Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Google/Yahoo Weiterleitung über thealltimes.com (https://www.trojaner-board.de/109220-google-yahoo-weiterleitung-thealltimes-com.html)

TuxedoMask20 06.02.2012 14:27

Google/Yahoo Weiterleitung über thealltimes.com
 
Hi,
ein Kumpel von mir hat sich auf seinem Laptop etwas eingefangen, dass ihn bei der google.de oder yahoo.de website immer über thealltimes.com wo anderst hin umleitet. Auch die Wiederherstellung wurde deaktiviert. Das Windows Security Center ebenfalls. Ein manueller Start in den Prozessen ist nicht mehr möglich.

Platte wurde mit GDATA Antivir 2012 BootCD und dem Avira Antivir gescanned. Ohne Fund.

Spybot findet nur die Tatsache, dass das Security Center deaktiviert ist, kann es aber nicht beheben.

Proxies sind keine eingestellt.

Temporäre Dateien und Cookies sind gelöscht.

Sowohl Firefox als auch iexplore sind betroffen.

Hier noch die Logs:
OCL:
OTL Logfile:
Code:

OTL logfile created on: 06.02.2012 14:01:12 - Run 3
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Julian\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,27% Memory free
8,00 Gb Paging File | 6,45 Gb Available in Paging File | 80,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,04 Gb Total Space | 111,89 Gb Free Space | 75,07% Space Free | Partition Type: NTFS
Drive D: | 149,04 Gb Total Space | 4,44 Gb Free Space | 2,98% Space Free | Partition Type: NTFS
Drive E: | 136,35 Gb Total Space | 136,21 Gb Free Space | 99,90% Space Free | Partition Type: NTFS
Drive F: | 149,04 Gb Total Space | 148,91 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
Drive H: | 12,69 Gb Total Space | 12,59 Gb Free Space | 99,18% Space Free | Partition Type: NTFS
 
Computer Name: JULIAN-PC | User Name: Julian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.05 23:49:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Julian\Downloads\OTL.exe
PRC - [2012.01.29 17:12:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.12.27 23:21:08 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.11.20 13:17:56 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010.05.04 11:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.29 17:12:47 | 001,911,768 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.10.15 00:54:26 | 000,265,536 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010.05.04 11:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.09.23 21:59:36 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- D:\Programme\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.12.08 05:22:38 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2011.12.08 05:22:38 | 000,098,616 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.05 02:25:15 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.21 00:48:32 | 000,274,480 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) Brother MFC Serial Interface Driver(WDM)
DRV:64bit: - [2009.06.25 16:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009.06.25 15:38:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2009.06.25 15:13:44 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2009.06.10 21:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) Brother MFC Serial USB Driver(WDM)
DRV:64bit: - [2009.06.10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.22 21:52:30 | 000,215,040 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D1 BA D1 14 15 E4 CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..network.proxy.type: 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.06 10:36:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2010.07.05 00:17:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Extensions
[2012.02.05 17:13:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\yjc1fxga.default\extensions
[2012.02.05 17:13:25 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\yjc1fxga.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012.02.06 10:36:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\JULIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJC1FXGA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.02.06 10:14:09 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4:64bit: - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.177 217.0.43.161
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66D8168D-7F18-4E5F-BE8B-A427574AE81E}: DhcpNameServer = 217.0.43.177 217.0.43.161
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CDA2650D-3986-43EF-B15B-A0B920F58248}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.06 13:38:45 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.02.06 13:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UBCD4Win
[2012.02.06 13:13:15 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\Malwarebekämpfung
[2012.02.06 13:12:07 | 000,000,000 | ---D | C] -- C:\UBCD4Win
[2012.02.06 12:14:43 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.02.06 10:36:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.02.06 10:20:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.02.06 10:08:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.02.06 10:08:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.02.06 10:08:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.02.06 10:08:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.02.06 10:06:22 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.02.06 09:49:38 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012.02.05 17:20:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.02.05 17:20:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.02.05 17:20:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.02.05 17:13:32 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\QuickScan
[2012.02.05 16:59:45 | 000,000,000 | ---D | C] -- C:\Users\Julian\SmitfraudFix
[2012.02.05 16:56:55 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\backups
[2012.02.05 16:44:52 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\SmitfraudFix
[2012.02.05 14:55:52 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Avira
[2012.02.05 14:35:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.02.05 14:35:00 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.02.05 14:35:00 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.02.05 14:35:00 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.02.05 14:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.02.05 14:35:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.02.05 12:56:42 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Malwarebytes
[2012.02.05 12:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.05 12:56:37 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.05 12:56:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.05 12:56:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.03 11:55:20 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\LOL
[2012.01.31 17:50:15 | 000,000,000 | ---D | C] -- C:\Temp
[2012.01.31 17:47:00 | 000,203,320 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.01.31 17:47:00 | 000,098,616 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.01.31 17:40:35 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Samsung
[2012.01.31 17:40:25 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Samsung
[2012.01.31 17:40:23 | 000,000,000 | ---D | C] -- C:\Users\Julian\Documents\samsung
[2012.01.31 17:36:51 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2012.01.31 17:36:46 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012.01.31 17:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012.01.31 17:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2012.01.31 17:26:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2012.01.31 17:26:01 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung
[2012.01.31 17:25:27 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Downloaded Installations
[2012.01.30 20:11:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.01.30 20:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.01.30 20:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.01.20 21:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XSplit
[2012.01.20 21:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\SplitMediaLabs
[2012.01.20 21:29:17 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\SplitMediaLabs
[2012.01.15 17:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.01.15 17:21:49 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.01.15 17:21:49 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.06 13:47:49 | 000,021,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.06 13:47:49 | 000,021,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.06 13:44:53 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.06 13:44:53 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.06 13:44:53 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.06 13:44:53 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.06 13:44:53 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.06 13:40:28 | 000,000,316 | ---- | M] () -- C:\Windows\tasks\ctwb.job
[2012.02.06 13:40:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.06 13:40:17 | 3220,623,360 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.06 13:14:14 | 000,001,325 | ---- | M] () -- C:\Users\Public\Desktop\UBCD4Win.lnk
[2012.02.06 12:59:41 | 000,089,088 | ---- | M] () -- C:\Windows\SysNative\mbr.exe
[2012.02.06 10:36:02 | 000,001,064 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.06 10:29:19 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.02.06 10:14:09 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.02.04 17:06:36 | 000,122,880 | RHS- | M] () -- C:\Windows\SysWow64\ir41_qcxl.dll
[2012.02.04 13:15:25 | 000,533,993 | ---- | M] () -- C:\Users\Julian\Desktop\asdasd.jpg
[2012.02.04 02:09:32 | 009,809,512 | ---- | M] () -- C:\Users\Julian\Desktop\Skrillex & Katy Perry - E.T. (Bugzz Equinox Remix).mp3
[2012.02.04 01:40:18 | 012,207,611 | ---- | M] () -- C:\Users\Julian\Desktop\M.I.A - Paper Planes (Reload Beatz Dubstep Remix).mp3
[2012.01.31 18:11:39 | 014,599,212 | ---- | M] () -- C:\Users\Julian\Desktop\Pumped Up Kicks (Butch Clancy Remix).mp3
[2012.01.31 18:08:33 | 007,921,704 | ---- | M] () -- C:\Users\Julian\Desktop\Adele vs. Skrillex - Set Fire To Everybody.mp3
[2012.01.30 23:34:38 | 006,234,708 | ---- | M] () -- C:\Users\Julian\Desktop\The Way I Are (Timbaland Vs. Nephew) (Ft. Keri Hilson & D.O.E.).mp3
 
========== Files Created - No Company Name ==========
 
[2012.02.06 13:14:14 | 000,001,325 | ---- | C] () -- C:\Users\Public\Desktop\UBCD4Win.lnk
[2012.02.06 13:00:41 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\mbr.exe
[2012.02.06 10:36:02 | 000,001,076 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.06 10:36:02 | 000,001,064 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.06 10:08:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.02.06 10:08:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.02.06 10:08:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.02.06 10:08:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.02.06 10:08:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.02.04 17:06:36 | 000,122,880 | RHS- | C] () -- C:\Windows\SysWow64\ir41_qcxl.dll
[2012.02.04 17:06:36 | 000,000,316 | ---- | C] () -- C:\Windows\tasks\ctwb.job
[2012.02.04 13:15:25 | 000,533,993 | ---- | C] () -- C:\Users\Julian\Desktop\asdasd.jpg
[2012.02.04 02:08:59 | 009,809,512 | ---- | C] () -- C:\Users\Julian\Desktop\Skrillex & Katy Perry - E.T. (Bugzz Equinox Remix).mp3
[2012.02.04 01:37:47 | 012,207,611 | ---- | C] () -- C:\Users\Julian\Desktop\M.I.A - Paper Planes (Reload Beatz Dubstep Remix).mp3
[2012.01.30 23:34:21 | 006,234,708 | ---- | C] () -- C:\Users\Julian\Desktop\The Way I Are (Timbaland Vs. Nephew) (Ft. Keri Hilson & D.O.E.).mp3
[2012.01.30 23:25:07 | 007,921,704 | ---- | C] () -- C:\Users\Julian\Desktop\Adele vs. Skrillex - Set Fire To Everybody.mp3
[2012.01.30 23:16:27 | 014,599,212 | ---- | C] () -- C:\Users\Julian\Desktop\Pumped Up Kicks (Butch Clancy Remix).mp3
[2012.01.16 19:03:42 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011.12.23 20:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.12.23 20:58:24 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.12.23 20:58:24 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.12.23 20:58:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.12.23 20:58:24 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.11.13 10:46:44 | 000,251,629 | ---- | C] () -- C:\Windows\hpwins21.dat
[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.02.04 21:11:23 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.12.06 20:13:27 | 000,073,139 | ---- | C] () -- C:\Windows\War3Unin.dat
[2010.07.06 12:27:35 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.07.06 12:27:35 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7320.DAT
[2010.07.05 02:14:51 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010.07.05 02:14:51 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010.07.05 00:27:33 | 000,000,017 | ---- | C] () -- C:\Users\Julian\AppData\Local\resmon.resmoncfg
[2009.11.06 12:03:31 | 000,000,428 | ---- | C] () -- C:\Windows\hpwmdl21.dat
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2005.01.17 06:10:16 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2004.08.09 06:00:42 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
 
========== LOP Check ==========
 
[2010.07.05 09:16:27 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\LolClient
[2010.11.28 22:14:36 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\MobMapUpdater
[2010.08.21 12:13:06 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\OpenOffice.org
[2012.02.05 17:13:40 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\QuickScan
[2012.01.31 17:40:25 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Samsung
[2012.01.20 21:29:17 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\SplitMediaLabs
[2011.12.18 15:42:58 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\TS3Client
[2012.02.06 13:40:28 | 000,000,316 | ---- | M] () -- C:\Windows\Tasks\ctwb.job
[2011.12.28 23:09:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---


Log von Malwarebytes:
Zitat:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.06.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Julian :: JULIAN-PC [Administrator]

Schutz: Aktiviert

06.02.2012 14:01:47
mbam-log-2012-02-06 (14-01-47).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 94605
Laufzeit: 26 Minute(n), 42 Sekunde(n) [Abgebrochen]

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Und die Liste der installierten Programme aus CCleaner:
Zitat:

Adobe Reader 9.5.0 - Deutsch Adobe Systems Incorporated 15.01.2012 118,3MB 9.5.0
Adobe Shockwave Player 11.5 Adobe Systems, Inc. 02.10.2010 11.5.8.612
Apple Application Support Apple Inc. 22.12.2011 61,2MB 2.1.6
Apple Mobile Device Support Apple Inc. 08.12.2011 24,9MB 4.0.0.97
Apple Software Update Apple Inc. 03.07.2011 2,25MB 2.1.3.127
Avira Free Antivirus Avira 04.02.2012 108,9MB 12.0.0.872
CCleaner Piriform 05.02.2012 3.15
HP Imaging Device Functions 13.0 HP 12.11.2011 13.0
HP Officejet Pro 8000 A809 Series HP 12.11.2011 13.0
iTunes Apple Inc. 29.01.2012 172,5MB 10.5.3.3
Java(TM) 6 Update 21 (64-bit) Oracle 17.07.2010 90,5MB 6.0.210
Java(TM) 6 Update 26 Oracle 24.08.2010 94,9MB 6.0.260
Java(TM) SE Development Kit 6 Update 21 (64-bit) Oracle 17.07.2010 144,0MB 1.6.0.210
League of Legends Riot Games 06.04.2011 1.02.0000
Logitech GamePanel Software 3.05.151 Logitech Inc. 03.02.2011 74,3MB 3.05.151
Malwarebytes Anti-Malware Version 1.60.1.1000 Malwarebytes Corporation 04.02.2012 17,4MB 1.60.1.1000
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 11.02.2011 38,8MB 4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 11.02.2011 2,94MB 4.0.30319
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 23.01.2012 0,25MB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 04.07.2011 0,29MB 8.0.61001
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 Microsoft Corporation 13.07.2010 0,21MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 Microsoft Corporation 20.08.2010 1,71MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 11.07.2010 0,77MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 04.07.2011 0,77MB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 29.10.2010 0,58MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 04.07.2011 0,59MB 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 05.02.2012 12,3MB 10.0.40219
Miranda IM 0.9.39 24.12.2011
Mozilla Firefox 10.0 (x86 de) Mozilla 05.02.2012 35,5MB 10.0
Nero Burning ROM 10 Nero AG 19.08.2010 162,3MB 10.0.11000
Nero BurnRights 10 Nero AG 19.08.2010 6,42MB 4.0.11200.14.100
Nero Update Nero AG 19.08.2010 1,44MB 1.0.0018
NVIDIA 3D Vision Treiber 285.62 NVIDIA Corporation 14.01.2012 285.62
NVIDIA Grafiktreiber 285.62 NVIDIA Corporation 14.01.2012 285.62
NVIDIA PhysX-Systemsoftware 260.99 NVIDIA Corporation 17.12.2010 260.99
NVIDIA Update 1.5.20 NVIDIA Corporation 14.01.2012 1.5.20
OpenOffice.org 3.2 OpenOffice.org 20.08.2010 363MB 3.2.9502
QuickTime Apple Inc. 08.12.2011 73,3MB 7.71.80.42
Realtek 8136 8168 8169 Ethernet Driver Realtek 04.07.2010 1.00.0005
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 04.07.2010 6.0.1.5928
Samsung Kies Samsung Electronics Co., Ltd. 30.01.2012 205MB 2.1.1.11124_17
SAMSUNG USB Driver for Mobile Phones SAMSUNG Electronics Co., Ltd. 30.01.2012 42,8MB 1.4.103.0
Spybot - Search & Destroy Safer Networking Limited 04.02.2012 1.6.2
Synaptics Pointing Device Driver Synaptics Incorporated 04.07.2010 13.2.6.1
TeamSpeak 3 Client TeamSpeak Systems GmbH 11.07.2010
UBCD4Win 3.60 UBCD4Win Team - Benjamin Burrows 05.02.2012 603MB
Warcraft III 05.12.2010
Warcraft III: All Products 05.12.2010
WinRAR 12.11.2010
XSplit SplitMediaLabs 19.01.2012 38,5MB 1.0.1201.0504

cosinus 06.02.2012 20:19

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

TuxedoMask20 07.02.2012 09:02

In den vorigen Logs steht das gleiche. Ich habe ihn nur vom Vorabend bis zu dem Morgen 5 mal mit aktualisierter Datenbank laufen lassen, in der Hoffnung, dass dadurch der Störenfried gefunden wird. Nie wurde etwas schadhaftes gefunden oder gar gefixed.

cosinus 07.02.2012 12:24

Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


TuxedoMask20 08.02.2012 16:43

Hi,
also auch dieser Scanner hatte nichts gefunden. Der Kumpel hat den Laptop jetzt mittlerweile formatiert. War ja eh unumgänglich. Hätte mich nur interessiert, was das für ein Ding war, das sich vor jedem Scanner verstecken konnte sogar mit Updates von gestern. Auch Bootsektorscanner haben nichts gefunden, also keine Ahnung, wo sich das Ding verkrochen hat. Bitte jetzt nicht schreien, warum ich derartige Dinger benutzt habe: Ich habe Informatik studiert und traue mir durchaus bißchen was bzgl. PCs zu, war also kein "Ich probiere einfach mal bißchen aus"-Test :)

Danke für die Hilfeversuche Arne.


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:58 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131