dll
2011-10-28 15:07 . 2011-10-28 15:07        448512        ----a-w-        c:\windows\system32\html.iec
2011-10-28 15:07 . 2011-10-28 15:07        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2011-10-28 15:07 . 2011-10-28 15:07        165888        ----a-w-        c:\windows\system32\iexpress.exe
2011-10-28 15:07 . 2011-10-28 15:07        160256        ----a-w-        c:\windows\system32\wextract.exe
2011-10-28 14:08 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2011-10-28 14:08 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2011-10-26 10:56 . 2011-10-26 10:56        917840        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0486ACFD-5C61-41D8-8A71-FB2BA445D664}\gapaengine.dll
2011-10-18 00:27 . 2011-10-26 10:54        8570192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{ECCC5D85-334E-4494-AAB3-2AB2D4095596}\mpengine.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-13 307768]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-12 421736]
"EnergyUtility"="c:\program files (x86)\Lenovo\EnergyCut\utilty.exe" [2007-04-27 1581056]
"EnergyCut"="c:\program files (x86)\Lenovo\EnergyCut\EnergyCut.exe" [2007-03-09 1167360]
.
c:\users\Rebi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files (x86)\FRITZ!DSL\FritzDsl.exe [2007-9-3 992560]
FRITZ!DSL Protect.lnk - c:\program files (x86)\FRITZ!DSL\FwebProt.exe [2007-9-7 1070384]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe [2011-12-3 29184]
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files (x86)\FRITZ!DSL\IGDCTRL.EXE [2007-09-04 87344]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000Core.job
- c:\users\Rebi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-26 11:05]
.
2012-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546844914-2474796464-924611435-1000UA.job
- c:\users\Rebi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-26 11:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-03 16414824]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-13 307768]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-11-16 508472]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2009-12-17 4367808]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6988736]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Rebi\AppData\Roaming\Mozilla\Firefox\Profiles\klgp19po.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-02  17:10:02
ComboFix-quarantined-files.txt  2012-01-02 16:09
.
Vor Suchlauf: 9 Verzeichnis(se), 116.153.851.904 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 115.788.238.848 Bytes frei
.
- - End Of File - - 513D8CAE19BD1F57AAB0923420C02190
--- --- ---

markusg 02.01.2012 18:53
kann es sein das das problem nach der instalation von
wetter.info.gadget
auftrat? nutze das nicht selbst, wäre aber evtl. die lösung

randulin 02.01.2012 21:13
Das könnte sein. Lange habe ich das noch nicht drauf. Ich habe es jetzt mal deinstalliert.

Sieht es ansonsten sauber aus auf meinem PC?

markusg 03.01.2012 13:02
wir gucken mal weiter.

malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

randulin 06.01.2012 17:41
Sorry, hat ein bisschen gedauert. Hier der Log.


Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.06.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Rebi :: REBI-PC [Administrator]

Schutz: Aktiviert

06.01.2012 16:53:09
mbam-log-2012-01-06 (16-53-09).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 294623
Laufzeit: 41 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg 06.01.2012 17:42
sieht io aus

lade den CCleaner standard:
CCleaner Download - CCleaner 3.14.1616
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

randulin 06.01.2012 17:52
7-Zip 9.20 (x64 edition) Igor Pavlov 12.12.2011 4,53MB 9.20.00.0 notwendig
Adobe Flash Player 11 ActiveX 64-bit Adobe Systems Incorporated 23.11.2011 6,00MB 11.1.102.55 notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 18.12.2011 6,00MB 11.1.102.55 notwendig
Adobe Photoshop CS3 Adobe Systems Incorporated 23.12.2011 1.085MB 10.0 unnötig (Testversion)
Adobe Reader X (10.1.1) - Deutsch Adobe Systems Incorporated 29.10.2011 119,2MB 10.1.1 notwendig
Apple Application Support Apple Inc. 02.11.2011 61,2MB 2.1.5 unbekannt
Apple Mobile Device Support Apple Inc. 21.11.2011 24,9MB 4.0.0.97 unbekannt
Apple Software Update Apple Inc. 02.11.2011 2,38MB 2.1.3.127 notwendig
AVM FRITZ!Box Dokumentation AVM Berlin 02.12.2011 unbekannt
AVM FRITZ!Box Druckeranschluss AVM Berlin 02.12.2011 unbekannt
AVM FRITZ!DSL AVM Berlin 02.12.2011 14,1MB 2.04.02 notwendig
Bonjour Apple Inc. 02.11.2011 2,00MB 3.0.0.10 unbekannt
Broadcom 802.11 Wireless Driver 25.10.2011 1.0.0.0 notwendig
CCleaner Piriform 05.01.2012 3.14 notwendig
CDBurnerXP CDBurnerXP 22.12.2011 12,8MB 4.4.0.2838 notwendig
CdCoverCreator 2.5.3 thyanté Software 23.12.2011 2.5.3 unnötig
Conexant HD Audio Conexant 25.10.2011 4.107.0.60 unbekannt
Energy Management Lenovo 29.10.2011 5.4.0.8 notwendig
EnergyCut Lenovo 25.11.2011 1.00 notwendig
Google Chrome Google Inc. 25.10.2011 16.0.912.63 notwendig
IrfanView (remove only) Irfan Skiljan 04.11.2011 1,50MB 4.30 notwendig
iTunes Apple Inc. 21.11.2011 170,5MB 10.5.1.42 notwendig
Malwarebytes Anti-Malware Version 1.60.0.1800 Malwarebytes Corporation 05.01.2012 18,6MB 1.60.0.1800 notwendig
McAfee Security Scan Plus McAfee, Inc. 01.11.2011 8,30MB 2.0.181.2 unnötig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.10.2011 38,8MB 4.0.30319 unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 25.10.2011 2,94MB 4.0.30319 unbekannt
Microsoft Office Professional Plus 2010 Microsoft Corporation 15.11.2011 14.0.6029.1000 notwendig
Microsoft Security Essentials Microsoft Corporation 25.10.2011 2.1.1116.0 notwendig
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 03.12.2011 0,29MB 8.0.61001 unekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 29.12.2011 0,57MB 9.0.30729.4148 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 30.12.2011 0,59MB 9.0.30729.6161 unbkeannt
Mozilla Firefox 8.0.1 (x86 de) Mozilla 17.12.2011 34,9MB 8.0.1 notwendig
NVIDIA Drivers NVIDIA Corporation 25.10.2011 65,1MB 1.10.57.35 notwendig
Realtek Ethernet Controller Driver For Windows Vista and Later Realtek 25.10.2011 1.00.0009 notwendig
VirtualCloneDrive Elaborate Bytes 29.10.2011 notwendig
Visual Studio 2008 x64 Redistributables AVG Technologies 29.12.2011 42,00KB 10.0.0.2 unbekannt
VLC media player 1.1.11 VideoLAN 02.11.2011 1.1.11 notwenidg
Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) Lenovo 29.10.2011 10/19/2009 5.4.0.1 notwendig

markusg 06.01.2012 19:51
deinstaliere:
Adobe Flash Player alle
Adobe - Andere Version des Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
Adobe Photoshop
CdCoverCreator

öffne otl. klicke bereinigen, pc startet neu, removal tools werden gelöscht.
öffne ccleaner, analysieren, bereinigen.
pc neustarten, berichte obs noch probleme gibt.

randulin 19.01.2012 18:21
Huch, Seite 2 jetzt erst entdeckt. Mach ich.. Feedback kommt.


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131