|
GUV Trojaner 2.07 blockiert meinen Rechner Hallo, habe mir den GuV 2.07 Tjonaner eingefangen. Dieser blockiert bei bestehender I-Net Verbindung meinen Rechner. Habe die Kaspersky Rescue Disk 10 durchlaufen lassen, was zu keinem Erfolg/Fund führte. Hier die ODT files: OTL logfile created on: 28.07.2012 14:18:03 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\****\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,87 Gb Total Physical Memory | 0,62 Gb Available Physical Memory | 33,22% Memory free 3,73 Gb Paging File | 2,06 Gb Available in Paging File | 55,19% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 216,89 Gb Total Space | 77,83 Gb Free Space | 35,88% Space Free | Partition Type: NTFS Drive D: | 15,70 Gb Total Space | 2,26 Gb Free Space | 14,42% Space Free | Partition Type: NTFS Drive E: | 268,94 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive F: | 1,95 Gb Total Space | 1,52 Gb Free Space | 77,68% Space Free | Partition Type: FAT32 Computer Name: HANS-HP | User Name: HANS | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\HANS\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe () PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.) PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) PRC - C:\Users\HANS\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited) PRC - C:\PROGRA~2\AD-AWA~1\AdAware.exe (Lavasoft Limited) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software) PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () PRC - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () PRC - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe () PRC - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Company) PRC - C:\Windows\SysWOW64\ezSharedSvcHost.exe (EasyBits Software AS) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Windows\PixArt\PAC7302\Monitor.exe (PixArt Imaging Incorporation) ========== Modules (No Company Name) ========== MOD - C:\Users\HANS\AppData\Local\Temp\rty0_7z.exe () MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll () MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe () MOD - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\6ec4dc5649a0969dd383d88a2f0e3faa\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll () MOD - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf () MOD - C:\Program Files (x86)\DivX\DivX Plus Web Player\libxml2.dll () MOD - C:\Program Files (x86)\ManyCam\Bin\opencv_imgproc220.dll () MOD - C:\Program Files (x86)\ManyCam\Bin\opencv_core220.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Program Files (x86)\ShiningMorning\MagicCamera\driver\My Webcam.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll () MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll () ========== Win32 Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (vToolbarUpdater11.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe () SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (Ad-Aware Service) -- C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (SBAMSvc) -- C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software) SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (HPWMISVC) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe () SRV - (HP Wireless Assistant Service) -- C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard Company) SRV - (RtVOsdService) -- C:\Programme\Realtek\RtVOsd\RtVOsdService.exe (Realtek Semiconductor Corp.) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (GameConsoleService) -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (mcaudrv_simple) -- C:\Windows\SysNative\drivers\mcaudrv_x64.sys (ManyCam LLC) DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\mcvidrv_x64.sys (ManyCam LLC) DRV:64bit: - (SbFw) -- C:\Windows\SysNative\drivers\SbFw.sys (GFI Software) DRV:64bit: - (sbwtis) -- C:\Windows\SysNative\drivers\sbwtis.sys (GFI Software) DRV:64bit: - (sbhips) -- C:\Windows\SysNative\drivers\sbhips.sys (GFI Software) DRV:64bit: - (sbapifs) -- C:\Windows\SysNative\drivers\sbapifs.sys (GFI Software) DRV:64bit: - (motusbdevice) -- C:\Windows\SysNative\drivers\motusbdevice.sys (Motorola Inc) DRV:64bit: - (SBRE) -- C:\Windows\SysNative\drivers\sbredrv.sys (GFI Software) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (SBFWIMCLMP) -- C:\Windows\SysNative\drivers\SbFwIm.sys (GFI Software) DRV:64bit: - (SBFWIMCL) -- C:\Windows\SysNative\drivers\SbFwIm.sys (GFI Software) DRV:64bit: - (WCMVCAM) -- C:\Windows\SysNative\drivers\wcmvcam64.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (motccgp) -- C:\Windows\SysNative\drivers\motccgp.sys (Motorola) DRV:64bit: - (motmodem) -- C:\Windows\SysNative\drivers\motmodem.sys (Motorola) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (Motousbnet) -- C:\Windows\SysNative\drivers\Motousbnet.sys (Motorola) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (azvusb) -- C:\Windows\SysNative\drivers\azvusb.sys (AzureWave Technologies, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.) DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.) DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp) DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell) DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (motccgpfl) -- C:\Windows\SysNative\drivers\motccgpfl.sys (Motorola) DRV:64bit: - (BTCFilterService) -- C:\Windows\SysNative\drivers\motfilt.sys (Motorola Inc) DRV:64bit: - (DRHARD64) -- C:\Windows\SysNative\drivers\DRHARD64.sys (Licensed for Gebhard Software) DRV:64bit: - (mod7700) -- C:\Windows\SysNative\drivers\mod7700.sys (DiBcom SA) DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV:64bit: - (MotoSwitchService) -- C:\Windows\SysNative\drivers\motswch.sys (Motorola) DRV:64bit: - (PAC7302) -- C:\Windows\SysNative\drivers\PAC7302.SYS (PixArt Imaging Inc.) DRV - (SBRE) -- C:\Windows\SysWOW64\drivers\SBREDrv.sys (GFI Software) DRV - (RSUSBSTOR) -- C:\Windows\SysWOW64\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (DRHARD64) -- C:\Windows\SysWOW64\drivers\DRHARD64.sys (Licensed for Gebhard Software) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {17D07DCA-9963-4B64-B041-470C1D18FB16} IE:64bit: - HKLM\..\SearchScopes\{17D07DCA-9963-4B64-B041-470C1D18FB16}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox IE:64bit: - HKLM\..\SearchScopes\{CA79E86B-1399-4F6C-BA68-E2E61C5DFA1E}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} IE:64bit: - HKLM\..\SearchScopes\{D76C7D49-129A-404B-B4CB-8F360FD6F13F}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 IE - HKLM\..\SearchScopes,DefaultScope = {17D07DCA-9963-4B64-B041-470C1D18FB16} IE - HKLM\..\SearchScopes\{17D07DCA-9963-4B64-B041-470C1D18FB16}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox IE - HKLM\..\SearchScopes\{CA79E86B-1399-4F6C-BA68-E2E61C5DFA1E}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} IE - HKLM\..\SearchScopes\{D76C7D49-129A-404B-B4CB-8F360FD6F13F}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={F985C235-6E06-42ED-835F-6B03449CCE41}&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&lang=de&ds=od011&pr=sa&d=2012-07-12 10:37:48&v=11.1.0.12&sap=hp IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MYC-ST&o=102869&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=5J&apn_dtid=YYYYYYYYDE&apn_uid=2ecb1320-4ad0-4ee8-9304-42d89ac3f03b&apn_sauid=F9C4E419-5948-4468-9DDA-676F824B14AC IE - HKCU\..\SearchScopes\{17D07DCA-9963-4B64-B041-470C1D18FB16}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={F985C235-6E06-42ED-835F-6B03449CCE41}&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&lang=de&ds=od011&pr=sa&d=2012-07-12 10:37:48&v=11.1.0.12&sap=dsp&q={searchTerms} IE - HKCU\..\SearchScopes\{CA79E86B-1399-4F6C-BA68-E2E61C5DFA1E}: "URL" = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} IE - HKCU\..\SearchScopes\{D76C7D49-129A-404B-B4CB-8F360FD6F13F}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://isearch.avg.com?cid=%7B19039b98-34c3-4f85-bb5b-1cc6ec0d107a%7D&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&ds=od011&v=11.1.0.12&lang=de&pr=sa&d=2012-07-12%2010%3A37%3A48&sap=hp" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B19039b98-34c3-4f85-bb5b-1cc6ec0d107a%7D&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&ds=od011&v=11.1.0.12&lang=de&pr=sa&d=2012-07-12%2010%3A37%3A48&sap=ku&q=" FF - prefs.js..network.proxy.http: "109.123.126.253" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.03.30 22:50:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.03.30 22:50:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.06.12 13:58:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.07.12 10:38:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 20:11:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.12 01:23:35 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 20:11:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.12 01:23:35 | 000,000,000 | ---D | M] [2010.12.24 20:26:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HANS\AppData\Roaming\mozilla\Extensions [2012.07.27 12:35:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HANS\AppData\Roaming\mozilla\Firefox\Profiles\3umw55nu.default\extensions [2012.06.18 19:55:06 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\HANS\AppData\Roaming\mozilla\Firefox\Profiles\3umw55nu.default\extensions\ich@maltegoetz.de [2012.06.22 01:43:31 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\HANS\AppData\Roaming\mozilla\Firefox\Profiles\3umw55nu.default\extensions\toolbar@ask.com [2012.06.22 01:43:31 | 000,002,328 | ---- | M] () -- C:\Users\HANS\AppData\Roaming\Mozilla\Firefox\Profiles\3umw55nu.default\searchplugins\askcom.xml [2011.05.16 14:12:39 | 000,001,330 | ---- | M] () -- C:\Users\HANS\AppData\Roaming\Mozilla\Firefox\Profiles\3umw55nu.default\searchplugins\wikipedia-en.xml [2012.03.20 15:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.07.27 12:35:40 | 000,184,864 | ---- | M] () (No name found) -- C:\USERS\HANS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3UMW55NU.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI [2012.07.19 20:11:21 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.22 16:17:36 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.06.11 20:59:16 | 000,031,848 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012.06.12 13:58:23 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll [2012.03.20 15:21:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.12 10:37:20 | 000,003,750 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml [2012.03.20 15:21:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.03.20 15:21:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.03.20 15:21:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.20 15:21:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.20 15:21:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://isearch.avg.com/?cid={F985C235-6E06-42ED-835F-6B03449CCE41}&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&lang=de&ds=od011&pr=sa&d=2012-07-12 10:37:48&v=11.1.0.12&sap=hp CHR - default_search_provider: AVG Secure Search (Enabled) CHR - default_search_provider: search_url = hxxp://isearch.avg.com/search?cid={F985C235-6E06-42ED-835F-6B03449CCE41}&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&lang=de&ds=od011&pr=sa&d=2012-07-12 10:37:48&v=11.1.0.12&sap=dsp&q={searchTerms} CHR - default_search_provider: suggest_url = hxxp://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding} CHR - homepage: hxxp://isearch.avg.com/?cid={F985C235-6E06-42ED-835F-6B03449CCE41}&mid=d9a7c60cc20747d0a19a74bd86c54ed1-416a6c0bfe2a5b785f117078de9c5c55452a042a&lang=de&ds=od011&pr=sa&d=2012-07-12 10:37:48&v=11.1.0.12&sap=hp CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.71\npGoogleUpdate3.dll CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\npwinext.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\HANS\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\ O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll () O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe () O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [PAC7302_Monitor] C:\Windows\PixArt\PAC7302\Monitor.exe (PixArt Imaging Incorporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited) O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Communicator] C:\Program Files (x86)\Microsoft Lync\communicator.exe (Microsoft Corporation) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe () O4 - Startup: C:\Users\HANS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\HANS\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Lync-Add-On - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Lync-Add-On - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E138912E-61A2-4183-8D8D-A83EC7F04021}: DhcpNameServer = 192.168.178.1 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll () O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{3481df78-6803-11e0-9584-c0cb38316c3e}\Shell - "" = AutoRun O33 - MountPoints2\{3481df78-6803-11e0-9584-c0cb38316c3e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{3481df7d-6803-11e0-9584-c0cb38316c3e}\Shell - "" = AutoRun O33 - MountPoints2\{3481df7d-6803-11e0-9584-c0cb38316c3e}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{3481e030-6803-11e0-9584-9dc2b942ef48}\Shell - "" = AutoRun O33 - MountPoints2\{3481e030-6803-11e0-9584-9dc2b942ef48}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{92495b5f-b7c9-11e1-b076-ff4629054f51}\Shell - "" = AutoRun O33 - MountPoints2\{92495b5f-b7c9-11e1-b076-ff4629054f51}\Shell\AutoRun\command - "" = F:\TING.EXE O33 - MountPoints2\{d6823b96-10f2-11e0-badc-daf1d6bb8bea}\Shell - "" = AutoRun O33 - MountPoints2\{d6823b96-10f2-11e0-badc-daf1d6bb8bea}\Shell\AutoRun\command - "" = F:\setup.exe -a O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\TING.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.28 14:16:17 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\HANS\Desktop\OTL.exe [2012.07.28 13:28:43 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{DE2CC60A-80F3-45EA-BD85-14E9C1FC57D1} [2012.07.28 01:53:14 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{22BE46A5-51BE-4A58-984A-5B0AFD57494D} [2012.07.28 01:52:58 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{B4B29EC4-268D-4BF0-8641-2E6DFD0796FE} [2012.07.27 15:41:29 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2012.07.27 01:48:45 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{4487A095-D6C9-4B3D-8ECA-57CE80B036A7} [2012.07.26 13:48:01 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{3A0EDF4E-225F-431C-AFBF-0AC82A167881} [2012.07.25 12:51:25 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{EBF68E95-7235-4935-A241-B60A99D7FE7E} [2012.07.25 12:51:02 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{6F06E05E-13C3-486A-9534-D693B1F89636} [2012.07.25 00:50:31 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{4E463251-35E5-4348-9B8C-DB1FA8D883FB} [2012.07.24 12:49:38 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{42CA68FD-7A36-4F7B-B3B6-66CC8C7A4EF0} [2012.07.24 12:49:16 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{C35673DF-CB69-4C34-8380-3FA4101E0693} [2012.07.23 23:17:31 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{2C1AA254-A40E-446F-8530-8F57BD12C160} [2012.07.23 23:17:05 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{5DA4F6E4-F4CC-49B9-88C4-847B9E8302B4} [2012.07.23 05:52:41 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{A52DA91C-B1C9-4F7D-858A-20CC784B7E65} [2012.07.22 17:49:59 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{44DB6C55-DBCC-4AA7-9280-10DAC9E927AD} [2012.07.22 17:49:45 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{F45DC502-BAD4-4836-906B-28E73A990B14} [2012.07.21 10:24:15 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{E443B5BC-66F9-4A1E-A5F4-133AF51F71B8} [2012.07.21 10:23:59 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{6CBC50F5-9E7B-4534-B9F0-0AB09594B7C6} [2012.07.20 14:44:10 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{1B6045B4-ACC2-4D6B-A7B7-51CF86CEA80A} [2012.07.20 14:43:43 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{88DB8E8A-347F-432D-8A97-5F46CA1F963B} [2012.07.19 13:25:16 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{F108353B-5CFD-4218-B877-FC4DA5276A04} [2012.07.19 13:24:46 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{31EB946B-E564-4F7B-9AE5-DA85B4E9FD28} [2012.07.19 01:07:38 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\ManyCam [2012.07.19 01:07:37 | 000,000,000 | ---D | C] -- C:\ProgramData\ManyCam [2012.07.19 01:07:36 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Roaming\ManyCam [2012.07.18 20:18:06 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{2AFEABC8-B00D-4218-812E-A10BCB830477} [2012.07.15 21:28:34 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{69E843F7-A72D-413F-8F68-C3D83A03C53F} [2012.07.12 10:38:52 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\AVG Secure Search [2012.07.12 10:37:47 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search [2012.07.12 10:37:27 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{EA9BF39F-A923-431F-AA87-C97A5FD8F340} [2012.07.12 10:37:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVG Secure Search [2012.07.12 10:37:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG Secure Search [2012.07.12 10:37:00 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{2D89EC2C-F90B-4A2C-9794-805CB4430C13} [2012.07.12 10:35:32 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.07.11 14:15:55 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Roaming\MyPhoneExplorer [2012.07.11 14:15:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer [2012.07.11 14:15:22 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Roaming\OpenCandy [2012.07.11 14:15:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPhoneExplorer [2012.07.11 13:51:31 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{8E806377-6035-446E-98E1-6DE9810ADE73} [2012.07.11 13:51:08 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{2153E826-E8BF-47A2-8044-CC6A58EDB6D1} [2012.07.11 13:42:47 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012.07.11 13:42:46 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012.07.11 13:42:13 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.07.11 13:41:56 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012.07.11 13:41:42 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012.07.11 01:50:34 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{8CDC8618-B661-4B02-8661-6B730502B522} [2012.07.10 13:48:39 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{3E343D84-6A7A-4ED2-BFD9-D505D77F063A} [2012.07.10 13:48:25 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{74222684-E0D9-4668-84C4-A02805CB5D8B} [2012.07.09 11:58:50 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{EE272BA1-F080-4436-B129-7B97CAB6012A} [2012.07.09 11:57:56 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{658608E5-5413-4321-BBBD-EAA3056EA490} [2012.07.08 18:18:51 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{1377655F-ECFA-4104-A1D8-F715CFAFEC66} [2012.07.06 13:42:12 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{1C1CE3D9-32DB-4B20-B17A-F348D813A0F0} [2012.07.06 13:41:50 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{904D9CFA-DD39-48D7-8D09-AE8FBC8A844B} [2012.07.06 01:41:18 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{C5A793D6-B561-4EFA-AB75-A0130BABDD9F} [2012.07.05 13:39:47 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{AC2BBD4F-9907-4997-9572-6B412424649E} [2012.07.05 13:39:30 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{E7D1B664-EA4B-4144-AE7F-4D581C1AF94E} [2012.07.05 00:16:29 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{806B736F-E3F7-46F9-BD80-0BEA9E3F9EA7} [2012.07.04 12:14:57 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{7A65346B-4D63-47B9-8E83-ADA5F2D1F0B7} [2012.07.04 12:14:33 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{5AC15306-935D-4B81-B8D6-2566609BD48F} [2012.07.04 00:13:57 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{B1B064DB-E097-4BE0-8B63-29E377B453B8} [2012.07.03 12:12:29 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{FC85217C-662B-4F46-B800-AB9582217F27} [2012.07.03 12:11:57 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{FB54E165-D3DF-451B-8CA6-43649ABCF7A1} [2012.07.02 18:31:20 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{75B80820-F061-4403-AEF6-18F14DD4A79B} [2012.07.02 18:30:42 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{F65AA5AB-EAE9-49B6-ACB8-C9A4003B87E3} [2012.07.02 03:21:55 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{BC92A8CD-4E11-4F78-9B00-E99405B37314} [2012.07.02 03:21:30 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{4F4AE0BF-0873-43E2-B7F6-E4253FE103C5} [2012.06.29 13:58:29 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{D1EBF478-6388-4471-AC03-4396E0A8D065} [2012.06.29 13:58:07 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{5D62743C-6A5D-4BA1-9FED-A0DC422E477C} [2012.06.29 01:57:34 | 000,000,000 | ---D | C] -- C:\Users\HANS\AppData\Local\{C85BD1F6-E088-448A-B9A8-906632C9AB0D} [20 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.28 14:16:44 | 001,509,054 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.28 14:16:44 | 000,658,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.28 14:16:44 | 000,619,636 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.28 14:16:44 | 000,131,482 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.28 14:16:44 | 000,107,698 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.28 14:04:30 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\HANS\Desktop\OTL.exe [2012.07.28 13:35:02 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.28 13:35:02 | 000,023,024 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.28 13:29:15 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.28 13:27:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.28 13:27:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.28 13:27:06 | 1501,974,528 | -HS- | M] () -- C:\hiberfil.sys [2012.07.28 01:53:08 | 004,503,728 | ---- | M] () -- C:\ProgramData\z7_0ytr.pad [2012.07.27 12:34:54 | 000,001,078 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Antivirus Scheduled Scan.job [2012.07.27 01:17:36 | 000,001,877 | ---- | M] () -- C:\Users\HANS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.25 15:36:53 | 000,004,817 | ---- | M] () -- C:\Users\HANS\.recently-used.xbel [2012.07.24 18:06:46 | 000,000,441 | ---- | M] () -- C:\Windows\BRWMARK.INI [2012.07.17 12:18:35 | 004,800,512 | ---- | M] () -- C:\Users\HANS\Desktop\DWJNord_Hansi.mdb [2012.07.12 10:34:17 | 000,451,456 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.11 14:15:49 | 000,002,057 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk [2012.07.04 00:46:52 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI [2012.07.02 19:30:05 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForHANS.job [20 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.27 12:34:54 | 000,001,078 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Antivirus Scheduled Scan.job [2012.07.27 01:17:36 | 000,001,877 | ---- | C] () -- C:\Users\HANS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.07.27 01:17:34 | 004,503,728 | ---- | C] () -- C:\ProgramData\z7_0ytr.pad [2012.07.25 15:36:53 | 000,004,817 | ---- | C] () -- C:\Users\HANS\.recently-used.xbel [2012.07.11 14:15:49 | 000,002,057 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk [2012.03.11 16:39:29 | 000,000,043 | ---- | C] () -- C:\ProgramData\.SimImages [2012.01.11 20:52:51 | 000,002,048 | -HS- | C] () -- C:\Users\HANS\AppData\Local\{867a8038-20c6-5611-0b37-1dd75994ce9e}\@ [2011.08.16 03:56:45 | 000,007,605 | ---- | C] () -- C:\Users\HANS\AppData\Local\Resmon.ResmonCfg [2011.05.02 19:19:22 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT [2011.04.27 13:39:50 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat [2011.04.27 13:39:50 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat [2011.04.27 03:04:21 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.01.23 20:35:44 | 000,001,854 | ---- | C] () -- C:\Users\HANS\AppData\Roaming\GhostObjGAFix.xml [2011.01.09 20:04:04 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat [2011.01.07 14:32:22 | 001,536,672 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.12.29 20:17:28 | 000,000,441 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.12.29 20:17:28 | 000,000,053 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2010.12.29 20:17:28 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\bd4040cn.dat [2010.10.08 04:30:04 | 000,000,268 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog2.ini [2010.10.08 04:30:04 | 000,000,209 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog.ini [2010.10.08 04:27:29 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.08.25 20:34:30 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin [2010.08.25 20:34:30 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin ========== LOP Check ========== [2012.06.19 14:05:59 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\Ad-Aware Antivirus [2011.02.23 01:55:08 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\ASCOMP Software [2012.07.28 14:15:35 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\Dropbox [2012.07.25 15:36:46 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\gtk-2.0 [2012.05.14 23:28:16 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\ICQ [2011.04.21 00:23:35 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\LibreOffice [2012.07.19 01:09:37 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\ManyCam [2012.06.04 18:12:09 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\Motorola [2012.07.24 22:46:04 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\MyPhoneExplorer [2012.07.11 14:15:31 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\OpenCandy [2010.12.26 21:13:48 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\OpenOffice.org [2011.03.15 15:55:01 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\PhotoFiltre [2012.07.25 01:57:05 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\SoftGrid Client [2011.01.07 14:33:08 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\TP [2011.10.07 01:29:51 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\WebcamMax [2012.06.06 18:36:07 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\Windows Live Writer [2012.05.03 03:33:27 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\XMedia Recode [2011.08.14 18:52:07 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\XnView [2010.12.26 22:45:32 | 000,000,000 | ---D | M] -- C:\Users\HANS\AppData\Roaming\_MDLogs [2012.07.27 12:34:54 | 000,001,078 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job [2012.05.11 13:53:16 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code: :OTL• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden |
Danke für die schnelle Antwort! :) Habe alles wie beschrieben ausgeführt, hier nun das Textdokument: All processes killed ========== OTL ========== C:\Users\HANS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default User: Default User User: HANS ->Flash cache emptied: 53750 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: HANS ->Temp folder emptied: 371330275 bytes ->Temporary Internet Files folder emptied: 11790555 bytes ->Java cache emptied: 17452974 bytes ->FireFox cache emptied: 1081974714 bytes ->Google Chrome cache emptied: 171603204 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 62257004 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes RecycleBin emptied: 6231371 bytes Total Files Cleaned = 1.643,00 mb OTL by OldTimer - Version 3.2.55.0 log created on 07282012_150009 Files\Folders moved on Reboot... C:\Users\HANS\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... File C:\Users\HANS\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found! Registry entries deleted on Reboot... |
sehr gut Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
|
Das ist erledigt und wirft folgendes Log aus: Combofix Logfile: Code: ComboFix 12-07-27.03 - HANS 28.07.2012 15:20:56.1.4 - x64 |
hi malwarebytes: Downloade Dir bitte Malwarebytes
|
Vielen Dank! Also, Malwarebytes ist durchgelaufen und hat keinen Fehler finden können. Code: Malwarebytes Anti-Malware (Test) 1.62.0.1300Allerdings hat wärend des Suchlaufs AntiVir angeschlagen und 2 Funde gemeldet. Ich hänge hier den Report noch mit an: Code: |
wir der pc für onlinebanking zum einkaufen, für sonstige zahlungsabwicklungen, oder ähnlcih wichtigem verwendet, wie zb berufliches? |
Hallo markus, Um deine Frage zu beantworten: OnlineBanking: Nein Einkäufe: ja (ebay, amazon, paypal) Beruflich: eher Nein(als Ersatz) ich hoffe das hilft weiter. :) |
ok du hast das zero access rootkit auf dem pc. deswegen musst du später alle passwörter endern. da wir das nicht mit 100 %iger sicherheit entfernen können: der pc muss neu aufgesetzt und dann abgesichert werden 1. Datenrettung:
ich werde außerdem noch weitere punkte dazu posten. 4. alle Passwörter ändern! 5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen. 6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 05:26 Uhr. |
Copyright ©2000-2025, Trojaner-Board