Hey Kira,
also ich habe alles so ausgeführt ......!!! Hier die Ergebnisse:
Malewarebytes: Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8046
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
30.10.2011 13:42:23
mbam-log-2011-10-30 (13-42-23).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 363691
Laufzeit: 1 Stunde(n), 10 Minute(n), 41 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\Users\oli\AppData\Local\f59bee42\X (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\Users\oli\AppData\Local\f59bee42\U\80000000.@ (Spyware.Agent) -> Quarantined and deleted successfully.
c:\Users\oli\AppData\Local\f59bee42\U\800000cb.@ (Backdoor.0Access) -> Quarantined and deleted successfully.
c:\Users\oli\AppData\LocalLow\Sun\Java\deployment\cache\6.0\26\2221f99a-5a138dcd (Backdoor.0Access) -> Quarantined and deleted successfully.
OTL: Code:
OTL logfile created on: 30.10.2011 13:57:46 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\oli\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,93 Gb Total Physical Memory | 2,17 Gb Available Physical Memory | 74,08% Memory free
5,86 Gb Paging File | 4,88 Gb Available in Paging File | 83,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99,09 Gb Total Space | 40,35 Gb Free Space | 40,72% Space Free | Partition Type: NTFS
Drive D: | 186,00 Gb Total Space | 62,96 Gb Free Space | 33,85% Space Free | Partition Type: NTFS
Drive E: | 1,81 Gb Total Space | 1,79 Gb Free Space | 99,28% Space Free | Partition Type: FAT
Computer Name: NOTEBOOK-OLI | User Name: oli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\oli\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
========== Modules (No Company Name) ==========
MOD - C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll ()
========== Win32 Services (SafeList) ==========
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (TrufosAlt) -- C:\Windows\System32\drivers\TrufosAlt.sys (BitDefender S.R.L.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (zghsnmea) -- C:\Windows\System32\drivers\zghsnmea.sys (ZTE Incorporated)
DRV - (zghsmdm) -- C:\Windows\System32\drivers\zghsmdm.sys (ZTE Incorporated)
DRV - (zghsdiag) -- C:\Windows\System32\drivers\zghsdiag.sys (ZTE Incorporated)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (androidusb) -- C:\Windows\System32\drivers\androidusb.sys (Google Inc)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (Serial) -- C:\Windows\system32\DRIVERS\serial.sys (Brother Industries Ltd.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek )
DRV - (vflt) -- C:\Windows\System32\drivers\vfilter.sys (Shrew Soft Inc)
DRV - (vnet) -- C:\Windows\System32\drivers\virtualnet.sys (Shrew Soft Inc)
DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys (Intel(R) Corporation)
DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
IE - HKCU\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultthis.engineName: "PHPNukeDE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102572&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.7
FF - prefs.js..extensions.enabledItems: {c9508125-4747-4733-b048-e4b82dc9716d}:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2102572&q="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\oli\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: D:\Programme\Firefox\components [2011.10.16 13:58:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: D:\Programme\Firefox\plugins [2011.09.29 20:17:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.15\extensions\\Components: D:\Programme\thunderbird\components [2011.09.28 19:39:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.15\extensions\\Plugins: D:\Programme\thunderbird\plugins
[2010.10.12 17:26:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oli\AppData\Roaming\mozilla\Extensions
[2010.10.12 17:26:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oli\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.10.28 18:09:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions
[2009.12.29 23:29:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.01.21 15:25:14 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2011.04.06 14:30:54 | 000,000,000 | ---D | M] (PHPNukeDE Community Toolbar) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions\{c9508125-4747-4733-b048-e4b82dc9716d}
[2011.10.28 18:09:38 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.04.06 14:30:54 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\oli\AppData\Roaming\mozilla\Firefox\Profiles\9orow469.default\extensions\engine@conduit.com
[2011.04.06 14:31:10 | 000,000,931 | ---- | M] () -- C:\Users\oli\AppData\Roaming\Mozilla\Firefox\Profiles\9orow469.default\searchplugins\conduit.xml
[2010.02.16 15:30:46 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAMME\FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Users\oli\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An vorhandenes PDF anfügen - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Works\Excel\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe CS 3\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\Programme\icq\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\Programme\icq\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Works\projekt\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6658193F-483E-4DA0-8928-19CB41222D52}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{c193846f-7d20-11df-aa0c-00265ea3a491}\Shell - "" = AutoRun
O33 - MountPoints2\{c193846f-7d20-11df-aa0c-00265ea3a491}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.10.30 12:26:23 | 000,000,000 | ---D | C] -- C:\Users\oli\AppData\Roaming\Malwarebytes
[2011.10.30 12:25:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.10.30 12:25:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.10.30 12:25:44 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.10.30 12:25:44 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.10.30 12:24:54 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\oli\Desktop\mbam-setup-1.51.2.1300.exe
[2011.10.30 12:24:54 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\oli\Desktop\OTL.exe
[2011.10.30 12:24:53 | 003,511,776 | ---- | C] (Piriform Ltd) -- C:\Users\oli\Desktop\ccsetup312.exe
[2011.10.28 19:11:02 | 000,000,000 | ---D | C] -- C:\Users\oli\AppData\Local\Eraser 6
[2011.10.28 18:54:17 | 000,000,000 | ---D | C] -- C:\Users\oli\AppData\Roaming\Avira
[2011.10.28 18:48:39 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.10.28 18:48:38 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.10.28 18:48:38 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.10.28 18:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.10.28 18:00:25 | 000,309,320 | ---- | C] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\TrufosAlt.sys
[2011.10.27 22:46:33 | 000,000,000 | ---D | C] -- C:\Users\oli\AppData\Roaming\SUPERAntiSpyware.com
[2011.10.27 22:46:33 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011.10.27 20:27:39 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.10.27 19:46:10 | 000,000,000 | -HSD | C] -- C:\Users\oli\AppData\Local\f59bee42
[2011.10.26 19:58:53 | 000,000,000 | ---D | C] -- C:\Users\oli\Desktop\dublin
[2011.10.12 13:41:51 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.10.12 13:41:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.10.12 13:41:50 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.10.12 13:41:50 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011.10.12 13:41:50 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.10.12 13:34:16 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2011.10.12 13:34:16 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2011.10.12 13:33:16 | 002,334,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
========== Files - Modified Within 30 Days ==========
[2011.10.30 13:51:38 | 000,010,880 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.10.30 13:51:38 | 000,010,880 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.10.30 13:50:55 | 000,647,376 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.10.30 13:50:55 | 000,610,094 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.10.30 13:50:55 | 000,127,404 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.10.30 13:50:55 | 000,104,412 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.10.30 13:44:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.10.30 13:43:58 | 2362,920,960 | -HS- | M] () -- C:\hiberfil.sys
[2011.10.30 12:57:07 | 000,001,130 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-664893872-1263777797-2991827239-1000UA.job
[2011.10.30 12:25:49 | 000,001,074 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.30 12:23:14 | 003,511,776 | ---- | M] (Piriform Ltd) -- C:\Users\oli\Desktop\ccsetup312.exe
[2011.10.30 12:22:32 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\oli\Desktop\OTL.exe
[2011.10.30 12:22:10 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\oli\Desktop\mbam-setup-1.51.2.1300.exe
[2011.10.28 18:48:49 | 000,001,947 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.10.28 18:00:25 | 000,309,320 | ---- | M] (BitDefender S.R.L.) -- C:\Windows\System32\drivers\TrufosAlt.sys
[2011.10.28 17:57:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-664893872-1263777797-2991827239-1000Core.job
[2011.10.19 18:47:31 | 000,000,921 | ---- | M] () -- C:\Users\oli\Desktop\Trillian.lnk
[2011.10.19 15:56:15 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.10.19 15:56:15 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.10.19 15:56:15 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.10.15 16:10:23 | 000,023,531 | ---- | M] () -- C:\Users\oli\Desktop\Biografie - Herwig Zack.pdf
[2011.10.13 17:43:23 | 002,535,280 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.10.06 19:29:13 | 000,275,194 | ---- | M] () -- C:\Users\oli\Desktop\Ticket-4642-6888-3978.pdf
[2011.10.01 03:42:56 | 001,638,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
========== Files Created - No Company Name ==========
[2011.10.30 12:25:49 | 000,001,074 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.10.28 18:48:49 | 000,001,947 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.10.15 16:10:23 | 000,023,531 | ---- | C] () -- C:\Users\oli\Desktop\Biografie - Herwig Zack.pdf
[2011.10.06 19:29:13 | 000,275,194 | ---- | C] () -- C:\Users\oli\Desktop\Ticket-4642-6888-3978.pdf
[2011.04.10 20:31:18 | 000,008,704 | ---- | C] () -- C:\Windows\System32\CNMVS78.DLL
[2011.01.14 00:17:41 | 000,000,033 | ---- | C] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
[2011.01.14 00:14:50 | 000,001,302 | ---- | C] () -- C:\ProgramData\ss.ini
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010.02.27 22:26:13 | 000,004,608 | ---- | C] () -- C:\Users\oli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.29 23:34:52 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009.11.23 21:45:09 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2009.11.16 20:38:25 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.09.30 04:14:28 | 000,647,376 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.09.30 04:14:28 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.09.30 04:14:28 | 000,127,404 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.09.30 04:14:28 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.30 08:17:23 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009.07.29 16:33:13 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2009.07.29 16:32:04 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2009.07.29 16:32:04 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2009.07.29 16:27:22 | 000,004,280 | ---- | C] () -- C:\Windows\HotFixList.ini
[2009.07.29 16:26:12 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.07.29 14:26:36 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009.07.29 14:26:27 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 002,535,280 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,610,094 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,104,412 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008.09.11 16:45:02 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll
[2008.02.09 17:03:07 | 000,024,576 | ---- | C] () -- C:\Windows\System32\drivers\Marker.exe
[2007.04.16 03:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin
[2007.02.26 08:49:12 | 006,139,774 | ---- | C] () -- C:\Windows\imagine digital freedom.dat
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:798A3728
< End of report >
und noch die installierten Programme: Code:
Adobe AIR Adobe Systems Incorporated 09.06.2011 2.6.0.19140
Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen Adobe Systems Incorporated 28.12.2009 2.996MB 1.0
Adobe ExtendScript Toolkit 2 Adobe Systems Incorporated 28.12.2009 16,4MB 2.0.2
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 10.11.2010 6,00MB 10.1.102.64
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 07.06.2011 6,00MB 10.3.181.22
Adobe Premiere Pro CS4 Adobe Systems Incorporated 13.01.2011 1.891MB 4
Adobe Reader 9 - Deutsch Adobe Systems Incorporated 12.11.2009 230MB 9.0.0
Adobe Shockwave Player 11.5 Adobe Systems, Inc. 11.10.2010 11.5.8.612
Alice Greenfingers Oberon Media 28.12.2009
Apple Application Support Apple Inc. 15.05.2011 52,8MB 1.4.1
Apple Software Update Apple Inc. 15.05.2011 2,16MB 2.1.1.116
Atheros WLAN Client WLAN 29.07.2009 14.00.0000
Avira Free Antivirus Avira 27.10.2011 105,4MB 12.0.0.861
BatteryLifeExtender Samsung 29.07.2009 4,71MB 1.0.0
BS.Player FREE Webteh, d.o.o. 28.12.2009 2.50.1017
Cake Mania Oberon Media 28.12.2009
Canon Inkjet Printer Driver Add-On Module 09.04.2011
Canon iP4200 09.04.2011
Canon RAW Codec Canon Inc. 05.04.2011 1.8.0.68
CCleaner Piriform 29.10.2011 3.12
Chicken Invaders 3 Oberon Media 28.12.2009
Cooking Dash Oberon Media 28.12.2009
CyberLink YouCam CyberLink Corp. 12.11.2009 78,0MB 2.0.2907
Diner Dash 2 Oberon Media 28.12.2009
Dream Chronicles Oberon Media 28.12.2009
Dream Day First Home Oberon Media 28.12.2009
Easy Battery Manager Samsung 28.12.2009 3.2.1.10
Easy Display Manager Samsung Electronics Co., Ltd. 29.07.2009 2.3
Easy Network Manager Samsung 29.07.2009 19,1MB 4.0.2
Easy SpeedUp Manager 28.12.2009 2.0.2.7
Facebook Video Calling 1.0.0.8714 Skype Limited 12.10.2011 3,93MB 1.0.8714
FreeMind 30.01.2011 0.8.1
Galapago Oberon Media 28.12.2009
Game Pack Oberon Media, Inc. 12.11.2009 5.3.0.6
Go Go Gourmet Chef of the Year Oberon Media 28.12.2009
HijackThis 2.0.2 TrendMicro 07.02.2010 2.0.2
ICQ7.2 ICQ 12.10.2010 7.2
Icy Tower v1.2 (11kHz) Free Lunch Design 04.05.2010
imagine digital freedom - Samsung Samsung Electronics Co. Ltd., 29.07.2009 7,50MB 1.0.2.2
Intel(R) Graphics Media Accelerator Driver Intel Corporation 28.12.2009 38.086MB
Intel(R) PROSet/Wireless WiFi Software Intel(R) Corporation 29.07.2009 8,40MB 12.01.2000
Intel® Matrix Storage Manager Intel Corporation 28.12.2009
Java(TM) 6 Update 18 Sun Microsystems, Inc. 15.02.2010 94,5MB 6.0.180
Malwarebytes' Anti-Malware Version 1.51.2.1300 Malwarebytes Corporation 29.10.2011 13,8MB 1.51.2.1300
Microsoft IntelliType Pro 8.2 Microsoft Corporation 27.08.2011 8.20.469.0
Microsoft Office Access 2007 Microsoft Corporation 28.12.2009 12.0.4518.1014
Microsoft Office Excel 2007 Microsoft Corporation 28.12.2009 12.0.4518.1014
Microsoft Office Outlook 2007 Microsoft Corporation 23.08.2010 12.0.4518.1014
Microsoft Office PowerPoint 2007 Microsoft Corporation 28.12.2009 12.0.4518.1014
Microsoft Office Project Standard 2007 Microsoft Corporation 02.01.2011 12.0.4518.1014
Microsoft Office Word 2007 Microsoft Corporation 28.12.2009 12.0.4518.1014
Microsoft Silverlight Microsoft Corporation 12.11.2009 11,8MB 2.0.31005.0
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 12.11.2009 1,74MB 3.1.0000
Microsoft SQL Server Native Client Microsoft Corporation 12.11.2009 2,60MB 9.00.3042.00
Microsoft SQL Server VSS Writer Microsoft Corporation 12.11.2009 0,69MB 9.00.3042.00
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 29.07.2009 0,58MB 9.0.30729
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 27.10.2011 11,1MB 10.0.40219
Mozilla Firefox (3.6.23) Mozilla 28.09.2011 3.6.23 (de)
Mozilla Thunderbird (3.1.15) Mozilla 27.09.2011 3.1.15 (de)
MPEG Video Wizard DVD 5.0.0.110 (12/2010) Womble Multimedia, Inc. 20.01.2011 5.0.0.110
PCTroubleshooting Samsung Electronics Co.,LTD. 12.11.2009 1,93MB 2.0.0.4
Prezi Desktop Prezi Inc 15.06.2011 3.038
QuickTime Apple Inc. 15.05.2011 73,7MB 7.69.80.9
Realtek 8136 8168 8169 Ethernet Driver Realtek 29.07.2009 1.00.0007
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 28.12.2009 6.0.1.5892
Samsung Magic Doctor Samsung Electronics Co., LTD 28.12.2009 5.0
Samsung Recovery Solution III Samsung 29.07.2009 3.0.0.9
Samsung Update Plus Samsung Electronics Co., Ltd. 29.07.2009 2.0
Synaptics Pointing Device Driver Synaptics 28.12.2009 11.1.3.2
Trillian 28.12.2009
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) Microsoft Corporation 12.11.2009 25,1MB 9.00.3042.00
User Guide 28.12.2009 1.0
VLC media player 1.1.5 VideoLAN 18.01.2011 1.1.5
WIDCOMM Bluetooth Software 6.1.0.5200 WIDCOMM, Inc. 12.11.2009 38,4MB 6.1.0.5200
Windows Live Anmelde-Assistent Microsoft Corporation 12.11.2009 1,93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 28.12.2009 14.0.8064.0206
Windows Live Sync Microsoft Corporation 12.11.2009 2,80MB 14.0.8064.206
Windows Live-Uploadtool Microsoft Corporation 12.11.2009 0,22MB 14.0.8014.1029
Windows Media Player Firefox Plugin Microsoft Corp 24.02.2011 0,29MB 1.0.0.8
WinRAR 28.12.2009
Zuma Deluxe Oberon Media 28.12.2009
Vielen Dank für die Hilfe !! |
