Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Browser Hijack: Firefox 9.0.1 leitet Google Suchergebnisse um (https://www.trojaner-board.de/108541-browser-hijack-firefox-9-0-1-leitet-google-suchergebnisse-um.html)

cananga 24.01.2012 14:31
Browser Hijack: Firefox 9.0.1 leitet Google Suchergebnisse um
 
Nach Beseitigung des Rogue Viruses "System Check" werden die bei Google aufgelisteten Links auf andere Seiten umgeleitet. Google-Search im Firefox Startfenster funktioniert auch nicht mehr und oben rechts werden keine Suchmaschinen angezeigt. Auch nach Neuinstallation von Firefox und Java-Update mit Anwendung von Rajava keine Änderung!

Hier der OTL.txt:

OTL Logfile:
Code:
OTL logfile created on: 24.01.2012 14:03:54 - Run 4
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Documents and Settings\mustermann\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3,49 Gb Total Physical Memory | 2,99 Gb Available Physical Memory | 85,61% Memory free
7,34 Gb Paging File | 7,02 Gb Available in Paging File | 95,69% Paging File free
Paging file location(s): C:\pagefile.sys 5362 5362 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 101,16 Gb Total Space | 56,83 Gb Free Space | 56,18% Space Free | Partition Type: NTFS
Drive D: | 263,25 Gb Total Space | 211,98 Gb Free Space | 80,52% Space Free | Partition Type: NTFS
Drive E: | 101,35 Gb Total Space | 61,38 Gb Free Space | 60,56% Space Free | Partition Type: NTFS
Drive G: | 38,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: FAT32
Drive J: | 1397,26 Gb Total Space | 404,49 Gb Free Space | 28,95% Space Free | Partition Type: NTFS
 
Computer Name: HAL9000 | User Name: mustermann | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.22 16:30:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
PRC - [2011.12.28 13:57:17 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.11.09 14:09:57 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009.02.15 23:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.12.28 13:57:17 | 002,124,760 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2004.09.08 13:45:58 | 000,368,128 | ---- | M] () -- C:\Program Files\Filzip\fzshext.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.11.22 14:20:17 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.11.22 14:20:04 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.01.25 11:41:12 | 002,398,536 | ---- | M] (O&O Software GmbH) [Auto | Stopped] -- C:\Program Files\OO Software\Defrag\oodag.exe -- (OODefragAgent)
SRV - [2009.02.15 23:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.19 14:12:00 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011.12.10 18:29:50 | 000,722,416 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.11.22 14:20:32 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.11.22 14:20:32 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.11.22 14:20:32 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.11.09 14:22:25 | 000,005,632 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mv64xxmm.sys -- (mv64xxmm)
DRV - [2011.11.09 14:22:24 | 000,013,616 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mvxxmm.sys -- (mvxxmm)
DRV - [2011.11.09 14:22:24 | 000,013,616 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mv61xxmm.sys -- (mv61xxmm)
DRV - [2011.10.26 04:01:40 | 007,412,736 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011.08.30 10:28:46 | 006,435,432 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2011.08.17 11:18:00 | 000,064,896 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EtronXHCI.sys -- (EtronXHCI)
DRV - [2011.08.17 11:18:00 | 000,045,056 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EtronHub3.sys -- (EtronHub3)
DRV - [2011.08.05 18:24:24 | 000,068,208 | ---- | M] (MOTU, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mawwave.sys -- (MAWWAVE)
DRV - [2011.08.05 18:24:22 | 000,348,272 | ---- | M] (MOTU, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motuaw.sys -- (motuaw)
DRV - [2011.07.06 11:16:08 | 004,137,960 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtKHDMI.sys -- (RTHDMIAzAudService)
DRV - [2010.10.28 15:58:44 | 000,272,232 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010.10.19 16:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (MEI) Intel(R)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.11.18 00:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009.11.18 00:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009.02.15 23:10:26 | 000,353,672 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2008.11.17 02:24:00 | 000,051,688 | ---- | M] (Check Point Software Technologies LTD) [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 8D B3 45 C2 B5 CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.22 19:23:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.12.21 15:41:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2012.01.22 19:23:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mustermann\Application Data\Mozilla\Extensions
[2012.01.23 14:35:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mustermann\Application Data\Mozilla\Firefox\Profiles\o76gy4nw.default\extensions
[2012.01.22 19:23:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.01.22 19:23:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions(2)
[2012.01.22 16:03:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions(2)\{972ce4c6-7e08-4474-a285-3208198ce6fd}(2)
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\RESTGERäUSCH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\O76GY4NW.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\RESTGERäUSCH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\O76GY4NW.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2011.12.28 13:57:18 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
 
O1 HOSTS File: ([2008.04.14 12:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9BB3E126-83DC-4F45-ACB2-76C53F2377FF}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.12.08 16:21:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell - "" = AutoRun
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell\AutoRun\command - "" = H:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} -
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.23 17:10:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Sun
[2012.01.23 16:34:38 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
[2012.01.23 16:11:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.01.23 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.01.23 16:03:05 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.01.23 15:45:06 | 002,322,184 | ---- | C] (ESET) -- C:\Documents and Settings\mustermann\Desktop\esetsmartinstaller_enu.exe
[2012.01.23 15:45:06 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\TFC.exe
[2012.01.23 15:45:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Desktop\JavaRa
[2012.01.22 22:49:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ZoneLabs
[2012.01.22 22:49:52 | 000,000,000 | ---D | C] -- C:\Program Files\Zone Labs
[2012.01.22 22:49:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2012.01.22 22:21:14 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.22 19:24:31 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\mustermann\Recent
[2012.01.22 19:23:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Mozilla
[2012.01.22 17:11:15 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012.01.22 16:03:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Mozilla(2)
[2012.01.22 14:46:15 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.01.21 14:36:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Identities
[2012.01.21 14:25:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Business
[2012.01.12 13:34:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Desktop\Kulturwerk Halle NEUN
[2012.01.07 18:21:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Music
[2012.01.07 18:20:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Start Menu\Programs\Music
[2012.01.06 16:02:37 | 000,700,416 | ---- | C] (MAGIX AG) -- C:\WINDOWS\System32\mgxoschk.dll
[2012.01.06 16:02:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MAGIX
[2012.01.06 15:56:55 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mustermann\My Documents\My Videos
[2012.01.06 15:56:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\MAGIX
[2012.01.06 15:55:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Xara
[2012.01.06 15:55:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MAGIX Shared
[2012.01.06 15:54:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2012.01.06 15:54:48 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MAGIX Services
[2012.01.05 19:18:34 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mustermann\Start Menu\Programs\Administrative Tools
[2012.01.05 19:16:36 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012.01.05 16:26:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\My Music
[2012.01.04 17:44:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Native Instruments
[2012.01.04 17:44:14 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{E648CD4D-3307-4213-89B2-9C0E20C77202}
[2012.01.04 17:43:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments
[2012.01.04 17:43:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012.01.04 15:31:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2012.01.03 01:29:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Traktor3
[2012.01.03 01:29:26 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments
[2011.12.28 18:55:24 | 000,000,000 | ---D | C] -- C:\Program Files\Bethesda Softworks
[2011.12.28 18:55:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Oblivion
[2011.12.28 15:30:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Nero
[2011.12.28 15:27:52 | 000,000,000 | ---D | C] -- C:\Program Files\Nero
[2011.12.28 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero
[2011.12.28 15:27:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Nero
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.24 14:02:45 | 000,350,197 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.01.24 14:02:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.24 14:01:54 | 001,120,356 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2012.01.24 13:58:58 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini
[2012.01.23 17:04:02 | 000,000,040 | ---- | M] () -- C:\Documents and Settings\mustermann\defogger_reenable
[2012.01.23 16:06:45 | 000,392,626 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.01.23 16:06:45 | 000,058,800 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.01.23 16:06:43 | 000,000,041 | ---- | M] () -- C:\WINDOWS\System32\Filzip.ini
[2012.01.23 15:44:30 | 002,322,184 | ---- | M] (ESET) -- C:\Documents and Settings\mustermann\Desktop\esetsmartinstaller_enu.exe
[2012.01.23 15:43:51 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\TFC.exe
[2012.01.22 22:46:13 | 000,004,212 | RH-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2012.01.22 19:26:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.22 16:35:21 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\b8uwvl8q.exe
[2012.01.22 16:30:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
[2012.01.22 16:26:15 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\Defogger.exe
[2012.01.22 15:47:00 | 000,224,365 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\bookmarks-2012-01-22.json
[2012.01.21 15:56:49 | 000,223,252 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090367.pdf
[2012.01.21 15:55:11 | 000,223,435 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090366.pdf
[2012.01.21 15:54:15 | 000,224,278 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090365.pdf
[2012.01.12 13:32:52 | 000,226,437 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\Kulturwerk9 technisches Personal.odt
[2012.01.09 17:43:56 | 000,011,640 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.01.09 16:43:30 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\mustermann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.09 14:38:53 | 000,223,368 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090363.pdf
[2012.01.08 18:06:21 | 000,223,434 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090364.pdf
[2012.01.06 17:11:21 | 001,493,584 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.01.03 01:25:49 | 000,000,023 | ---- | M] () -- C:\WINDOWS\BlendSettings.ini
[2012.01.01 17:35:50 | 000,023,518 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\skyrim.odt
[2011.12.29 16:11:21 | 000,225,347 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Angebot Nr.2009032416.pdf
[2011.12.28 18:58:14 | 000,000,032 | ---- | M] () -- C:\WINDOWS\CD_Start.INI
 
========== Files Created - No Company Name ==========
 
[2012.01.23 17:01:28 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\b8uwvl8q.exe
[2012.01.23 17:00:29 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\Defogger.exe
[2012.01.23 16:06:43 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini
[2012.01.22 22:50:00 | 000,004,212 | RH-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2012.01.22 22:49:51 | 000,350,197 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.01.22 16:26:46 | 000,000,040 | ---- | C] () -- C:\Documents and Settings\mustermann\defogger_reenable
[2012.01.22 15:47:00 | 000,224,365 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\bookmarks-2012-01-22.json
[2012.01.22 14:25:32 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\mustermann\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012.01.21 15:56:45 | 000,223,252 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090367.pdf
[2012.01.21 15:55:07 | 000,223,435 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090366.pdf
[2012.01.21 15:54:11 | 000,224,278 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090365.pdf
[2012.01.08 18:06:18 | 000,223,434 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090364.pdf
[2012.01.08 18:05:32 | 000,223,368 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090363.pdf
[2012.01.06 16:02:37 | 000,007,103 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2012.01.05 19:16:54 | 000,011,640 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.01.03 00:59:42 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2012.01.01 17:09:54 | 000,023,518 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\skyrim.odt
[2011.12.29 15:56:37 | 000,225,347 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Angebot Nr.2009032416.pdf
[2011.12.28 18:58:13 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011.12.14 10:57:48 | 000,033,533 | ---- | C] () -- C:\WINDOWS\System32\CoreVorbis-uninstall.exe
[2011.12.14 10:54:10 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011.12.14 10:51:01 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2011.12.14 10:46:29 | 000,007,680 | ---- | C] () -- C:\Documents and Settings\mustermann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.10 03:22:41 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI
[2011.12.09 00:51:45 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.12.08 17:21:27 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini
[2011.12.08 17:13:57 | 000,123,139 | ---- | C] () -- C:\WINDOWS\HPHins12.dat
[2011.12.08 17:13:57 | 000,014,916 | ---- | C] () -- C:\WINDOWS\hphmdl12.dat
[2011.12.08 17:13:55 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2011.12.08 17:13:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.12.08 17:12:33 | 001,493,584 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.12.08 16:39:42 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\drivers\IntelMEFWVer.dll
[2011.12.08 16:39:01 | 000,081,936 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2011.12.08 16:36:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011.12.08 16:36:15 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011.12.08 16:36:15 | 000,242,430 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.12.08 16:36:15 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011.12.08 16:23:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.12.08 16:19:32 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011.11.09 14:12:01 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\FontReg.exe
[2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\OVDecoder.dll
[2008.04.14 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 12:00:00 | 000,392,626 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 12:00:00 | 000,058,800 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008.03.01 20:18:37 | 000,244,224 | ---- | C] () -- C:\WINDOWS\System32\gc.dll
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
 
========== LOP Check ==========
 
[2011.12.09 01:42:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications
[2011.12.12 13:57:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Buhl Data Service GmbH
[2012.01.21 16:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2012.01.04 17:43:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2011.12.11 22:24:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ubisoft
[2012.01.04 17:44:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{E648CD4D-3307-4213-89B2-9C0E20C77202}
[2011.12.12 13:57:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Buhl Data Service
[2011.12.12 14:12:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Buhl Data Service GmbH
[2011.12.15 22:49:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Foxit Software
[2012.01.06 15:56:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\MAGIX
[2011.12.08 18:34:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\OpenOffice.org
[2011.12.08 17:17:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Thunderbird
[2011.12.11 22:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Ubisoft
[2012.01.23 14:57:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\uTorrent
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.12.08 17:09:38 | 000,000,000 | ---D | M] -- C:\ATI
[2011.12.09 23:13:57 | 000,000,000 | RHSD | M] -- C:\cmdcons
[2012.01.23 16:11:46 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2012.01.21 13:19:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings
[2011.12.08 16:28:31 | 000,000,000 | ---D | M] -- C:\Intel
[2012.01.23 16:18:15 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.09 21:57:39 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011.12.08 16:24:01 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.01.23 16:18:13 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2011.11.09 14:09:43 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\system32\dllcache\afd.sys
[2011.11.09 14:09:43 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\system32\drivers\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.11.09 14:09:57 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\explorer.exe
[2011.11.09 14:09:57 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: IPSEC.SYS  >
[2008.04.14 12:00:00 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\dllcache\ipsec.sys
[2008.04.14 12:00:00 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys
 
< MD5 for: REGEDIT.EXE  >
[2008.04.14 12:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) MD5=058710B720282CA82B909912D3EF28DB -- C:\WINDOWS\regedit.exe
[2008.04.14 12:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) MD5=058710B720282CA82B909912D3EF28DB -- C:\WINDOWS\system32\dllcache\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 12:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008.04.14 12:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2011.11.09 14:11:37 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=53A8857723277B1D6D5EE60A9F85B117 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2011.11.09 14:11:37 | 000,509,440 | ---- | M] (Microsoft Corporation) MD5=53A8857723277B1D6D5EE60A9F85B117 -- C:\WINDOWS\system32\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011.11.09 14:11:35 | 001,867,904 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
--- --- ---

Im Anhang Gmer und disfogger Logfiles...

Grüße

Cananga

kira 24.01.2012 16:04
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Hast du den Rechner bereits auf Viren überprüft? Folgende Ergebnisse möchte ich noch sehen:
Code:
Malwarebytes
(alle vorhandenen Protokolle!)
2.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell - "" = AutoRun
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\Shell\AutoRun\command - "" = H:\autorun.exe

:Commands
[purity]
[emptytemp]

3.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

4.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

5.
Lade dir von hier -> TrendMicro™ HijackThis™/Version 2.0.4 herunter
Zitat:
Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen" (musst du im Forum eingeloggt sein!)
Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

cananga 24.01.2012 16:40
Hallo!
OTL Datei nach Fix.
Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29743724-2355-11e1-ad28-50e5495586a9}\ not found.
File H:\autorun.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes
 
User: Restgeräusch
->Temp folder emptied: 98304 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->FireFox cache emptied: 44306710 bytes
->Flash cache emptied: 456 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 256 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 42,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 01242012_163358

Files\Folders moved on Reboot...
C:\Documents and Settings\Restgeräusch\Local Settings\Temp\~DF3A97.tmp moved successfully.
File\Folder C:\WINDOWS\temp\ZLT02a45.TMP not found!

Registry entries deleted on Reboot...
Malware logs :
10.12.2011:
Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8347

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.12.2011 15:15:32
mbam-log-2011-12-10 (15-15-32).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 164499
Laufzeit: 1 Minute(n), 0 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
22.01.2012 #1
Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.22.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Restgeräusch :: HAL9000 [Administrator]

Schutz: Deaktiviert

22.01.2012 14:46:57
mbam-log-2012-01-22 (14-46-57).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 176390
Laufzeit: 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 7
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
22.01.2012 #2
Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.22.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Restgeräusch :: HAL9000 [Administrator]

Schutz: Deaktiviert

22.01.2012 14:48:58
mbam-log-2012-01-22 (14-48-58).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 176389
Laufzeit: 29 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
22.01.2012 #3
Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2011.12.24.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Restgeräusch :: HAL9000 [Administrator]

Schutz: Deaktiviert

22.01.2012 22:21:40
mbam-log-2012-01-22 (22-21-40).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 208987
Laufzeit: 7 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hier der Ccleaner text:
Code:
AC3Filter (remove only)                24.01.2012               
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        24.01.2012                11.1.102.55
AMD Catalyst Install Manager        Advanced Micro Devices, Inc.        11.12.2011        16,9MB        3.0.851.0
Application Profiles        Ihr Firmenname        11.12.2011        0,34MB        2.0.4331.36041
Arma Cold War Assault Uninstall                24.01.2012               
ArmA Uninstall                24.01.2012               
Assassin's Creed        Ubisoft        11.12.2011                1.00
Avira Free Antivirus        Avira        24.01.2012                12.0.0.872
CCleaner        Piriform        24.01.2012                3.13
Core AAC Decoder (remove only)                24.01.2012               
CoreVorbis Audio Decoder (remove only)                24.01.2012               
Etron USB3.0 Host Controller        Etron Technology        08.12.2011                0.105
ffdshow v1.1.3984 [2011-09-22]                14.12.2011                1.1.3984.0
Filzip 3.06        Philipp Engel        22.01.2012                3.0.6
Foxit Reader 5.1        Foxit Corporation        21.01.2012                5.1.4.104
HiJackThis        Trend Micro        09.12.2011        0,36MB        1.0.0
HP Imaging Device Functions 7.0        HP        24.01.2012                7.0
HP Photosmart and Deskjet 7.0 Software        HP        24.01.2012                7.1
Intel(R) Management Engine Components        Intel Corporation        24.01.2012                7.0.0.1144
Java(TM) 6 Update 22        Oracle        08.12.2011        97,1MB        6.0.220
Java(TM) 7 Update 2        Oracle        23.01.2012        99,1MB        7.0.20
Malwarebytes Anti-Malware Version 1.60.0.1800        Malwarebytes Corporation        22.01.2012                1.60.0.1800
Mein Büro        Buhl Data Service GmbH        21.01.2012                11.0
Microsoft .NET Framework 2.0        Microsoft Corporation        08.12.2011               
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        13.12.2011        5,25MB        8.0.59193
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        06.01.2012        9,64MB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        08.12.2011        10,2MB        9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        09.12.2011        11,1MB        10.0.40219
Mozilla Firefox 9.0.1 (x86 de)        Mozilla        24.01.2012                9.0.1
Mozilla Thunderbird (8.0)        Mozilla        24.01.2012                8.0 (de)
Nero 9 Essentials        Nero AG        28.12.2011               
NVIDIA PhysX        NVIDIA Corporation        13.12.2011        73,8MB        9.10.0223
O&O Defrag Professional        O&O Software GmbH        10.12.2011        38,2MB        14.1.431
Oblivion        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Horse Armor Pack        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Knights of the Nine        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Mehrunes Razor        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Orrery        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Spell Tomes        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Thieves Den        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Vile Lair        Bethesda Softworks        28.12.2011                1.00.0000
Oblivion - Wizard's Tower        Bethesda Softworks        28.12.2011                1.00.0000
OpenAL                24.01.2012               
OpenOffice.org 3.3        OpenOffice.org        08.12.2011        413MB        3.3.9567
OpenSource MP4 Splitter (remove only)                24.01.2012               
OpenSource MPEG Splitter (remove only)                24.01.2012               
OpenSource MPEG2 Video Decoder (remove only)                24.01.2012               
Operation Flashpoint uninstall                24.01.2012               
QuickTime        Apple Inc.        21.12.2011        73,3MB        7.71.80.42
REALTEK GbE & FE Ethernet PCI-E NIC Driver        Realtek        08.12.2011                1.30.0000
Realtek HDMI Audio Driver for ATI        Realtek Semiconductor Corp.        24.01.2012                5.10.0.6409
Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        08.12.2011                5.10.0.6449
SopCast 3.4.7        www.sopcast.com        24.01.2012                3.4.7
Spybot - Search & Destroy        Safer Networking Limited        12.12.2011                1.6.2
ZoneAlarm Pro        Check Point, Inc        24.01.2012                8.0.298.000
Zoom Player (remove only)                24.01.2012               
µTorrent                24.01.2012                3.0.0
Hier das neue OLT Logfile:
OTL Logfile:
Code:
OTL logfile created on: 24.01.2012 16:49:39 - Run 5
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Documents and Settings\mustermann\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3,49 Gb Total Physical Memory | 2,92 Gb Available Physical Memory | 83,57% Memory free
8,57 Gb Paging File | 8,05 Gb Available in Paging File | 94,01% Paging File free
Paging file location(s): C:\pagefile.sys 5362 5362 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 101,16 Gb Total Space | 55,65 Gb Free Space | 55,01% Space Free | Partition Type: NTFS
Drive D: | 263,25 Gb Total Space | 211,98 Gb Free Space | 80,52% Space Free | Partition Type: NTFS
Drive E: | 101,35 Gb Total Space | 61,38 Gb Free Space | 60,56% Space Free | Partition Type: NTFS
Drive G: | 38,57 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: FAT32
 
Computer Name: HAL9000 | User Name: mustermann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.22 16:30:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
PRC - [2011.12.28 13:57:17 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.11.22 14:20:33 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.11.22 14:20:17 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.11.22 14:20:04 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.11.22 14:20:04 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.11.09 14:09:57 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009.02.15 23:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009.02.15 23:10:22 | 000,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.12.28 13:57:17 | 002,124,760 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011.11.22 14:20:19 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2004.09.08 13:45:58 | 000,368,128 | ---- | M] () -- C:\Program Files\Filzip\fzshext.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Disabled | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.11.22 14:20:17 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.11.22 14:20:04 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.01.25 11:41:12 | 002,398,536 | ---- | M] (O&O Software GmbH) [On_Demand | Stopped] -- C:\Program Files\OO Software\Defrag\oodag.exe -- (OODefragAgent)
SRV - [2009.02.15 23:10:22 | 002,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2006.03.03 21:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.19 14:12:00 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011.12.10 18:29:50 | 000,722,416 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.11.22 14:20:32 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.11.22 14:20:32 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.11.22 14:20:32 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.11.09 14:22:25 | 000,005,632 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mv64xxmm.sys -- (mv64xxmm)
DRV - [2011.11.09 14:22:24 | 000,013,616 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mvxxmm.sys -- (mvxxmm)
DRV - [2011.11.09 14:22:24 | 000,013,616 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\mv61xxmm.sys -- (mv61xxmm)
DRV - [2011.10.26 04:01:40 | 007,412,736 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2011.08.30 10:28:46 | 006,435,432 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2011.08.17 11:18:00 | 000,064,896 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EtronXHCI.sys -- (EtronXHCI)
DRV - [2011.08.17 11:18:00 | 000,045,056 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EtronHub3.sys -- (EtronHub3)
DRV - [2011.08.05 18:24:24 | 000,068,208 | ---- | M] (MOTU, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mawwave.sys -- (MAWWAVE)
DRV - [2011.08.05 18:24:22 | 000,348,272 | ---- | M] (MOTU, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motuaw.sys -- (motuaw)
DRV - [2011.07.06 11:16:08 | 004,137,960 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtKHDMI.sys -- (RTHDMIAzAudService)
DRV - [2010.10.28 15:58:44 | 000,272,232 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010.10.19 16:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HECI.sys -- (MEI) Intel(R)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.11.18 00:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009.11.18 00:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009.02.15 23:10:26 | 000,353,672 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2008.11.17 02:24:00 | 000,051,688 | ---- | M] (Check Point Software Technologies LTD) [Kernel | Boot | Running] -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 8D B3 45 C2 B5 CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.22 19:23:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.12.21 15:41:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2012.01.22 19:23:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mustermann\Application Data\Mozilla\Extensions
[2012.01.23 14:35:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mustermann\Application Data\Mozilla\Firefox\Profiles\o76gy4nw.default\extensions
[2012.01.22 19:23:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.01.22 19:23:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions(2)
[2012.01.22 16:03:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions(2)\{972ce4c6-7e08-4474-a285-3208198ce6fd}(2)
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\RESTGERäUSCH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\O76GY4NW.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\RESTGERäUSCH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\O76GY4NW.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2011.12.28 13:57:18 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
 
O1 HOSTS File: ([2008.04.14 12:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9BB3E126-83DC-4F45-ACB2-76C53F2377FF}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.12.08 16:21:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.24 16:33:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.01.24 16:32:07 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012.01.24 16:23:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012.01.24 15:32:18 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012.01.24 15:32:18 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012.01.24 15:32:18 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012.01.24 15:32:18 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012.01.24 15:31:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012.01.24 15:31:02 | 000,000,000 | ---D | C] -- C:\Cofi
[2012.01.24 15:29:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.01.24 15:25:38 | 004,388,468 | R--- | C] (Swearware) -- C:\Documents and Settings\mustermann\Desktop\Cofi.exe
[2012.01.24 14:15:45 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\mustermann\Recent
[2012.01.23 17:10:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Sun
[2012.01.23 16:34:38 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
[2012.01.23 16:11:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.01.23 16:11:20 | 000,637,848 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.01.23 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.01.23 16:03:05 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.01.23 15:45:06 | 002,322,184 | ---- | C] (ESET) -- C:\Documents and Settings\mustermann\Desktop\esetsmartinstaller_enu.exe
[2012.01.23 15:45:06 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\TFC.exe
[2012.01.23 15:45:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Desktop\JavaRa
[2012.01.22 22:49:57 | 000,058,248 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsregexp.dll
[2012.01.22 22:49:56 | 000,103,816 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\zlcommdb.dll
[2012.01.22 22:49:56 | 000,069,000 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\zlcomm.dll
[2012.01.22 22:49:53 | 000,035,208 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vswmi.dll
[2012.01.22 22:49:52 | 001,221,512 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\zpeng25.dll
[2012.01.22 22:49:52 | 000,309,128 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vspubapi.dll
[2012.01.22 22:49:52 | 000,109,960 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsxml.dll
[2012.01.22 22:49:52 | 000,107,912 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsmonapi.dll
[2012.01.22 22:49:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ZoneLabs
[2012.01.22 22:49:52 | 000,000,000 | ---D | C] -- C:\Program Files\Zone Labs
[2012.01.22 22:49:51 | 000,353,672 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsdatant.sys
[2012.01.22 22:49:32 | 000,482,184 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsutil.dll
[2012.01.22 22:49:32 | 000,229,256 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsinit.dll
[2012.01.22 22:49:32 | 000,110,472 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsdata.dll
[2012.01.22 22:49:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2012.01.22 22:21:14 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.01.22 19:23:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Mozilla
[2012.01.22 17:11:15 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012.01.22 16:03:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Mozilla(2)
[2012.01.22 14:46:15 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.01.21 14:36:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Identities
[2012.01.21 14:25:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Business
[2012.01.12 13:34:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Desktop\Kulturwerk Halle NEUN
[2012.01.07 18:21:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Music
[2012.01.07 18:20:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Start Menu\Programs\Music
[2012.01.06 16:02:37 | 000,700,416 | ---- | C] (MAGIX AG) -- C:\WINDOWS\System32\mgxoschk.dll
[2012.01.06 16:02:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MAGIX
[2012.01.06 15:56:55 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mustermann\My Documents\My Videos
[2012.01.06 15:56:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\MAGIX
[2012.01.06 15:55:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Xara
[2012.01.06 15:55:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MAGIX Shared
[2012.01.06 15:54:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2012.01.06 15:54:48 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MAGIX Services
[2012.01.05 19:18:34 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mustermann\Start Menu\Programs\Administrative Tools
[2012.01.05 19:16:36 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012.01.05 16:26:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\My Music
[2012.01.04 17:44:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Native Instruments
[2012.01.04 17:44:14 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{E648CD4D-3307-4213-89B2-9C0E20C77202}
[2012.01.04 17:43:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments
[2012.01.04 17:43:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012.01.04 15:31:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2012.01.04 15:21:45 | 000,158,512 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxDrv.sys
[2012.01.04 15:21:40 | 000,091,440 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys
[2012.01.03 01:29:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\My Documents\Traktor3
[2012.01.03 01:29:26 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments
[2011.12.28 18:55:24 | 000,000,000 | ---D | C] -- C:\Program Files\Bethesda Softworks
[2011.12.28 18:55:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Local Settings\Application Data\Oblivion
[2011.12.28 15:30:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mustermann\Application Data\Nero
[2011.12.28 15:27:52 | 000,000,000 | ---D | C] -- C:\Program Files\Nero
[2011.12.28 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero
[2011.12.28 15:27:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Nero
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.24 16:47:20 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini
[2012.01.24 16:35:50 | 000,350,197 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.01.24 16:35:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.01.24 16:35:16 | 001,125,460 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2012.01.24 15:25:45 | 004,388,468 | R--- | M] (Swearware) -- C:\Documents and Settings\mustermann\Desktop\Cofi.exe
[2012.01.24 14:19:31 | 000,000,738 | ---- | M] () -- C:\Documents and Settings\mustermann\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012.01.23 17:04:02 | 000,000,040 | ---- | M] () -- C:\Documents and Settings\mustermann\defogger_reenable
[2012.01.23 16:11:09 | 000,637,848 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012.01.23 16:11:09 | 000,567,184 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012.01.23 16:11:09 | 000,223,112 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012.01.23 16:11:09 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012.01.23 16:11:09 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012.01.23 16:11:09 | 000,141,312 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012.01.23 16:06:45 | 000,392,626 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.01.23 16:06:45 | 000,058,800 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.01.23 16:06:43 | 000,000,041 | ---- | M] () -- C:\WINDOWS\System32\Filzip.ini
[2012.01.23 15:44:30 | 002,322,184 | ---- | M] (ESET) -- C:\Documents and Settings\mustermann\Desktop\esetsmartinstaller_enu.exe
[2012.01.23 15:43:51 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\TFC.exe
[2012.01.22 22:46:13 | 000,004,212 | RH-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2012.01.22 19:26:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.01.22 16:35:21 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\b8uwvl8q.exe
[2012.01.22 16:30:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mustermann\Desktop\OTL.exe
[2012.01.22 16:26:15 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\Defogger.exe
[2012.01.22 15:47:00 | 000,224,365 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\bookmarks-2012-01-22.json
[2012.01.21 15:56:49 | 000,223,252 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090367.pdf
[2012.01.21 15:55:11 | 000,223,435 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090366.pdf
[2012.01.21 15:54:15 | 000,224,278 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090365.pdf
[2012.01.12 13:32:52 | 000,226,437 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\Kulturwerk9 technisches Personal.odt
[2012.01.09 17:43:56 | 000,011,640 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.01.09 16:43:30 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\mustermann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.09 14:38:53 | 000,223,368 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090363.pdf
[2012.01.08 18:06:21 | 000,223,434 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090364.pdf
[2012.01.06 17:11:21 | 001,493,584 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.01.03 01:25:49 | 000,000,023 | ---- | M] () -- C:\WINDOWS\BlendSettings.ini
[2012.01.01 17:35:50 | 000,023,518 | ---- | M] () -- C:\Documents and Settings\mustermann\Desktop\skyrim.odt
[2011.12.29 16:11:21 | 000,225,347 | ---- | M] () -- C:\Documents and Settings\mustermann\My Documents\Angebot Nr.2009032416.pdf
[2011.12.28 18:58:14 | 000,000,032 | ---- | M] () -- C:\WINDOWS\CD_Start.INI
 
========== Files Created - No Company Name ==========
 
[2012.01.24 15:32:18 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012.01.24 15:32:18 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012.01.24 15:32:18 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012.01.24 15:32:18 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012.01.24 15:32:18 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012.01.24 14:19:31 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\mustermann\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012.01.23 17:01:28 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\b8uwvl8q.exe
[2012.01.23 17:00:29 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\Defogger.exe
[2012.01.23 16:06:43 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini
[2012.01.22 22:50:00 | 000,004,212 | RH-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2012.01.22 22:49:51 | 000,350,197 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml
[2012.01.22 16:26:46 | 000,000,040 | ---- | C] () -- C:\Documents and Settings\mustermann\defogger_reenable
[2012.01.22 15:47:00 | 000,224,365 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\bookmarks-2012-01-22.json
[2012.01.22 14:25:32 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\mustermann\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012.01.21 15:56:45 | 000,223,252 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090367.pdf
[2012.01.21 15:55:07 | 000,223,435 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090366.pdf
[2012.01.21 15:54:11 | 000,224,278 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090365.pdf
[2012.01.08 18:06:18 | 000,223,434 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090364.pdf
[2012.01.08 18:05:32 | 000,223,368 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Rechnung Nr.2009090363.pdf
[2012.01.06 16:02:37 | 000,007,103 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2012.01.05 19:16:54 | 000,011,640 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012.01.03 00:59:42 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2012.01.01 17:09:54 | 000,023,518 | ---- | C] () -- C:\Documents and Settings\mustermann\Desktop\skyrim.odt
[2011.12.29 15:56:37 | 000,225,347 | ---- | C] () -- C:\Documents and Settings\mustermann\My Documents\Angebot Nr.2009032416.pdf
[2011.12.28 18:58:13 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011.12.14 10:57:48 | 000,033,533 | ---- | C] () -- C:\WINDOWS\System32\CoreVorbis-uninstall.exe
[2011.12.14 10:54:10 | 000,074,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011.12.14 10:51:01 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2011.12.14 10:46:29 | 000,007,680 | ---- | C] () -- C:\Documents and Settings\mustermann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.10 03:22:41 | 000,000,042 | ---- | C] () -- C:\WINDOWS\oodjobd.INI
[2011.12.09 00:51:45 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2011.12.08 17:21:27 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini
[2011.12.08 17:13:57 | 000,123,139 | ---- | C] () -- C:\WINDOWS\HPHins12.dat
[2011.12.08 17:13:57 | 000,014,916 | ---- | C] () -- C:\WINDOWS\hphmdl12.dat
[2011.12.08 17:13:55 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2011.12.08 17:13:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.12.08 17:12:33 | 001,493,584 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.12.08 16:39:42 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\drivers\IntelMEFWVer.dll
[2011.12.08 16:39:01 | 000,081,936 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2011.12.08 16:36:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011.12.08 16:36:15 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011.12.08 16:36:15 | 000,242,430 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.12.08 16:36:15 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011.12.08 16:23:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.12.08 16:19:32 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011.11.09 14:12:01 | 000,006,144 | ---- | C] () -- C:\WINDOWS\System32\FontReg.exe
[2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\OVDecoder.dll
[2008.04.14 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008.04.14 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008.04.14 12:00:00 | 000,392,626 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008.04.14 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008.04.14 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008.04.14 12:00:00 | 000,058,800 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008.04.14 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008.04.14 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008.04.14 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008.04.14 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008.04.14 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008.04.14 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008.03.01 20:18:37 | 000,244,224 | ---- | C] () -- C:\WINDOWS\System32\gc.dll
[2007.04.27 09:43:58 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
 
========== LOP Check ==========
 
[2011.12.09 01:42:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications
[2011.12.12 13:57:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Buhl Data Service GmbH
[2012.01.21 16:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MAGIX
[2012.01.04 17:43:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2011.12.11 22:24:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ubisoft
[2012.01.24 14:14:17 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{E648CD4D-3307-4213-89B2-9C0E20C77202}
[2011.12.12 13:57:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Buhl Data Service
[2011.12.12 14:12:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Buhl Data Service GmbH
[2011.12.15 22:49:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Foxit Software
[2012.01.06 15:56:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\MAGIX
[2011.12.08 18:34:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\OpenOffice.org
[2011.12.08 17:17:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Thunderbird
[2011.12.11 22:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\Ubisoft
[2012.01.24 14:15:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mustermann\Application Data\uTorrent
 
========== Purity Check ==========
 
 

< End of report >
HiJack Report:
[code]
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:55:50, on 24.01.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 SP3 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag Agent (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 3496 bytes
--- --- ---


Danke!
Cananga

kira 25.01.2012 11:43
frage ich mich, wozu braucht man dann ZoneAlarm, zahlst auch noch für...?:pfeiff:


1.
Hast du den Rechner bereits auf Viren überprüft? Folgende Ergebnisse möchte ich noch sehen:
Code:
C:\Qoobox
oder C:\ComboFix.txt
(alle vorhandenen Protokolle!)
2.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

:Commands
[purity]
[emptytemp]

3.
reinige dein System mit CCleaner:
  • "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

4.
TDSSKiller von Kaspersky
  • Lade den TDSSKiller und entpacke das Archiv auf Deinen Desktop.
  • Vergewissere Dich, dass die TDSSKiller.exe direkt auf dem Desktop liegt (nicht in einem Ordner auf dem Desktop).
  • deaktiviere vorübergehend dein AntiVirus-Programm
  • Starte die TDSSKiller.exe durch Doppelklick.
  • Nach Beendigung der Arbeit schlägt das Tool vor, das System neu zu starten.
    Bestätige das ggfs. mit Y(es).
    Beim Hochfahren des Systems führt der Treiber alle geplanten Operationen aus löscht sich danach.
  • Poste mir den Inhalt von C:\TDSSKiller<random>.txt hier in den Thread.
Hier findest Du eine ausführlichere Anleitung.

5.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:38 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131