Sorry, war jetzt längere Zeit krank. Ich habe ein neueres Logfile von GData HTML-Code:
Virenprüfung mit G Data InternetSecurity 2012
Version 23.0.5.9 (17.09.2012)
Virensignaturen vom 19.01.2013
Job: Lokale Festplatten
Startzeit: 19.01.2013 22:00:41
Engine(s): Engine A (AVA 22.7486), Engine B (AVL 22.1481)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein
Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 20.01.2013 11:50:09
428110 Dateien überprüft
11 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
–Archiv: A0194554.exe
Pfad: E:\System Volume Information\_restore{CA01AD95-EE07-47C5-898A-E56A2A8DC07C}\RP264
Status: Virus gefunden
Virus: Win32:Spyware-gen [Spy] (Engine B)
Objekt: MahjongQuest3.exe
In Archiv: E:\System Volume Information\_restore{CA01AD95-EE07-47C5-898A-E56A2A8DC07C}\RP264\A0194554.exe
Status: Virus gefunden
Virus: Win32:Spyware-gen [Spy] (Engine B)
–Archiv: f_00c253
Pfad: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache
Status: Virus gefunden
Virus: Gen:Application.Heur.nq0@beOSiUkO, Gen:Application.Heur.eq0@bS2DBJjO, Gen:Application.Heur.cmKfbWuUv3fO, Gen:Application.Heur.emKfbCGfykjO, Gen:Application.Heur.cmKfb8DZCRjO, Gen:Application.Heur.fq0@b4YzcgfO, Gen:Application.Heur.cmKfbiBPZXoO, Application.Nirsoft.RDPassView.A, Gen:Application.Heur.eq0@bSODfwlO, Application.Nirsoft.VNCPassView.A, Gen:Application.Heur.fq1@bm6lgKkO (Engine A)
Objekt: NirSoft/chromepass.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.nq0@beOSiUkO (Engine A)
Objekt: NirSoft/dialupass.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.eq0@bS2DBJjO (Engine A)
Objekt: NirSoft/iepv.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfbWuUv3fO (Engine A)
Objekt: NirSoft/mspass.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.emKfbCGfykjO (Engine A)
Objekt: NirSoft/netpass.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfb8DZCRjO (Engine A)
Objekt: NirSoft/passwordfox.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.fq0@b4YzcgfO (Engine A)
Objekt: NirSoft/pstpassword.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfbiBPZXoO (Engine A)
Objekt: NirSoft/rdpv.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Application.Nirsoft.RDPassView.A (Engine A)
Objekt: NirSoft/sniffpass.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.eq0@bSODfwlO (Engine A)
Objekt: NirSoft/vncpassview.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Application.Nirsoft.VNCPassView.A (Engine A)
Objekt: NirSoft/wirelesskeyview.exe
In Archiv: C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00c253
Status: Virus gefunden
Virus: Gen:Application.Heur.fq1@bm6lgKkO (Engine A)
–Archiv: A0194556.exe
Pfad: E:\System Volume Information\_restore{CA01AD95-EE07-47C5-898A-E56A2A8DC07C}\RP264
Status: Virus gefunden
Virus: Win32:Spyware-gen [Spy] (Engine B)
Objekt: MahjongQuest3.exe
In Archiv: E:\System Volume Information\_restore{CA01AD95-EE07-47C5-898A-E56A2A8DC07C}\RP264\A0194556.exe
Status: Virus gefunden
Virus: Win32:Spyware-gen [Spy] (Engine B)
–Archiv: lzjkfkx4.zip
Pfad: C:\Users\UR\Documents\UseNeXT\wizard\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
Objekt: Linezer0.part1.rar=>keymaker.exe
In Archiv: C:\Users\UR\Documents\UseNeXT\wizard\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4.zip
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
–Archiv: Linezer0.part1.rar
Pfad: C:\Users\UR\Documents\UseNeXT\wizard\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
Objekt: keymaker.exe
In Archiv: C:\Users\UR\Documents\UseNeXT\wizard\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4\Linezer0.part1.rar
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
–Archiv: nirsoft_package_1.16.05.zip
Pfad: C:\Users\UR\Downloads
Status: Virus gefunden
Virus: Gen:Application.Heur.nq0@beOSiUkO, Gen:Application.Heur.eq0@bS2DBJjO, Gen:Application.Heur.cmKfbWuUv3fO, Gen:Application.Heur.emKfbCGfykjO, Gen:Application.Heur.cmKfb8DZCRjO, Gen:Application.Heur.fq0@b4YzcgfO, Gen:Application.Heur.cmKfbiBPZXoO, Application.Nirsoft.RDPassView.A, Gen:Application.Heur.eq0@bSODfwlO, Application.Nirsoft.VNCPassView.A, Gen:Application.Heur.dmKfb4@P@6oO (Engine A)
Objekt: NirSoft/chromepass.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.nq0@beOSiUkO (Engine A)
Objekt: NirSoft/dialupass.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.eq0@bS2DBJjO (Engine A)
Objekt: NirSoft/iepv.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfbWuUv3fO (Engine A)
Objekt: NirSoft/mspass.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.emKfbCGfykjO (Engine A)
Objekt: NirSoft/netpass.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfb8DZCRjO (Engine A)
Objekt: NirSoft/passwordfox.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.fq0@b4YzcgfO (Engine A)
Objekt: NirSoft/pstpassword.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.cmKfbiBPZXoO (Engine A)
Objekt: NirSoft/rdpv.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Application.Nirsoft.RDPassView.A (Engine A)
Objekt: NirSoft/sniffpass.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.eq0@bSODfwlO (Engine A)
Objekt: NirSoft/vncpassview.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Application.Nirsoft.VNCPassView.A (Engine A)
Objekt: NirSoft/wirelesskeyview.exe
In Archiv: C:\Users\UR\Downloads\nirsoft_package_1.16.05.zip
Status: Virus gefunden
Virus: Gen:Application.Heur.dmKfb4@P@6oO (Engine A)
–Archiv: RemoveWAT-2.2.6.rar
Pfad: C:\Users\UR\Downloads
Status: Virus gefunden
Virus: Application.Hacktool.RemoveWAT.A (Engine A)
Objekt: RemoveWAT 2.2.6\RemoveWAT 2.2.6.exe
In Archiv: C:\Users\UR\Downloads\RemoveWAT-2.2.6.rar
Status: Virus gefunden
Virus: Application.Hacktool.RemoveWAT.A (Engine A)
Objekt: RemoveWAT 2.2.6.exe
Pfad: C:\Users\UR\Downloads\RemoveWAT-2.2.6\RemoveWAT 2.2.6
Status: Virus entfernt
Virus: Application.Hacktool.RemoveWAT.A (Engine A)
–Archiv: Linezer0.part1.rar
Pfad: C:\Users\UR\Downloads\Wondershare
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
Objekt: keymaker.exe
In Archiv: C:\Users\UR\Downloads\Wondershare\Linezer0.part1.rar
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
–Archiv: Linezer0.part1.rar
Pfad: C:\Users\UR\Downloads\Wondershare\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
Objekt: keymaker.exe
In Archiv: C:\Users\UR\Downloads\Wondershare\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4\Linezer0.part1.rar
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
–Archiv: lzjkfkx4.zip
Pfad: C:\Users\UR\Downloads\Wondershare\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
Objekt: Linezer0.part1.rar=>keymaker.exe
In Archiv: C:\Users\UR\Downloads\Wondershare\Wondershare.PDF.Password.Remover.v1.3.0. (Wondersh\lzjkfkx4.zip
Status: Virus gefunden
Virus: Trojan.Generic.7976716 (Engine A)
–Der Zugriff auf die folgenden Dateien wurde verweigert:
C:\Program Files\BrowserProtect\conf.db
C:\Program Files\BrowserProtect\svc.log
C:\Program Files\G Data\InternetSecurity\Firewall\LiveStrm.dat
C:\Program Files\G Data\InternetSecurity\Firewall\GdFwSvc.dat
C:\Program Files\G Data\InternetSecurity\Firewall\Modules.dat
C:\Windows\WindowsUpdate.log
C:\Windows\CSC\v2.0.6\pq
C:\Windows\debug\PASSWD.LOG
C:\Windows\ServiceProfiles\LocalService\ntuser.dat
C:\Windows\ServiceProfiles\LocalService\ntuser.dat{f741ea68-72c0-11e1-9899-806e6f6e6963}.TM.blf
C:\Windows\ServiceProfiles\LocalService\ntuser.dat{f741ea68-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
C:\Windows\ServiceProfiles\LocalService\ntuser.dat{f741ea68-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WindowsUpdate.log
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat{f741ea6d-72c0-11e1-9899-806e6f6e6963}.TM.blf
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat{f741ea6d-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat{f741ea6d-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
C:\Windows\SoftwareDistribution\ReportingEvents.log
C:\Windows\System32\config\default
C:\Windows\System32\config\sam
C:\Windows\System32\config\security
C:\Windows\System32\config\software
C:\Windows\System32\config\system
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
C:\Windows\System32\config\TxR\{f741ea5c-72c0-11e1-9899-806e6f6e6963}.TxR.0.regtrans-ms
C:\Windows\System32\config\TxR\{f741ea5c-72c0-11e1-9899-806e6f6e6963}.TxR.1.regtrans-ms
C:\Windows\System32\config\TxR\{f741ea5c-72c0-11e1-9899-806e6f6e6963}.TxR.2.regtrans-ms
C:\Windows\System32\config\TxR\{f741ea5c-72c0-11e1-9899-806e6f6e6963}.TxR.blf
C:\Windows\System32\config\TxR\{f741ea5d-72c0-11e1-9899-806e6f6e6963}.TM.blf
C:\Windows\System32\config\TxR\{f741ea5d-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
C:\Windows\System32\config\TxR\{f741ea5d-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
C:\Windows\System32\wbem\repository\INDEX.BTR
C:\Windows\System32\wbem\repository\MAPPING1.MAP
C:\Windows\System32\wbem\repository\MAPPING2.MAP
C:\Windows\System32\wbem\repository\MAPPING3.MAP
C:\Windows\System32\wbem\repository\OBJECTS.DATA
C:\Windows\System32\wdi\LogFiles\WdiContextLog.etl.001
C:\Windows\System32\wfp\wfpdiag.etl
C:\Windows\System32\winevt\Logs\ACEEventLog.evtx
C:\Windows\System32\winevt\Logs\Application.evtx
C:\Windows\System32\winevt\Logs\HardwareEvents.evtx
C:\Windows\System32\winevt\Logs\Internet Explorer.evtx
C:\Windows\System32\winevt\Logs\Key Management Service.evtx
C:\Windows\System32\winevt\Logs\Media Center.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-BranchCacheSMB%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-HomeGroup Provider Service%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-OfflineFiles%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx
C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx
C:\Windows\System32\winevt\Logs\ODiag.evtx
C:\Windows\System32\winevt\Logs\OSession.evtx
C:\Windows\System32\winevt\Logs\Security.evtx
C:\Windows\System32\winevt\Logs\Spybot - Search and Destroy.evtx
C:\Windows\System32\winevt\Logs\System.evtx
C:\Windows\System32\winevt\Logs\TuneUp.evtx
C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx
C:\Windows\Tasks\SCHEDLGU.TXT
C:\Windows\Temp\tmp00004fb6\tmp00000000
C:\TLDTH
C:\Boot\BCD
C:\Boot\BCD.LOG
C:\ProgramData\BlueStacks\Logs\Hypervisor.log
C:\ProgramData\FLEXnet\OMCD_002d6e00_tsf.data
C:\ProgramData\G Data\AVK\Log\AVKLog\0000009597.log
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\ProgramData\TuneUp Software\TuneUp Utilities\TUProgMan.10.tudb
C:\ProgramData\TuneUp Software\TuneUp Utilities\TUUtilitiesSvc.12.tudb
C:\ProgramData\TuneUp Software\TuneUp Utilities\Program Statistics\ProgramStatistics.10.tudb
C:\Users\UR\ntuser.dat
C:\Users\UR\ntuser.dat{f741ea72-72c0-11e1-9899-806e6f6e6963}.TM.blf
C:\Users\UR\ntuser.dat{f741ea72-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
C:\Users\UR\ntuser.dat{f741ea72-72c0-11e1-9899-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
C:\Users\UR\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
C:\Users\UR\AppData\Local\Microsoft\Windows\WindowsUpdate.log
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
C:\Users\UR\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
C:\Users\UR\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Users\UR\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013011920130120\index.dat
C:\Users\UR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\UR\AppData\Local\Nokia\Nokia Data Store\DataBase\MDataStore.db3
C:\Users\UR\AppData\Local\Nokia\Nokia Data Store\Thumbnail\DataBase\MDataStore.db3
C:\Users\UR\AppData\Local\Nokia\Nokia Suite\Messages\Database\msg_db.sqlite
C:\Users\UR\AppData\Local\Nokia\Nokia Suite\Photos\Database\photo_markers_db.sqlite
C:\Users\UR\AppData\Local\SlimWare Utilities Inc\SlimDrivers\settings.db
C:\Users\UR\AppData\Local\SlimWare Utilities Inc\SlimDrivers\supdates.db
C:\Users\UR\AppData\Local\SlimWare Utilities Inc\SlimDrivers\Logs\2013-01-19 21-48-56 0.log
C:\Users\UR\AppData\Local\Temp\FXSAPIDebugLogFile.txt
C:\Users\UR\AppData\Local\Temp\ICACHE-04044202.tmp
C:\Users\UR\AppData\Local\Temp\ICACHE-19EE2C4D.tmp
C:\Users\UR\AppData\Local\Temp\ILIST-00000000.tmp
C:\Users\UR\AppData\Local\Temp\ILIST-6E36D60E.tmp
C:\Users\UR\AppData\Local\Temp\qtsingleapp-NokiaO-b889-1-lockfile
C:\Users\UR\AppData\Local\Temp\~DF7A72B2C6BA605D44.TMP
C:\Users\UR\AppData\Roaming\Dropbox\shellext\l\50fb06a6
C:\Users\UR\AppData\Roaming\Dropbox\shellext\l\50fb0731
C:\Users\UR\AppData\Roaming\Dropbox\shellext\l\50fb076c
C:\Users\UR\AppData\Roaming\Dropbox\shellext\l\50fb07a8
C:\Users\UR\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\UR\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
C:\Users\UR\AppData\Roaming\ProcessLasso\.pg-active
C:\Users\UR\AppData\Roaming\Skype\DbTemp\temp-54jdo9nktIh27oVNL05rIEdx
C:\Users\UR\AppData\Roaming\Skype\DbTemp\temp-H2nUxfNe1Da1EWgqQj4jqAUK
C:\Users\UR\AppData\Roaming\Skype\mecino\bistats.db
C:\Users\UR\AppData\Roaming\Skype\mecino\bistats.lock
C:\Users\UR\AppData\Roaming\Skype\mecino\dc.db
C:\Users\UR\AppData\Roaming\Skype\mecino\keyval.db
C:\Users\UR\AppData\Roaming\Skype\mecino\keyval.lock
C:\Users\UR\AppData\Roaming\Skype\mecino\main.db
C:\Users\UR\AppData\Roaming\Skype\mecino\main.lock
C:\Users\UR\AppData\Roaming\Skype\shared_dynco\dc.db
C:\Users\UR\AppData\Roaming\Skype\shared_dynco\dc.lock
C:\Users\UR\AppData\Roaming\Skype\shared_httpfe\queue.db
C:\Users\UR\AppData\Roaming\Skype\shared_httpfe\queue.lock
–Die folgenden Dateien sind Passwortgeschützt:
C:\Program Files\CCFinder\abtranslate.data
C:\Program Files\Games\Franzis\Windows 7 Games\autorun.cdd
C:\Program Files\JetAudio\jetUpdate.dat
E:\Backup C\Office\Outlook.pst
E:\Backup C\Office\Outlook\Outlook.pst
E:\Desktop\Outlook.pst
C:\Program Files\MyKeyFinder\Settings.dll
C:\Program Files\MyKeyFinder\Settings2.dll
E:\Desktop\Audio\Das Wasserauto - Das nur mit Wasser angetrieben wird - Bauanleitungen German 2008\Wasserauto.rar
C:\Program Files\pCon.planner 6\data\egr\bib2d\1\egr_bib2d_1.alb
C:\Program Files\pCon.planner 6\data\egr\found\1\egr_found_1.alb
C:\Program Files\pCon.planner 6\data\egr\mchair\1\egr_mchair_1.alb
C:\Program Files\pCon.planner 6\data\egr\mcontainer\1\egr_mcontainer_1.alb
C:\Program Files\pCon.planner 6\data\egr\mcupboard\1\egr_mcupboard_1.alb
C:\Program Files\pCon.planner 6\data\egr\mpchair\1\egr_mpchair_1.alb
C:\Program Files\pCon.planner 6\data\egr\mpcupboard\1\egr_mpcupboard_1.alb
C:\Program Files\pCon.planner 6\data\egr\mptable\1\egr_mptable_1.alb
C:\Program Files\pCon.planner 6\data\egr\mtable\1\egr_mtable_1.alb
C:\Program Files\pCon.planner 6\data\ofml\go\1\ofml_go_1.alb
C:\Program Files\pCon.planner 6\data\ofml\np2d\1\ofml_np2d_1.alb
C:\Program Files\pCon.planner 6\data\ofml\oi\1\ofml_oi_1.alb
C:\Program Files\pCon.planner 6\data\ofml\xoi\1\ofml_xoi_1.alb
C:\Program Files\pCon.planner 6\etc\gfx\common.gfx
C:\Program Files\pCon.planner 6\etc\gfx\images.gfx
C:\Program Files\pCon.planner 6\etc\gfx\shader.gfx
C:\Program Files\pCon.planner 6\etc\profiles\planner_std.profile
E:\Desktop\Download\2011\bigloa03\ExpTe\Ama\NuBah\rikpafiles.com_-_Nude_Beach_Big_017_1319_017.rar
C:\Program Files\Recovery Toolbox for Word\settings.bin
E:\Desktop\Download\2011\Bilder\fru_7steps.pdf
E:\Desktop\Download\2011\Desktoptools\omnimo_4_1_for_rainmeter_by_fediafedia-d2mhn7l.zip
E:\Desktop\Download\2011\Free_Tools\ElcorPowerKey.zip
C:\Program Files\Spiele\Kartenspiele\autorun.cdd
E:\Desktop\Download\2011\Free_Tools\install_flashplayer11x32_mssa_aih.exe
E:\Desktop\Download\2011\Free_Tools\mykeyfinder.exe
E:\Desktop\Download\2011\Free_Tools\RecoveryToolboxForWordInstall.exe
E:\Desktop\Download\2011\Free_Tools\ysd.exe
E:\Desktop\Download\2011\Free_Tools\ElcorPowerKey\Setup.exe
C:\Program Files\WashAndGo\Cleaner.dat
E:\Desktop\Download\2011\Free_Tools\TweakRAM71\Setup.exe
E:\Desktop\Download\2011\Free_Tools\TweakRAM71\TweakRAM71.zip
E:\Desktop\Download\2011\Systemtools\Chew-WGA_0.9\CW.eXe
C:\Program Files\Zoner Photo Studio 14\pack.dat
C:\Program Files\Zoner Photo Studio 14\Program32\zcl.dat
C:\Windows\CleverPrint\PrtSetupX.exe
E:\Desktop\Ecologic-Energy-Group\Biogasanlagen-Standorte\Ecologic Energy-doc.zip
E:\Desktop\Ecologic-Energy-Group\Biogasanlagen-Standorte\Ecologic Energy-xls.zip
E:\Desktop\Geschäft\ARI\Website aramys\FlashSite\sources_Z828zrN0Z1.zip
E:\Desktop\Geschäft\ARI\Website aramys\Flashsite_Orginal\Source\sources_Z828zrN0Z1.zip
E:\Desktop\Geschäft\GFE\Antragsbegleitschein.pdf
E:\Desktop\Geschäft\GFE\gfe_bhkw_2010_2501.pdf
E:\Desktop\Geschäft\GFE\Musterkunde.pdf
E:\Desktop\Geschäft\GFE\Vermittlerdatenblatt.pdf
E:\Desktop\Geschäft\GFE\Ablage\bhkw_2010_2801_1-4.pdf
E:\Desktop\Geschäft\GFE\Ablage\bhkw_2010_2801_blubox.pdf
E:\Desktop\Geschäft\GFE\Ablage\bhkw_2010_2801_EWIV.pdf
E:\Desktop\Geschäft\GFE\Ablage\bhkw_2010_2801_FAQ_Schluss.pdf
E:\Desktop\Geschäft\GFE\Ablage\bhkw_Marketingplan_2501.pdf
E:\Desktop\Medien\Grafik\Adobe CS3\FlashSite\sources_Z828zrN0Z1.zip
E:\Desktop\Medien\Grafik\Adobe CS3\Flashsite_Orginal\Source\sources_Z828zrN0Z1.zip
E:\Desktop\Medien\Grafik\FlashSite\sources_Z828zrN0Z1.zip
E:\Desktop\Medien\Grafik\Flashsite_Orginal\Source\sources_Z828zrN0Z1.zip
E:\Desktop\Movies\cd1774f8-63c5-4fac-b222-589d292b7870
C:\Program File\Wise Care 365\BootPack.wpk
C:\Program File\Wise Care 365\skins\default.wsk
C:\Program File\Wise Care 365\skins\f001_Cloud.wsk
C:\Program File\Wise Care 365\skins\f002_Biscuit.wsk
C:\Program File\Wise Care 365\skins\f003_Brush.wsk
C:\Program File\Wise Care 365\skins\v0010_kids.wsk
C:\Program File\Wise Care 365\skins\v0011_Sunset.wsk
C:\Program File\Wise Care 365\skins\v0013_StarWars.wsk
C:\Program File\Wise Care 365\skins\v001_bridge.wsk
C:\Program File\Wise Care 365\skins\v002_Drop.wsk
E:\Desktop\Office\Website aramys\FlashSite\sources_Z828zrN0Z1.zip
C:\Program File\Wise Care 365\skins\v003_Earth.wsk
C:\Program File\Wise Care 365\skins\v004_Kitty.wsk
C:\Program File\Wise Care 365\skins\v005_Lotus.wsk
C:\Program File\Wise Care 365\skins\v006_Gril.wsk
C:\Program File\Wise Care 365\skins\v007_Star.wsk
C:\Program File\Wise Care 365\skins\v008_Giraffe.wsk
C:\Program File\Wise Care 365\skins\v009_Robot.wsk
E:\Desktop\Office\Website aramys\Flashsite_Orginal\Source\sources_Z828zrN0Z1.zip
C:\ProgramData\ActMask EMF Virtual Printer SDK\PrtSetupX.exe
C:\ProgramData\Spybot - Search & Destroy\Quarantine\AdRevolver-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\AdRevolver-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\AdRevolver-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\AdRevolver-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Adviva-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Adviva-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Adviva-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Adviva-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Alcohol 120%-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Babylon.Toolbar-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Babylon.Toolbar-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\BurstMedia-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\BurstMedia-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\BurstMedia-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\BurstMedia-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cache-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CasaleMedia-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Clickbank-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Cookie-0005.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CoreMetrics-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CoreMetrics-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CoreMetrics-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\CoreMetrics-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\DoubleClick-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\FastClick-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\FastClick-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\FastClick-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\FastClick-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\HitBox-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\HitBox-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\HitBox-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\HitBox-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\IncrediBar-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Internet Explorer-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Internet Explorer-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Internet Explorer-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Log-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MediaPlex-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Microsoft.Windows.Security.InternetExplorer-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Microsoft.WindowsSecurityCenter_disabled-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Microsoft.WindowsSecurityCenter_disabled-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Direct3D-0005.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectDraw-0005.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS DirectInput-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Media Player-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\MS Regedit-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\SexTracker-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Statcounter-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Tradedoubler-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Verlauf-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\W3i.IQ5.fraud-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\W3i.IQ5.fraud-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\WebTrends live-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\WebTrends live-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Media SDK-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Media SDK-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Media SDK-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Media SDK-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows Media SDK-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0004.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows-0005.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows.OpenWith-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows.OpenWith-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Windows.OpenWith-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\WinRAR-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Zedo-0000.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Zedo-0001.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Zedo-0002.zip
C:\ProgramData\Spybot - Search & Destroy\Quarantine\Zedo-0003.zip
C:\ProgramData\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityCenterdisabled.zip
C:\ProgramData\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityCenterdisabled1.zip
C:\ProgramData\Spybot - Search & Destroy\Recovery\SearchExplorer.zip
E:\Desktop\Privat\PDFS + ebooks\Magazin - PCgo - Gesammelte Tipps Und Tricks.rar
E:\Desktop\Privat\PDFS + ebooks\Windows XP perfektioniert - Tips & Tricks.zip
C:\Users\UR\AppData\Local\Abelssoft\.data
E:\Documents\FalkData\{1BA4421E-4A47-4AE0-93B4-D0FC36CA8F69}.zip
E:\Documents\FalkData\{3464FCFA-1A4D-40B9-909F-DE40676C387C}.zip
E:\Documents\FalkData\{3C5FB882-57F4-4320-BDB8-E382227D75D0}.zip
E:\Documents\FalkData\{4D11BFBE-ADB8-4053-B2F4-A53ABC758141}.zip
E:\Documents\FalkData\{8061B2E2-CBC4-4D35-BFD2-780310E3C5AA}.zip
E:\Documents\FalkData\{8A473988-9E61-49E6-BE2B-A3A35B9C30A6}.zip
E:\Documents\FalkData\{AC4B9926-2B54-447D-AB20-7A7EB66FB673}.zip
E:\Documents\FalkData\{EA5C64B9-913A-43BE-95E7-C56B57D14079}.zip
E:\Documents\FalkData\{EB564212-460A-4BA4-A702-AAC17CD00C8E}.zip
E:\Documents\Rainmeter\Skins\WP7\Common\Config\SourceCode.zip
E:\Documents\UseNeXT\alt.binaries.e-book\Das Wasserauto - Das nur mit Wasser angetrieben wird - Bauanleitungen German 2008\Wasserauto.rar
C:\Users\UR\AppData\Local\Microsoft\Outlook\archive.pst
C:\Users\UR\AppData\Local\Recovery Toolbox for Word\settings.bin
C:\Users\UR\Desktop\Ecologic-Energy-Group\Biogasanlagen-Standorte\Ecologic Energy-doc.zip
C:\Users\UR\Desktop\Ecologic-Energy-Group\Biogasanlagen-Standorte\Ecologic Energy-xls.zip
C:\Users\UR\Documents\FalkData\{1BA4421E-4A47-4AE0-93B4-D0FC36CA8F69}.zip
C:\Users\UR\Documents\FalkData\{3464FCFA-1A4D-40B9-909F-DE40676C387C}.zip
C:\Users\UR\Documents\FalkData\{3C5FB882-57F4-4320-BDB8-E382227D75D0}.zip
C:\Users\UR\Documents\FalkData\{4D11BFBE-ADB8-4053-B2F4-A53ABC758141}.zip
C:\Users\UR\Documents\FalkData\{8061B2E2-CBC4-4D35-BFD2-780310E3C5AA}.zip
C:\Users\UR\Documents\FalkData\{8A473988-9E61-49E6-BE2B-A3A35B9C30A6}.zip
C:\Users\UR\Documents\FalkData\{AC4B9926-2B54-447D-AB20-7A7EB66FB673}.zip
C:\Users\UR\Documents\FalkData\{EB564212-460A-4BA4-A702-AAC17CD00C8E}.zip
C:\Users\UR\Documents\FalkData\{EA5C64B9-913A-43BE-95E7-C56B57D14079}.zip
C:\Users\UR\Documents\Rainmeter\Skins\@Backup\WP7\Common\Config\SourceCode.zip
C:\Users\UR\Downloads\ccfinder.exe
C:\Users\UR\Downloads\mykeyfinder.exe
C:\Users\UR\Downloads\Myriad_Pro_Adobe_OTF.rar
C:\Users\UR\Downloads\ysd.exe
C:\Users\UR\Downloads\Myriad_Pro_Adobe_OTF\Myriad Pro (Adobe) OTF.rar
und ein ganz neues
von freefixer HTML-Code:
FreeFixer v1.02 log
hxxp://www.freefixer.com/
Operating system: Windows 7 Service Pack 1
Log dated 2013-02-03 16:05
AppInit_DLLs (1 whitelisted)
C:\Windows\system32\acaptuser32.dll
Browser Helper Objects (2 whitelisted)
{133232D2-DAE3-4B6F-AAC2-17CD87495682}, Wondershare YouTube Downloader, C:\Program Files\Wondershare\AllMyTube\SVRIEPlugin.dll
{326E768D-4182-46FD-9C16-1449A49795F4}, DivX Plus Web Player HTML5 <video>, C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}, BitComet Helper, C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
{61DB16C5-B733-43F4-872E-B20DC9E72740}, YouTube To ALLPlayer, C:\PROGRA~1\ALLPLA~1\YOUTUB~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}, Java(tm) Plug-In SSV Helper, C:\Program Files\Java\jre7\bin\ssv.dll
{BA3295CF-17ED-4F49-9E95-D999A0ADBFDC}, G Data BankGuard, C:\Program Files\Common Files\G Data\AVKProxy\BanksafeBHO.dll
{CC59E0F9-7E43-44FA-9FAA-8377850BF205}, Free Download Manager, C:\Program Files\Free Download Manager\iefdm2.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9}, Java(tm) Plug-In 2 SSV Helper, C:\Program Files\Java\jre7\bin\jp2ssv.dll
{ebe8b562-cba0-40d8-b920-af7cfe0c9d94}, Soda PDF 2012 Helper, C:\Program Files\Soda PDF 2012\PDFIEHelper.dll
Internet Explorer toolbars (1 whitelisted)
HKLM\..\Toolbar\{9DE41FB9-ACA7-4847-982B-D984042588FC} - Perfect PDF 5 - C:\Program Files\Perfect PDF 5\PDF4ie.dll
HKLM\..\Toolbar\{a8c9d542-fd91-4834-a2e8-adb9ae692b8b} - Soda PDF 2012 Toolbar - C:\Program Files\Soda PDF 2012\PDFIEPlugin.dll
Basic Internet Explorer settings
HKLM\..\Main, Start Page = hxxp://www.google.com
Registry Startups (7 whitelisted)
HKLM\..\Run, G Data AntiVirus Tray Application = C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
HKLM\..\Run, GDFirewallTray = C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
HKLM\..\Run, BTMTrayAgent = rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\..\Run, AntiLogger = "C:\Program Files\AntiLogger\AntiLogger.exe" /minimized
HKCU\..\Run, COMPUTERBILD-Cloud = "C:\Program Files\COMPUTERBILD-Cloud\CGCClient.exe" /autostart
HKCU\..\Run, TweakRAM = C:\Program Files\TweakRAM\TweakRAM.exe
HKCU\..\Run, EvJOWall = C:\Program Files\Wallpaper Changer\EvJOWall.exe
HKCU\..\Run, BrowserMask = "C:\Program Files\AntiBrowserSpy\AntiBrowserSpyBrowserMaske.exe" -delayed
HKCU\..\Run, Free Download Manager = "C:\Program Files\Free Download Manager\fdm.exe" -autorun
Autostart shortcuts
O&O Defrag Tray.lnk, , C:\Windows\Installer\{EE5845DF-8F69-4AAD-817A-BAD41A1A52B0}\DefragIcon.exe
Mediencenter Assistent.lnk, Mediencenter Assistent starten, C:\Program Files\Telekom Mediencenter\Mediencenter\MediencenterSoftware.exe
HOSTS file

Processes (70 whitelisted)
C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe
C:\Program Files\BrowserProtect\BpSvc.exe
C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe
C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\startup.service@mozilla.com\svc.exe
C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
C:\Program Files\Soda PDF 2012\ConversionService.exe
C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe
C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe
C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe
C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
C:\Program Files\AntiLogger\AntiLogger.exe
C:\Program Files\Wallpaper Changer\EvJOWall.exe
C:\Program Files\AntiBrowserSpy\AntiBrowserSpyBrowserMaske.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\CyberGhost VPN\CyberGhost.exe
C:\Program Files\CyberGhost VPN\CGVPNCliService.exe
C:\Program Files\CyberGhost VPN\OpenVPN\openvpn.exe
C:\Program Files\G Data\InternetSecurity\AVK\AVK.exe
C:\Program Files\FreeFixer\freefixer.exe
Services (52 whitelisted)
ADExchange, ArcSoft Exchange Service, c:\program (file is missing)
AVKProxy, G Data AntiVirus Proxy, c:\program files\common files\g data\avkproxy\avkproxy.exe
AVKService, G Data Scheduler, c:\program files\g data\internetsecurity\avk\avkservice.exe
AVKWCtl, G Data Filesystem Monitor, c:\program files\g data\internetsecurity\avk\avkwctl.exe
Bluetooth OBEX Service, Bluetooth OBEX Service, c:\program files\motorola\bluetooth\obexsrv.exe (file is missing)
BpSvc, BrowserProtect Anti-Hijack Service, c:\program files\browserprotect\bpsvc.exe
Firefox Service, Firefox Service, c:\users\ur\appdata\roaming\mozilla\firefox\profiles\2el6povu.default\extensions\startup.service@mozilla.com\svc.exe
OpLclSrv, OKI Local Port Manager, c:\program files\okidata\common\extend3\portmgrsrv.exe
Soda PDF 2012 Service, Soda PDF 2012 Service, c:\program files\soda pdf 2012\conversionservice.exe
TuneUp.UtilitiesSvc, TuneUp Utilities Service, c:\program files\tuneup utilities 2012\tuneuputilitiesservice32.exe
Svchost.exe Modules (269 whitelisted)
C:\Windows\system32\VBoxNetFltNotify.dll
Explorer.exe Modules (201 whitelisted)
C:\Program Files\COMPUTERBILD-Cloud\ShellExt32.dll
C:\Users\UR\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
C:\Users\UR\AppData\Roaming\Dropbox\bin\MSVCP71.dll
C:\Users\UR\AppData\Roaming\Dropbox\bin\MSVCR71.dll
C:\Program Files\Google\Drive\googledrivesync32.dll
C:\Program Files\G Data\InternetSecurity\Shredder\Reisswlf.dll
C:\Program Files\TeraCopy\TeraCopyExt.dll
C:\Program Files\ESTsoft\ALZip\AZCTM.dll
C:\Program Files\ESTsoft\ALZip\ctm_en-US.dll
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamdeu.dll
C:\Program Files\Unlocker\UnlockerCOM.dll
C:\Program Files\JetAudio\JetFlExt.dll
C:\Windows\system32\DTAG.Mediencenter.ShellExtension.dll
C:\Program Files\IObit\IObit Malware Fighter\IMFShellExt.dll
C:\Users\UR\AppData\Local\Google\Chrome\User Data\Default\Extensions\odoegbfnimkkocjoeoelkonmlfpbhlnc\2.2.0_0\flashhook.dll
Rundll Modules (50 whitelisted)
C:\Program Files\Motorola\Bluetooth\btmshell.dll
C:\Program Files\Motorola\Bluetooth\Resources\deu.dll
Shell services
WebCheck, {E6FB5E20-DE35-11CF-9C87-00AA005127ED}, (no file specified)
Drivers (75 whitelisted)
aflfile, AFLFile, C:\Windows\system32\drivers\aflfile.sys
AntiLog32, AntiLog32, c:\program files\antilogger\antilog32.sys
BstHdDrv, BlueStacks Hypervisor, c:\program files\bluestacks\hd-hypervisor-x86.sys
DCR, DCR, C:\Windows\system32\drivers\dcr.sys
dcrypt, , C:\Windows\system32\drivers\dcrypt.sys
DCVP, DCVP, C:\Windows\system32\drivers\dcvp.sys
Dokan, Dokan, c:\windows\system32\drivers\dokan.sys
dtsoftbus01, DAEMON Tools Virtual Bus Driver, C:\Windows\system32\drivers\dtsoftbus01.sys
GDBehave, GDBehave, C:\Windows\system32\drivers\gdbehave.sys
GDMnIcpt, GDMnIcpt, c:\windows\system32\drivers\miniicpt.sys
gdwfpcd, G DATA WFP CD, C:\Windows\system32\drivers\gdwfpcd32.sys
GRD, G Data Rootkit Detector Driver, c:\windows\system32\drivers\grd.sys
HookCentre, HookCentre, c:\windows\system32\drivers\hookcentre.sys
ISODrive, ISO DVD/CD-ROM Device Driver, c:\program files\ultraiso\drivers\isodrive.sys
JRAID, , C:\Windows\system32\drivers\jraid.sys
NPF, NetGroup Packet Filter Driver, C:\Windows\system32\drivers\npf.sys
SASDIFSV, SASDIFSV, c:\program files\superantispyware\sasdifsv.sys
SASKUTIL, SASKUTIL, c:\program files\superantispyware\saskutil.sys
ShredderVolumeDriver, Helper driver for shredding volume, C:\Windows\system32\drivers\shredderdriver32.sys
truecrypt, truecrypt, C:\Windows\system32\drivers\truecrypt.sys
UnlockerDriver5, , c:\program files\unlocker\unlockerdriver5.sys
VBoxDrv, VirtualBox Service, C:\Windows\system32\drivers\vboxdrv.sys
VBoxUSBMon, VirtualBox USB Monitor Driver, C:\Windows\system32\drivers\vboxusbmon.sys
VEDDevice, FileStream Secure Disk, C:\Windows\system32\drivers\ved.sys
Firefox Extensions
Fast Dial, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\fastdial@telega.phpnet.us\install.rdf
VWC Cocoon, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\firefox-support@vworldc.com\install.rdf
Ghostery, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\firefox@ghostery.com\install.rdf
Iplex to ALLPlayer, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\IplextoALL@ALLPlayer.org\install.rdf
Awesome screenshot: Capture and Annotate, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack\install.rdf
NetVideoHunter, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\netvideohunter@netvideohunter.com\install.rdf
startup.service, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\startup.service@mozilla.com\install.rdf
WEB.DE Toolbar, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\toolbar@web.de\install.rdf
YouTube to ALLPlayer, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\YouTubetoALL@ALLPlayer.org\install.rdf
TV-Fox, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}\install.rdf
WOT, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\install.rdf
Free YouTube Download (Free Studio) Menu, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\install.rdf
BitComet Video Downloader, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\install.rdf
DownloadHelper, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}\install.rdf
BabelFish, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{ca0849e8-2c76-42ae-9abe-34e14d337acf}\install.rdf
Memory Fox, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\install.rdf
FoxLingo, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\2el6povu.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}\install.rdf
BYTubeD - Bulk YouTube video Downloader, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\bytubed@cs213.cse.iitk.ac.in\install.rdf
Click&Clean, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\clickclean@hotcleaner.com\install.rdf
Fast Dial, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\fastdial@telega.phpnet.us\install.rdf
FRITZ!Box AddOn, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\fb_add_on@avm.de\install.rdf
Free Download Manager plugin, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\fdm_ffext@freedownloadmanager.org\install.rdf
FireJump, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\firejump@firejump.net\install.rdf
ProxTube - Unblock YouTube, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\ich@maltegoetz.de\install.rdf
TimeLineRemove.Com, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\jid0-YxzrUsJ0WOiOaU89TngAzLcIs18@jetpack\install.rdf
Firefox Synchronisation Extension, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\synchronize@nokia.suite\install.rdf
TV-Fox, C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}\install.rdf
G Data BankGuard, C:\Program Files\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}\install.rdf
Recently created/modified files (28 whitelisted)
2 hours, c:\Program Files\Common Files\G Data\AVKScanP\Avast5\defs\13020300\algo.dll
2 hours, c:\Program Files\Common Files\G Data\AVKScanP\Avast5\defs\13020300\swhealthex.dll
History
-C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
-C:\Program Files\Common Files\ArcSoft\esinter\Bin\eservutil.exe
-C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
-C:\Program Files\Motorola\Bluetooth\obexsrv.exe
-C:\Program Files\Motorola\Bluetooth\audiosrv.exe
-C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4415769-1588-4AD6-9624-B2E69DB78D1A}
-HKLM\SOFTWARE\Classes\CLSID\{C4415769-1588-4AD6-9624-B2E69DB78D1A}
-C:\Program Files\preispilot\Internet Explorer\preispilot.dll
-HKLM\SYSTEM\CurrentControlSet\Services\IMFservice
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\2020Player_IKEA@2020Technologies.com\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\firefox-support@vworldc.com\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\firefox@ghostery.com\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\https-everywhere@eff.org\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\mail@shopping-preise.de\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\install.rdf
-C:\Users\UR\AppData\Roaming\Mozilla\Firefox\Profiles\gnlumuph.tarnfox\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}\install.rdf
The following errors occurred during the scan:
Problems opening folder 'c:\System Volume Information\WindowsImageBackup' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'c:\Windows\CSC\v2.0.6' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'c:\Windows\System32\LogFiles\WMI\RtBackup' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'e:\Backup C\System\c0f1c59bcf6c2414a1\amd64' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'e:\Backup C\System\c0f1c59bcf6c2414a1\i386' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'e:\Backup C\System\f6098aa080f4ad019c5e7890cc380a\amd64' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
Problems opening folder 'e:\Backup C\System\f6098aa080f4ad019c5e7890cc380a\i386' to enumerate files. FindFirstFile failed. System error message: Zugriff verweigert. Error code: 5.
An unexpected exception occurred in the Csrss.exe Memory Scan Plugin:
QueryFullProcessImageName failed while trying to get a process full path. Process handle: 000006DC. System error message: Ein an das System angeschlossenes Gerät funktioniert nicht. Error code: 31.
End of FreeFixer log
die Hostdatei sieht mir sehr komisch aus: HOSTS file . |
Lesestoff: