Trojaner-Board - runctf mit Webcam - verbliebene Systemsicherheit nach Deaktivierung im Autostart

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - runctf mit Webcam - verbliebene Systemsicherheit nach Deaktivierung im Autostart (https://www.trojaner-board.de/130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart.html)

runctf mit Webcam - verbliebene Systemsicherheit nach Deaktivierung im Autostart

Hi,

ich habe mir gestern den im Betreff beschriebenen Virus gefangen; zunächst angezeigt im G-Data Virenscanner und trotz Quarantänebefehls eingenistet.

Ich habe ihn nach Einlesen über das Läppie meiner Frau im Autostart deaktivieren können, möchte ihn jedoch ganz eliminieren.

Zunächst die Logs:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 17:14 on 03/02/2013 (Geschäft)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

Code:

OTL logfile created on: 03.02.2013 17:14:48 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Geschäft\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 5,50 Gb Available Physical Memory | 68,72% Memory free

15,99 Gb Paging File | 13,33 Gb Available in Paging File | 83,36% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 931,41 Gb Total Space | 429,81 Gb Free Space | 46,15% Space Free | Partition Type: NTFS

 

Computer Name: ANDI | User Name: Geschäft | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.02.03 12:57:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Geschäft\Desktop\OTL.exe

PRC - [2013.01.26 21:30:44 | 000,308,368 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe

PRC - [2013.01.09 13:01:22 | 001,035,216 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe

PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.11.29 05:20:10 | 001,475,096 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe

PRC - [2012.11.29 04:49:49 | 001,548,312 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe

PRC - [2012.11.29 04:47:08 | 000,469,016 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe

PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2012.06.11 15:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe

PRC - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe

PRC - [2009.08.24 13:38:06 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE

PRC - [2008.11.09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\SysWOW64\PSIService.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2010.04.06 15:30:38 | 000,031,272 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\AppleChargerSrv.exe -- (AppleChargerSrv)

SRV - [2013.01.26 23:14:25 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.11.29 05:14:21 | 002,377,736 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe -- (GDFwSvc)

SRV - [2012.11.29 05:08:54 | 002,012,592 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe -- (AVKWCtl)

SRV - [2012.11.29 04:49:49 | 001,548,312 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)

SRV - [2012.11.29 04:47:08 | 000,469,016 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe -- (AVKService)

SRV - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012.08.02 12:42:04 | 008,786,848 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Wacom\Wacom_Tablet.exe -- (TabletServiceWacom)

SRV - [2012.08.02 12:42:04 | 000,565,152 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Wacom\Wacom_TouchService.exe -- (TouchServiceWacom)

SRV - [2012.06.11 15:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe -- (BBUpdate)

SRV - [2012.06.11 15:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe -- (BBSvc)

SRV - [2012.03.29 03:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)

SRV - [2011.03.28 20:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.02.19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2009.08.24 13:38:06 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.11.09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007.06.05 12:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing)

SRV - [2007.05.31 16:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 16:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.01.29 14:56:00 | 000,062,368 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)

DRV:64bit: - [2013.01.28 18:47:24 | 000,064,416 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)

DRV:64bit: - [2013.01.28 18:47:00 | 000,126,880 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)

DRV:64bit: - [2013.01.28 18:47:00 | 000,065,008 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)

DRV:64bit: - [2013.01.28 18:47:00 | 000,054,176 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)

DRV:64bit: - [2012.06.21 14:12:00 | 000,068,512 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wachidrouter.sys -- (WacHidRouter)

DRV:64bit: - [2012.06.21 14:12:00 | 000,013,728 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidkmdf.sys -- (hidkmdf)

DRV:64bit: - [2012.06.09 19:23:16 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD)

DRV:64bit: - [2012.05.22 13:07:18 | 000,015,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacomrouterfilter.sys -- (wacomrouterfilter)

DRV:64bit: - [2012.04.18 18:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.03.07 10:22:00 | 000,065,280 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronXHCI.sys -- (EtronXHCI)

DRV:64bit: - [2011.03.07 10:22:00 | 000,040,832 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronHub3.sys -- (EtronHub3)

DRV:64bit: - [2011.01.13 12:58:30 | 000,413,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2011.01.10 17:16:08 | 000,021,104 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AppleCharger.sys -- (AppleCharger)

DRV:64bit: - [2010.12.24 10:43:40 | 000,029,288 | -H-- | M] (Wondershare) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Apowersoft_AudioDevice.sys -- (Apowersoft_AudioDevice)

DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009.12.22 01:26:36 | 000,038,456 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)

DRV:64bit: - [2009.12.17 16:49:02 | 000,045,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npusbio_x64.sys -- (npusbio)

DRV:64bit: - [2009.10.07 11:13:34 | 000,070,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009.10.07 11:13:34 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2007.07.02 08:26:04 | 000,176,128 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiH0BAC.sys -- (SaiH0BAC)

DRV:64bit: - [2007.05.09 20:50:48 | 000,050,208 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)

DRV:64bit: - [2007.05.09 20:46:48 | 001,127,328 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)

DRV:64bit: - [2007.05.09 20:46:36 | 000,016,032 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)

DRV - [2013.02.03 11:54:40 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\gdrv.sys -- (gdrv)

DRV - [2012.06.10 11:16:42 | 000,030,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\GVTDrv64.sys -- (GVTDrv64)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.windowslive.de/startseite.aspx

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.afterwork-wellness.info [Binary data over 200 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.babybauchfoto.com/http [Binary data over 200 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.afterwork-wellness.info/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B1 20 1D EF 77 46 CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {19FE483C-A4C3-414A-B536-BDBB61A3078C}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{19FE483C-A4C3-414A-B536-BDBB61A3078C}: "URL" = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}&rlz=1I7ADRA_deDE488

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Geschäft\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101714.dll (Amazon.com, Inc.)

FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

 

 

[2012.08.02 16:09:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Softonic Helper Object) - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.6.4.3\bh\Softonic.dll (Softonic.com)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.6.4.3\SoftonicTlbr.dll (Softonic.com)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4:64bit: - HKLM..\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe" -startup File not found

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

O4 - HKCU..\Run: [AdobeBridge]  File not found

O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A1FB878-21AE-4F1A-A2D8-7F87680368AE}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.02.03 14:23:02 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\Kim Lars

[2013.02.03 12:57:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Geschäft\Desktop\OTL.exe

[2013.02.03 12:28:08 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartEd Pro

[2013.02.03 12:28:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StartEd

[2013.02.03 10:52:27 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{0A5A1C98-7C19-4431-B37D-47FD8BCA6E93}

[2013.02.02 23:44:16 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2013.02.02 22:29:19 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\schon rueber

[2013.02.02 19:05:54 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2013.02.02 19:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2013.02.02 19:05:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2013.02.02 09:54:46 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{FADACF9A-79EE-48EF-A897-A92923FF3825}

[2013.02.01 14:44:01 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4144D4F2-EB83-4F0F-B041-87B6B9160A7E}

[2013.01.31 17:14:28 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{82B2F28E-30E5-4122-A95B-0FE311A0A662}

[2013.01.30 17:09:50 | 000,016,504 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.30 15:15:28 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4E10F33D-91C6-4737-BE9D-2B1A5DEAED63}

[2013.01.29 14:59:09 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4A475983-D59C-44F6-AB23-0E986EFFCBA1}

[2013.01.28 15:26:38 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{2FDF62D3-2A54-4526-83F7-049A5F5585D7}

[2013.01.27 11:05:00 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{BB3F8CAE-3BC5-45BC-A701-A684C552E12B}

[2013.01.26 21:31:49 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{5A8EBA0F-9E99-45D7-9BBD-00641D0C831E}

[2013.01.06 07:35:49 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{85B57DD1-A8F9-487A-AEEF-F822866F5959}

[2013.01.05 11:44:47 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{74DAB6E9-769E-4511-8299-B8CFA099B482}

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.02.03 17:14:02 | 000,000,000 | ---- | M] () -- C:\Users\Geschäft\defogger_reenable

[2013.02.03 17:14:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.02.03 17:09:03 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.02.03 14:22:13 | 000,065,973 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau3.png

[2013.02.03 14:20:22 | 000,078,213 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau2.png

[2013.02.03 14:17:30 | 000,070,909 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau.png

[2013.02.03 13:03:48 | 000,969,322 | ---- | M] () -- C:\Windows\SysWow64\sig.bin

[2013.02.03 13:03:48 | 000,051,749 | ---- | M] () -- C:\Windows\SysWow64\nmp.map

[2013.02.03 12:58:39 | 000,365,568 | ---- | M] () -- C:\Users\Geschäft\Desktop\gmer_2.0.18454.exe

[2013.02.03 12:57:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Geschäft\Desktop\OTL.exe

[2013.02.03 12:55:46 | 000,050,477 | ---- | M] () -- C:\Users\Geschäft\Desktop\Defogger.exe

[2013.02.03 12:28:09 | 000,000,991 | ---- | M] () -- C:\Users\Geschäft\Desktop\StartEd Pro.lnk

[2013.02.03 12:02:03 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.02.03 12:02:03 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.02.03 11:59:33 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.02.03 11:59:33 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.02.03 11:59:33 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.02.03 11:59:33 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.02.03 11:59:33 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.02.03 11:54:56 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.02.03 11:54:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.02.03 11:54:24 | 2145,300,479 | -HS- | M] () -- C:\hiberfil.sys

[2013.01.30 17:09:50 | 000,016,504 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.29 14:56:00 | 000,062,368 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2013.01.28 18:47:24 | 000,064,416 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys

[2013.01.28 18:47:00 | 000,126,880 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2013.01.28 18:47:00 | 000,065,008 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2013.01.28 18:47:00 | 000,054,176 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2013.01.27 10:44:05 | 005,160,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.01.10 14:35:41 | 000,011,240 | ---- | M] (G Data Software AG) -- C:\Windows\SysWow64\GdScrSv.de.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.02.03 17:14:02 | 000,000,000 | ---- | C] () -- C:\Users\Geschäft\defogger_reenable

[2013.02.03 14:22:11 | 000,065,973 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau3.png

[2013.02.03 14:20:19 | 000,078,213 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau2.png

[2013.02.03 14:17:27 | 000,070,909 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau.png

[2013.02.03 12:58:39 | 000,365,568 | ---- | C] () -- C:\Users\Geschäft\Desktop\gmer_2.0.18454.exe

[2013.02.03 12:55:46 | 000,050,477 | ---- | C] () -- C:\Users\Geschäft\Desktop\Defogger.exe

[2013.02.03 12:28:09 | 000,000,991 | ---- | C] () -- C:\Users\Geschäft\Desktop\StartEd Pro.lnk

[2012.08.04 08:52:39 | 000,009,728 | ---- | C] () -- C:\Users\Geschäft\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.07.02 17:45:30 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi

[2012.06.10 13:15:09 | 000,001,316 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys

[2012.06.10 11:57:56 | 000,969,322 | ---- | C] () -- C:\Windows\SysWow64\sig.bin

[2012.06.09 22:18:08 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\nnr.dll

[2012.06.09 20:57:55 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys

[2012.06.09 20:34:55 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.09.19 19:40:30 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Amazon

[2012.07.31 09:06:35 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Apowersoft

[2012.11.20 20:39:07 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\c-software

[2012.06.09 22:50:12 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Canon

[2012.09.26 14:44:11 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2012.11.01 13:02:03 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Elephant Games

[2012.11.11 14:44:45 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\FileZilla

[2012.11.19 20:52:09 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\GOA

[2012.12.30 15:33:34 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\HyperCam

[2012.06.10 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\RawShellExtender

[2013.02.01 17:50:45 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\SKAT

[2012.08.04 08:52:39 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Solveig Multimedia

[2012.09.26 15:15:44 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.11.01 00:30:42 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\UClick

[2012.06.10 12:42:16 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Ulead Systems

[2012.06.12 22:39:08 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Windows Live Writer

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 167 bytes -> C:\ProgramData\TEMP:5E73E1C2
 

< End of report >

Code:

GMER 2.0.18454 - hxxp://www.gmer.net

Rootkit scan 2013-02-03 18:23:30

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005d ST1000DM rev.1AJ1 931,51GB

Running: gmer_2.0.18454.exe; Driver: C:\Users\GESCHF~1\AppData\Local\Temp\pxldrpod.sys
 
 

---- User code sections - GMER 2.0 ----
 

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                           00000000750b1401 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                             00000000750b1419 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                           00000000750b1431 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                           00000000750b144a 2 bytes [0B, 75]

.text  ...                                                                                                                                                                                                * 9

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                              00000000750b14dd 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                       00000000750b14f5 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                              00000000750b150d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                       00000000750b1525 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                             00000000750b153d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                  00000000750b1555 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                           00000000750b156d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                             00000000750b1585 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                00000000750b159d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                             00000000750b15b5 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                           00000000750b15cd 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                       00000000750b16b2 2 bytes [0B, 75]

.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                       00000000750b16bd 2 bytes [0B, 75]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4432] C:\Windows\system32\OLEAUT32.dll!OleCreatePropertyFrameIndirect                                                                              000007feff354ed0 9 bytes [68, 78, 03, 7A, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4432] C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll!PropertySheetW  000007fefc2f5c54 7 bytes [68, 08, 03, 7A, 02, C3, CC]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4432] C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll!PropertySheet   000007fefc2f5c64 9 bytes [68, 40, 03, 7A, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4432] C:\Windows\system32\comdlg32.dll!PageSetupDlgW                                                                                               000007feff6117a0 9 bytes [68, B0, 03, 7A, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtdllDefWindowProc_A                                                                                           000000007744f548 7 bytes JMP 0000000102a40570

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtdllDefWindowProc_W                                                                                           000000007745b0ac 7 bytes JMP 0000000102a405a8

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\kernel32.dll!CreateThread                                                                                                0000000076d66580 9 bytes JMP 0000000102a404c8

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\ole32.dll!OleLoadFromStream                                                                                              000007fefef675f0 7 bytes [68, E0, 05, A4, 02, C3, CC]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\OLEAUT32.dll!VariantClear                                                                                                000007feff2f1180 10 bytes [68, C0, 06, A4, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\OLEAUT32.dll!SysFreeString                                                                                               000007feff2f1320 7 bytes [68, 50, 06, A4, 02, C3, CC]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\OLEAUT32.dll!SysAllocStringByteLen                                                                                       000007feff2f4450 6 bytes [68, 18, 06, A4, 02, C3]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\OLEAUT32.dll!VariantChangeType                                                                                           000007feff2f6720 10 bytes [68, 88, 06, A4, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\OLEAUT32.dll!OleCreatePropertyFrameIndirect                                                                              000007feff354ed0 9 bytes [68, 78, 03, A4, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll!PropertySheetW  000007fefc2f5c54 7 bytes [68, 08, 03, A4, 02, C3, CC]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll!PropertySheet   000007fefc2f5c64 9 bytes [68, 40, 03, A4, 02, C3, CC, ...]

.text  C:\Program Files\Internet Explorer\iexplore.exe[4716] C:\Windows\system32\comdlg32.dll!PageSetupDlgW                                                                                               000007feff6117a0 9 bytes [68, B0, 03, A4, 02, C3, CC, ...]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                00000000750b1401 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                  00000000750b1419 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                00000000750b1431 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                00000000750b144a 2 bytes [0B, 75]

.text  ...                                                                                                                                                                                                * 9

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                   00000000750b14dd 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                            00000000750b14f5 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                   00000000750b150d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                            00000000750b1525 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                  00000000750b153d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                       00000000750b1555 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                00000000750b156d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                  00000000750b1585 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                     00000000750b159d 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                  00000000750b15b5 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                00000000750b15cd 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                            00000000750b16b2 2 bytes [0B, 75]

.text  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe[4856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                            00000000750b16bd 2 bytes [0B, 75]
 

---- EOF - GMER 2.0 ----

Mich interessiert nun die Datensicherheit meines PC - alle Passwörter muss ich neu eingeben - sind diese Zugänge sicher, wenn ich mich wieder einlogge ( gemeint sind Internetzugänge bei Webangeboten/Facebook/Reiseanbieter/weitere...)

Wie kann ich den runctf aus dem Autostart löschen?

Ist Internetbanking relativ sicher?

Ich habe derzeit alle Daten auf externe Festplatten gesichert. Dazu habe ich ein Systemabbild (Systemabbild auf externer Festplatte mittels Win 7 ) vor 6 Monaten gemacht - kann ich dieses im Fall der Fälle gefahrlos nutzen, falls eine Neueinrichtung unabänderlich ist? Ich möchte es jedoch vermeiden, da ich massive Probleme habe, die Treiber für Drucker und Scanner bei Win 7 / 64 erneut einzurichten ( die ja an sich im Systemabbild vorhanden sein müßten :lach: ).

Für die Unterstützung vielen Dank...

justme...

:hallo:

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

:OTL
 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback> 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888 

O4 - HKCU..\Run: [AdobeBridge] File not found 
 

:Files 

C:\ProgramData\*.exe

C:\ProgramData\*.dll

C:\ProgramData\*.tmp

C:\ProgramData\TEMP

C:\Users\Geschäft\*.tmp

C:\Users\Geschäft\AppData\Local\Temp\*.exe

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup unctf.lnk

ipconfig /flushdns /c

:Commands

[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

2. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

3. Schritt
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Vielen Dank :-)

Hier die Logs:

Code:

# AdwCleaner v2.110 - Datei am 04/02/2013 um 09:43:24 erstellt

# Aktualisiert am 03/02/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Geschäft - ANDI

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Geschäft\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\user.js

Ordner Gelöscht : C:\Program Files (x86)\Softonic

Ordner Gelöscht : C:\Users\Geschäft\AppData\LocalLow\Softonic
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.dskBnd

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.dskBnd.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\Software\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}

Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{5018CFD2-804D-4C99-9F81-25EAEA2769DE}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16457
 

[OK] Die Registrierungsdatenbank ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [7711 octets] - [04/02/2013 09:43:24]
 

########## EOF - C:\AdwCleaner[S1].txt - [7771 octets] ##########

Code:

Malwarebytes Anti-Malware (Test) 1.70.0.1100

www.malwarebytes.org
 

Datenbank Version: v2013.02.03.11
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Geschäft :: ANDI [Administrator]
 

Schutz: Aktiviert
 

04.02.2013 00:37:01

mbam-log-2013-02-04 (00-37-01).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 667867

Laufzeit: 1 Stunde(n), 45 Minute(n), 58 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

All processes killed

========== OTL ==========

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.

========== FILES ==========

File\Folder C:\ProgramData\*.exe not found.

File\Folder C:\ProgramData\*.dll not found.

File\Folder C:\ProgramData\*.tmp not found.

C:\ProgramData\TEMP folder moved successfully.

File\Folder C:\Users\Geschäft\*.tmp not found.

C:\Users\Geschäft\AppData\Local\Temp\dgnget.exe moved successfully.

C:\Users\Geschäft\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe moved successfully.

C:\Users\Geschäft\AppData\Local\Temp\ose00000.exe moved successfully.

C:\Users\Geschäft\AppData\Local\Temp\Setup-Wacom.exe moved successfully.

C:\Users\Geschäft\AppData\Local\Temp\softonic_ggl_1.6.4.3.exe moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.

File/Folder C:\Users\Geschäft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup unctf.lnk not found.
 < ipconfig /flushdns /c >

No captured output from command...

C:\Users\Geschäft\Desktop\cmd.bat deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56504 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Geschäft

->Temp folder emptied: 1412618083 bytes

->Temporary Internet Files folder emptied: 2594550407 bytes

->Flash cache emptied: 198116 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 152539684 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 26265383340 bytes

 

Total Files Cleaned = 29.016,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 02032013_225711
 

Files\Folders moved on Reboot...

C:\Users\Geschäft\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WO7OEYSR\plusone_gadget[1].htm moved successfully.

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B00GTTPN\ads[1].htm moved successfully.

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0W8O8GHV\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart[1].htm moved successfully.

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0W8O8GHV\ads[1].htm moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Bin dann mal zur Arbeit...

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Hallo t'john,

getan und abgeschlossen.

Ein Bericht war nicht aufzufinden und auch nicht durch Emsisoft nachträglich aufzurufen; ich erhielt lediglich die Mitteilung, daß keine suspekten Objekte gefunden wurden.

MfG

Andreas

hmmm... runctf befindet sich noch im Autostart der Systemconfig... - deaktiviert...

Schaue bitte in der Anleitung (http://www.trojaner-board.de/103809-...i-malware.html) nach, wo du die Logfiles finden kannst.
Poste das Logfile bitte.

Richtigen OTL-Scan machen:

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Wähle Scanne Alle Benuzer
Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
Unter Extra Registrierung, wähle bitte Benutze SafeList
Klicke nun auf Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Hallo t'john, :dankeschoen:

hier zunächst das File vom Malware:

Code:

Emsisoft Anti-Malware - Version 7.0

Letztes Update: 04.02.2013 22:36:40
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\
 

Riskware-Erkennung: Aus

Archiv Scan: An

ADS Scan: An

Dateitypen-Filter: Aus

Erweitertes Caching: An

Direkter Festplattenzugriff: Aus
 

Scan Beginn:        04.02.2013 22:40:48
 
 

Gescannt        759771

Gefunden        0
 

Scan Ende:        05.02.2013 02:02:30

Scan Zeit:        3:21:42

Folgend der Log vom OTL:

Code:

OTL logfile created on: 05.02.2013 22:20:58 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Geschäft\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

8,00 Gb Total Physical Memory | 5,20 Gb Available Physical Memory | 64,98% Memory free

15,99 Gb Paging File | 12,83 Gb Available in Paging File | 80,25% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 931,41 Gb Total Space | 456,64 Gb Free Space | 49,03% Space Free | Partition Type: NTFS

 

Computer Name: ANDI | User Name: Geschäft | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Geschäft\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)

PRC - C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Emsisoft GmbH)

PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)

PRC - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

PRC - C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

PRC - C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe (Microsoft Corporation.)

PRC - C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

PRC - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()

PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

PRC - C:\Windows\SysWOW64\PSIService.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()

SRV - (a2AntiMalware) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)

SRV - (GDFwSvc) -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG)

SRV - (AVKWCtl) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe (G Data Software AG)

SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

SRV - (AVKService) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)

SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (TabletServiceWacom) -- C:\Programme\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.)

SRV - (TouchServiceWacom) -- C:\Programme\Tablet\Wacom\Wacom_TouchService.exe (Wacom Technology, Corp.)

SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe (Microsoft Corporation.)

SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe (Microsoft Corporation.)

SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

SRV - (ES lite Service) -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (YahooAUService) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)

SRV - (ProtexisLicensing) -- C:\Windows\SysWOW64\PSIService.exe ()

SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)

SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (GDPkIcpt) -- C:\Windows\SysNative\drivers\PktIcpt.sys (G Data Software AG)

DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG)

DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG)

DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G Data Software AG)

DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG)

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (WacHidRouter) -- C:\Windows\SysNative\drivers\wachidrouter.sys (Wacom Technology)

DRV:64bit: - (hidkmdf) -- C:\Windows\SysNative\drivers\hidkmdf.sys (Windows (R) Win 7 DDK provider)

DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software)

DRV:64bit: - (wacomrouterfilter) -- C:\Windows\SysNative\drivers\wacomrouterfilter.sys (Wacom Technology)

DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)

DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()

DRV:64bit: - (Apowersoft_AudioDevice) -- C:\Windows\SysNative\drivers\Apowersoft_AudioDevice.sys (Wondershare)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (npusbio) -- C:\Windows\SysNative\drivers\npusbio_x64.sys ()

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (SaiH0BAC) -- C:\Windows\SysNative\drivers\SaiH0BAC.sys (Saitek)

DRV:64bit: - (LVUSBS64) -- C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.)

DRV:64bit: - (PID_PEPI) -- C:\Windows\SysNative\drivers\LV302V64.SYS (Logitech Inc.)

DRV:64bit: - (lvpepf64) -- C:\Windows\SysNative\drivers\lv302a64.sys (Logitech Inc.)

DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)

DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()

DRV - (a2acc) -- C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys (Emsisoft GmbH)

DRV - (a2injectiondriver) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys (Emsisoft GmbH)

DRV - (A2DDA) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys (Emsi Software GmbH)

DRV - (a2util) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys (Emsi Software GmbH)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.windowslive.de/startseite.aspx

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.afterwork-wellness.info [Binary data over 200 bytes]

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.babybauchfoto.com/http [Binary data over 200 bytes]

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.afterwork-wellness.info/

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B1 20 1D EF 77 46 CD 01  [binary data]

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\..\SearchScopes,DefaultScope = {19FE483C-A4C3-414A-B536-BDBB61A3078C}

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\..\SearchScopes\{19FE483C-A4C3-414A-B536-BDBB61A3078C}: "URL" = hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}&rlz=1I7ADRA_deDE488

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Geschäft\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101714.dll (Amazon.com, Inc.)

FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

 

 

[2012.08.02 16:09:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

O3:64bit: - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4:64bit: - HKLM..\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe" -startup File not found

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1571012534-911800545-3409040398-1000..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2013.02.03 23:00:31 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 [2013.02.04 09:46:23 | 000,000,000 | ---D | M]

O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0A1FB878-21AE-4F1A-A2D8-7F87680368AE}: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.02.05 22:22:15 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{ECEDFA12-27A1-41F9-A665-47EBDE9A1D8F}

[2013.02.05 11:00:08 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\Neuer Ordner

[2013.02.04 23:54:57 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{D884BA10-6A64-4EBF-8C83-C87BC64898D0}

[2013.02.04 22:34:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware

[2013.02.04 22:34:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware

[2013.02.04 22:34:12 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Documents\Anti-Malware

[2013.02.04 11:40:34 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4D8512B9-747B-4D8B-BA81-28AFF8317830}

[2013.02.04 00:33:46 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Roaming\Malwarebytes

[2013.02.04 00:33:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.02.04 00:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.02.04 00:33:38 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2013.02.04 00:33:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2013.02.04 00:33:19 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\Programs

[2013.02.04 00:30:44 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\2

[2013.02.03 23:00:21 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\1

[2013.02.03 22:57:11 | 000,000,000 | ---D | C] -- C:\_OTL

[2013.02.03 20:14:12 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\Daisy

[2013.02.03 14:23:02 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\Kim Lars

[2013.02.03 12:57:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Geschäft\Desktop\OTL.exe

[2013.02.03 12:28:08 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartEd Pro

[2013.02.03 12:28:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StartEd

[2013.02.03 10:52:27 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{0A5A1C98-7C19-4431-B37D-47FD8BCA6E93}

[2013.02.02 23:44:16 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2013.02.02 22:29:19 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\schon rueber

[2013.02.02 19:05:54 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2013.02.02 19:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2013.02.02 19:05:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2013.02.02 09:54:46 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{FADACF9A-79EE-48EF-A897-A92923FF3825}

[2013.02.01 14:44:01 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4144D4F2-EB83-4F0F-B041-87B6B9160A7E}

[2013.01.31 17:14:28 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{82B2F28E-30E5-4122-A95B-0FE311A0A662}

[2013.01.30 17:09:50 | 000,016,504 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.30 15:15:28 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4E10F33D-91C6-4737-BE9D-2B1A5DEAED63}

[2013.01.29 14:59:09 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{4A475983-D59C-44F6-AB23-0E986EFFCBA1}

[2013.01.28 15:26:38 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{2FDF62D3-2A54-4526-83F7-049A5F5585D7}

[2013.01.27 12:13:11 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\Desktop\Madeira 2013

[2013.01.27 11:05:00 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{BB3F8CAE-3BC5-45BC-A701-A684C552E12B}

[2013.01.26 21:40:43 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll

[2013.01.26 21:40:43 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll

[2013.01.26 21:40:25 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2013.01.26 21:40:23 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll

[2013.01.26 21:40:18 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll

[2013.01.26 21:40:18 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs

[2013.01.26 21:40:18 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs

[2013.01.26 21:40:18 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs

[2013.01.26 21:40:18 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs

[2013.01.26 21:40:18 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs

[2013.01.26 21:40:18 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs

[2013.01.26 21:40:18 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs

[2013.01.26 21:40:18 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs

[2013.01.26 21:40:18 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs

[2013.01.26 21:40:18 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs

[2013.01.26 21:40:18 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs

[2013.01.26 21:40:18 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs

[2013.01.26 21:40:18 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs

[2013.01.26 21:40:18 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs

[2013.01.26 21:40:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs

[2013.01.26 21:40:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs

[2013.01.26 21:40:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs

[2013.01.26 21:40:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs

[2013.01.26 21:40:18 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs

[2013.01.26 21:40:18 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs

[2013.01.26 21:40:17 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll

[2013.01.26 21:40:17 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll

[2013.01.26 21:40:17 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll

[2013.01.26 21:40:16 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs

[2013.01.26 21:40:16 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs

[2013.01.26 21:40:16 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs

[2013.01.26 21:40:16 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs

[2013.01.26 21:40:16 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs

[2013.01.26 21:40:16 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs

[2013.01.26 21:40:16 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs

[2013.01.26 21:40:16 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs

[2013.01.26 21:40:01 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll

[2013.01.26 21:40:00 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll

[2013.01.26 21:40:00 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll

[2013.01.26 21:40:00 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe

[2013.01.26 21:40:00 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2013.01.26 21:40:00 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll

[2013.01.26 21:40:00 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe

[2013.01.26 21:40:00 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2013.01.26 21:40:00 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll

[2013.01.26 21:40:00 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2013.01.26 21:40:00 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe

[2013.01.26 21:40:00 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

[2013.01.26 21:40:00 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll

[2013.01.26 21:40:00 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

[2013.01.26 21:40:00 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll

[2013.01.26 21:40:00 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll

[2013.01.26 21:40:00 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

[2013.01.26 21:40:00 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

[2013.01.26 21:40:00 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll

[2013.01.26 21:40:00 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe

[2013.01.26 21:39:51 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe

[2013.01.26 21:31:49 | 000,000,000 | ---D | C] -- C:\Users\Geschäft\AppData\Local\{5A8EBA0F-9E99-45D7-9BBD-00641D0C831E}

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.02.05 22:19:48 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.02.05 22:19:48 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.02.05 22:18:06 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.02.05 22:18:06 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.02.05 22:18:06 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.02.05 22:18:06 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.02.05 22:18:06 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.02.05 22:14:04 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.02.05 22:12:26 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.02.05 22:12:25 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys

[2013.02.05 22:12:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.02.05 22:12:09 | 2145,300,479 | -HS- | M] () -- C:\hiberfil.sys

[2013.02.05 12:09:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.02.05 10:31:32 | 000,970,754 | ---- | M] () -- C:\Windows\SysWow64\sig.bin

[2013.02.05 10:31:32 | 000,051,784 | ---- | M] () -- C:\Windows\SysWow64\nmp.map

[2013.02.05 00:33:57 | 020,855,296 | ---- | M] () -- C:\Users\Geschäft\Desktop\Briefbogen Fotografie-emotion Baby.ufo

[2013.02.04 22:34:49 | 000,001,091 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2013.02.04 12:15:28 | 000,071,666 | ---- | M] () -- C:\Users\Geschäft\Desktop\04.02.2013.pdf

[2013.02.04 09:41:06 | 000,582,093 | ---- | M] () -- C:\Users\Geschäft\Desktop\adwcleaner.exe

[2013.02.04 00:33:40 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.02.03 17:14:02 | 000,000,000 | ---- | M] () -- C:\Users\Geschäft\defogger_reenable

[2013.02.03 14:22:13 | 000,065,973 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau3.png

[2013.02.03 14:20:22 | 000,078,213 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau2.png

[2013.02.03 14:17:30 | 000,070,909 | ---- | M] () -- C:\Users\Geschäft\Desktop\Vorschau.png

[2013.02.03 12:58:39 | 000,365,568 | ---- | M] () -- C:\Users\Geschäft\Desktop\gmer_2.0.18454.exe

[2013.02.03 12:57:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Geschäft\Desktop\OTL.exe

[2013.02.03 12:55:46 | 000,050,477 | ---- | M] () -- C:\Users\Geschäft\Desktop\Defogger.exe

[2013.02.03 12:28:09 | 000,000,991 | ---- | M] () -- C:\Users\Geschäft\Desktop\StartEd Pro.lnk

[2013.01.30 17:09:50 | 000,016,504 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys

[2013.01.29 14:56:00 | 000,062,368 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys

[2013.01.28 18:47:24 | 000,064,416 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys

[2013.01.28 18:47:00 | 000,126,880 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys

[2013.01.28 18:47:00 | 000,065,008 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys

[2013.01.28 18:47:00 | 000,054,176 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys

[2013.01.27 10:44:05 | 005,160,848 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.01.26 23:14:15 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2013.01.26 23:14:15 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2013.01.10 14:35:41 | 000,011,240 | ---- | M] (G Data Software AG) -- C:\Windows\SysWow64\GdScrSv.de.dll

 
 ========== Files Created - No Company Name ==========

 

[2013.02.04 22:34:48 | 000,001,091 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2013.02.04 12:15:28 | 000,071,666 | ---- | C] () -- C:\Users\Geschäft\Desktop\04.02.2013.pdf

[2013.02.04 09:41:06 | 000,582,093 | ---- | C] () -- C:\Users\Geschäft\Desktop\adwcleaner.exe

[2013.02.04 00:33:40 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.02.03 22:49:01 | 020,855,296 | ---- | C] () -- C:\Users\Geschäft\Desktop\Briefbogen Fotografie-emotion Baby.ufo

[2013.02.03 17:14:02 | 000,000,000 | ---- | C] () -- C:\Users\Geschäft\defogger_reenable

[2013.02.03 14:22:11 | 000,065,973 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau3.png

[2013.02.03 14:20:19 | 000,078,213 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau2.png

[2013.02.03 14:17:27 | 000,070,909 | ---- | C] () -- C:\Users\Geschäft\Desktop\Vorschau.png

[2013.02.03 12:58:39 | 000,365,568 | ---- | C] () -- C:\Users\Geschäft\Desktop\gmer_2.0.18454.exe

[2013.02.03 12:55:46 | 000,050,477 | ---- | C] () -- C:\Users\Geschäft\Desktop\Defogger.exe

[2013.02.03 12:28:09 | 000,000,991 | ---- | C] () -- C:\Users\Geschäft\Desktop\StartEd Pro.lnk

[2012.08.04 08:52:39 | 000,009,728 | ---- | C] () -- C:\Users\Geschäft\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.07.02 17:45:30 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi

[2012.06.10 13:15:09 | 000,001,316 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys

[2012.06.10 11:57:56 | 000,970,754 | ---- | C] () -- C:\Windows\SysWow64\sig.bin

[2012.06.09 22:18:08 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\nnr.dll

[2012.06.09 20:57:55 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys

[2012.06.09 20:34:55 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.09.19 19:40:30 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Amazon

[2012.07.31 09:06:35 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Apowersoft

[2012.11.20 20:39:07 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\c-software

[2012.06.09 22:50:12 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Canon

[2012.09.26 14:44:11 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2012.11.01 13:02:03 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Elephant Games

[2012.11.11 14:44:45 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\FileZilla

[2012.11.19 20:52:09 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\GOA

[2012.12.30 15:33:34 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\HyperCam

[2012.06.10 13:20:12 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\RawShellExtender

[2013.02.01 17:50:45 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\SKAT

[2012.08.04 08:52:39 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Solveig Multimedia

[2012.09.26 15:15:44 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.11.01 00:30:42 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\UClick

[2012.06.10 12:42:16 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Ulead Systems

[2012.06.12 22:39:08 | 000,000,000 | ---D | M] -- C:\Users\Geschäft\AppData\Roaming\Windows Live Writer

 
 ========== Purity Check ==========

 

 
 

< End of report >

Hier ender jedoch auch schon die Ausgabe; ein zweites OTL-Logfile konnte ich nicht finden - auch nicht - auch nicht in dem OTL-Pfad. :daumenrunter:

Eine nachträgliche Kontrolle hat ergeben, daß ich genau nach Anleitung vorgegangen bin...

An dieser Stelle auch mal ein herzliches Danke für die bisherige tolle Unterstützung...

MfG Andreas

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL
 

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback> 

IE - HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8888;https=127.0.0.1:8888 

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) 
 

:Files 
 

ipconfig /flushdns /c

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

danach:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

danach:

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Gerne,

auf gehts:

Code:

All processes killed

========== OTL ==========

HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKU\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.

C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll moved successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

No captured output from command...

C:\Users\Geschäft\Desktop\cmd.bat deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Geschäft

->Temp folder emptied: 881633 bytes

->Temporary Internet Files folder emptied: 367369542 bytes

->Flash cache emptied: 2232 bytes

 

User: Public

 

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 709228 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes

RecycleBin emptied: 245038970 bytes

 

Total Files Cleaned = 586,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 02072013_160905
 

Files\Folders moved on Reboot...

C:\Users\Geschäft\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6889

# api_version=3.0.2

# EOSSerial=37a5342905cfae4da14328ad55cd696c

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-02-07 05:34:29

# local_time=2013-02-07 06:34:29 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776573 100 94 163013 111888319 0 0

# scanned=440417

# found=1

# cleaned=0

# scan_time=6382

C:\_OTL\MovedFiles\02032013_225711\C_Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6a7fef7f-5bc88092        a variant of Java/Exploit.CVE-2013-0422.AZ trojan        4D0342752659CECE9B3671DC09C79F5DE1A365C9        I

Code:

 Results of screen317's Security Check version 0.99.57  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 9  
 ``````````````Antivirus/Firewall Check:`````````````` 

G Data InternetSecurity 2013   

Emsisoft Anti-Malware          

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.70.0.1100  

 Adobe Flash Player 11.5.502.146  

 Adobe Reader 10.1.5 Adobe Reader out of Date!  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Emsisoft Anti-Malware a2service.exe   

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 Emsisoft Anti-Malware a2guard.exe   

 G Data InternetSecurity Firewall GDFwSvcx64.exe 

 G Data InternetSecurity Firewall GDFirewallTray.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Danke für die weitere Unterstützung :-)

Aktualisiere:

Adobe Reader: Adobe Reader - Download - Filepony (Alternativen: PDF Tools)

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die .exe-Datei
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 13 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

Code:

PluginCheck
 

 Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.

 Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

 
 
 

Internet Explorer 9.0 ist aktuell
 

Flash (11,5,502,146) ist aktuell.

Java ist nicht Installiert oder nicht aktiviert.
 

Adobe Reader ist nicht installiert oder aktiviert.

Code:

PluginCheck
 

 Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.

 Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

 
 
 

Internet Explorer 9.0 ist aktuell
 

Flash (11,5,502,146) ist aktuell.

Java ist nicht Installiert oder nicht aktiviert.
 

Adobe Reader ist nicht installiert oder aktiviert.

Nun habe ich ein inaktives Java für ein 32-Bit-System auf meinem System mit 64 Bit. Doe Probleme mit der Sicherheit habe ich verstanden, aber ist es nciht besser, Java grundsätzlich deinstalliert zu halten?

Zu Adore Reader: Ich habe die Version X ( 10.1.5) - jedoch wird sie nicht angezeigt?

Nun bin ich gespannt, wie es weitergeht :-)

LG, Andreas

Zitat:

Java grundsätzlich deinstalliert zu halten?

Wenn du keine Software benutzt die auf Java basiert, dann ja ;)

Aktualisiere:Adobe Reader: Adobe Reader - Download - Filepony (Alternativen: PDF Tools)

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

Soweit herzlichen Dank; Adobe Reader ist jetzt auch auf aktuellem Stand.

ADWCleaner lässt sich allerdings nicht so einfach deinstallieren; rufe ich ihn auf, kommt die Meldung C:\Users\Geschäft\Desktop\adwcleaner.exe ist keine zulässige Win32-Anwendung.

Gestern wurde mir dann auch noch durch G-Data angezeigt, daß ein Programm 'ad.yieldmanager' nach 'Hause telefonieren' möchte - also einen Verbindungsaufbau versucht hat. :headbang:

Ich habe diesen Versuch zunächst dauerhaft unterbunden - mag das ausreichend sein oder eher nicht ausreichen... :confused:

An dieser Stelle warte ich erst einmal Deine Info ab, bevor ich in deinen Hinweisen zur vollständigen Abarbeitung deines Plans weitermache... :pfeiff:

Danke :heulen:

Losche den adwCleaner manuel, dann:

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Hi t'john

ähmmm...

Code:

 ================================================================

 [                                                              ]

 [            Junkware Removal Tool (JRT) by Thisisu            ]

 [                 Version 4.6.2 (02.02.2013:2)                 ]

 [          Information about this tool can be found at         ]

 [                hxxp://thisisudax.blogspot.com                ]

 [                                                              ]

 [                                                              ]

 [   Please save any work in your browsers before proceeding.   ]

 [   Your desktop may temporarily disappear during this scan.   ]

 [           A Windows Explorer window may also open.           ]

 [            These actions are normal. Don't panic.            ]

 [                                                              ]

 [                       ** DISCLAIMER **                       ]

 [                                                              ]

 [           This software is provided "as is" without          ]

 [        warranty of any kind. You may use this software       ]

 [                       at your own risk.                      ]

 [                                                              ]

 [     Click the [X] in the top-right corner of this window     ]

 [                if you wish to exit. Otherwise,               ]

 ================================================================
 

Drücken Sie eine beliebige Taste . . .
 

 Creating a registry backup

 Checking Startup

 Checking Modules

...es öffnet sich der ESET Online Scanner, der nichts gefunden hat.

Eine Datei hat sich weder geöffnet noch wurde sie auf dem Desktop abgelegt :confused:

Ich bekam zum Ende beim Schließen des Programms allerdings die Information, daß das Prrogramm eventuell nicht richtig installiert wurde...

Erneut laufen lassen?

Mein G-Data hat dann heute noch folgenden Fund gemeldet:

Code:

Virus: Java:Agent-CMB [Expl], Java:CVE-2013-0422-AZ [Expl], Java:CVE-2013-0422-BE [Expl] (Engine B)

Datei: 55e8fcfc-20dce91c

Verzeichnis: C:\_OTL\MovedFiles\02032013_225711\C_Users\Geschäft\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60

Ich habe ihn direkt löschen lassen...

Wie gehen wir weiter vor?

Hast du alle Scanner deaktiviert vor dem Start von JRT?

Deaktiviere GData, er hat nur die OTL Quarantaene gefunden.

Entschuldige - G-Data war nicht vollständig abgeschaltet...
Hier nun die Info:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.6.2 (02.02.2013:2)

OS: Windows 7 Home Premium x64

Ran by Gesch„ft on 11.02.2013 at 11:10:32,99

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] hkey_classes_root\yt.ytnavassistplugin

Successfully deleted: [Registry Key] hkey_classes_root\yt.ytnavassistplugin.1

Successfully deleted: [Registry Key] hkey_local_machine\software\systweak
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 11.02.2013 at 11:23:41,57

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Ganz herzlichen Dank t'john,

...für Geduld, Sachkenntnis und die Unterstützung der letzten Tage :dankeschoen:

Zwei Dinge lassen mich jedoch noch nachdenken:

Zum einen ist der 'runctf' noch im Autostart - zwar deaktiviert, aber als wählbar vorhanden. Läßt sich das noch ändern oder muß ich damit leben?

Zum anderen habe ich mir einen zweiten User angelegt, jedoch wird dieser 'blank', also nicht als Spiegel meines Admin-Users aondern als neues System angelegt. Ich verwalte jedoch sehr viele Fotos mit einem speziellen Katalogprogramm, das auf die Pfade angewiesen ist... Kann ich hier noch einen Weg finden, den ehemals als Admin angelegten User zu spiegeln oder anderweitig als User mit reduzierten Rechten einzurichten?

Danke auch noch für diese Info - und eine Spende werde ich ebenfalls locker machen - für viel Kaffee oder anderes zum Wachhalten :kaffee:

Danke zunächst,

Andi

Zitat:

Zum einen ist der 'runctf' noch im Autostart - zwar deaktiviert, aber als wählbar vorhanden. Läßt sich das noch ändern oder muß ich damit leben?

Du meinst in msconfig ?

Da koennen wir was machen ;)

Scan mit SystemLook

Hiermit prüfe ich, ob für diese Infektion übliche Einträge noch vorhanden sind. Das Tool ändert nichts, wirft mir nur die nötigen Infos aus.

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop (falls noch nicht vorhanden).

User mit 64Bit-Windows-Versionen benutzen diese Version => http://jpshortstuff.247fixes.com/SystemLook_x64.exe

Doppelklick auf die SystemLook.exe, um das Tool zu starten.
Vista- und Windows 7-User unbedingt mit Rechtsklick und als Administrator starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:regfind runctf :filefind *runctf*
Klicke nun auf den Button Look, um den Scan zu starten.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Zitat:

Zum anderen habe ich mir einen zweiten User angelegt, jedoch wird dieser 'blank', also nicht als Spiegel meines Admin-Users aondern als neues System angelegt. Ich verwalte jedoch sehr viele Fotos mit einem speziellen Katalogprogramm, das auf die Pfade angewiesen ist... Kann ich hier noch einen Weg finden, den ehemals als Admin angelegten User zu spiegeln oder anderweitig als User mit reduzierten Rechten einzurichten?

Gegenvorschlag:

Lege einen neuen User an und mach ihn zum Admin waehrend du deinen normalen zum User machst ;)

Zitat:

Danke auch noch für diese Info - und eine Spende werde ich ebenfalls locker machen - für viel Kaffee oder anderes zum Wachhalten

;) sehr nett ;)

Supi...,

hier der Inhalt des Scans:

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 17:05 on 13/02/2013 by Geschäft

Administrator - Elevation successful
 

========== regfind ==========
 

Searching for "runctf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"path"="C:\Users\Geschäft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"backup"="C:\Windows\pss\runctf.lnk.Startup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"item"="runctf"
 

========== filefind ==========
 

Searching for "*runctf*"

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\175RF2Z9\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart[1].htm        --a---- 216264 bytes        [18:44 12/02/2013]        [18:44 12/02/2013] AB624EA43EFFFA8055A1C44E68DDEBF1

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33OH2ZNL\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-post1009803[1].htm        --a---- 0 bytes        [10:37 11/02/2013]        [10:37 11/02/2013] D41D8CD98F00B204E9800998ECF8427E

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DU4UGWC\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-2[1].htm        --a---- 128136 bytes        [18:50 12/02/2013]        [18:50 12/02/2013] ED385BF3AF3C594F8D05C316BCBCFF12

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USW08Y56\runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart_ltr[1].gif        --a---- 1035 bytes        [10:35 11/02/2013]        [10:35 11/02/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1OKU143N\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-2[1].htm        --a---- 88690 bytes        [16:04 13/02/2013]        [16:04 13/02/2013] CE034ACBACAAFF9B5F6C488BB7264BB7

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BA3ONEWZ\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-post1009624[1].htm        --a---- 20 bytes        [20:58 10/02/2013]        [20:58 10/02/2013] 7029066C27AC6F5EF18D660D5741979A

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BA3ONEWZ\runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart_ltr[1].gif        --a---- 1035 bytes        [10:55 09/02/2013]        [10:55 09/02/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TY4I7POP\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart[1].htm        --a---- 0 bytes        [18:08 07/02/2013]        [18:08 07/02/2013] D41D8CD98F00B204E9800998ECF8427E

C:\Users\Geschäft\Favorites\runctf mit Webcam - verbliebene Systemsicherheit nach Deaktivierung im Autostart - Trojaner-Board.url        --a---- 779 bytes        [21:11 06/02/2013]        [21:11 06/02/2013] 75A39D8FC76A838B3B06E736F0B0A7F0

C:\Windows\pss\runctf.lnk.Startup        ------- 1077 bytes        [22:44 02/02/2013]        [18:50 02/02/2013] C5AC6A5CF4F27C859934F91893583E62
 

Searching for "         "

No files found.
 

-= EOF =-

Hmmm - magst du mir bitte in 3 Sätzen mitteilen, wie ich insofern vorgehen kann, den Admin zum User zu machen und umgekehrt...? Mit Usern bin ich total unbeschlagen :confused:

Eine Spende ist unterwegs - gerade eben mit dem jetzt wieder sicheren System veranlasst :abklatsch:

Danke Andi

Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

Registry:: [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk] File:: C:\Windows\pss\runctf.lnk.Startup

Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

danach:

Temp File Cleaner - Download - Filepony bitte laufen lassen.

...erledigt...: :applaus:

Code:

ComboFix 13-02-13.02 - Geschäft 14.02.2013  16:35:30.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8189.6149 [GMT 1:00]

ausgeführt von:: c:\users\Geschõft\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Geschõft\Desktop\CFScript.txt.txt

AV: G Data InternetSecurity 2013 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}

FW: G Data Personal Firewall *Disabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}

SP: G Data InternetSecurity 2013 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Geschäft\AppData\Roaming\Microsoft\~DFK679f5c.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-01-14 bis 2013-02-14  ))))))))))))))))))))))))))))))

.

.

2013-02-14 15:42 . 2013-02-14 15:42        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-02-14 15:42 . 2013-02-14 15:42        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-02-14 15:33 . 2013-02-14 15:33        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DE2F879D-CB62-4095-86F9-835C30D49BAC}\offreg.dll

2013-02-13 13:56 . 2013-01-09 01:10        996352        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 13:56 . 2013-01-08 22:01        768000        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 13:53 . 2013-01-03 06:00        1913192        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-02-13 13:53 . 2013-01-03 06:00        288088        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2013-02-12 18:39 . 2013-02-12 18:39        --------        d-----w-        c:\windows\en

2013-02-12 18:38 . 2013-02-12 18:38        --------        d-----w-        c:\windows\de

2013-02-12 18:35 . 2013-02-12 18:35        --------        d-----w-        c:\program files\Windows Live

2013-02-12 18:34 . 2010-06-02 03:55        77656        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2013-02-12 18:34 . 2010-06-02 03:55        74072        ----a-w-        c:\windows\SysWow64\XAPOFX1_5.dll

2013-02-12 18:34 . 2010-06-02 03:55        527192        ----a-w-        c:\windows\SysWow64\XAudio2_7.dll

2013-02-12 18:34 . 2010-06-02 03:55        518488        ----a-w-        c:\windows\system32\XAudio2_7.dll

2013-02-12 18:34 . 2010-05-26 10:41        2526056        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        2106216        ----a-w-        c:\windows\SysWow64\D3DCompiler_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        276832        ----a-w-        c:\windows\system32\d3dx11_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        248672        ----a-w-        c:\windows\SysWow64\d3dx11_43.dll

2013-02-12 18:34 . 2009-09-04 16:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll

2013-02-12 18:34 . 2009-09-04 16:29        523088        ----a-w-        c:\windows\system32\d3dx10_42.dll

2013-02-12 18:33 . 2006-11-29 12:06        4398360        ----a-w-        c:\windows\system32\d3dx9_32.dll

2013-02-12 18:33 . 2006-11-29 12:06        3426072        ----a-w-        c:\windows\SysWow64\d3dx9_32.dll

2013-02-12 18:33 . 2013-02-12 18:33        525656        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\DXSETUP.exe

2013-02-12 18:33 . 2013-02-12 18:33        1691480        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\dsetup32.dll

2013-02-12 18:33 . 2013-02-12 18:33        94040        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\DSETUP.dll

2013-02-12 18:33 . 2013-02-12 18:33        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\DSETUP.dll

2013-02-12 18:33 . 2013-02-12 18:33        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\DXSETUP.exe

2013-02-12 18:33 . 2013-02-12 18:33        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\dsetup32.dll

2013-02-12 18:31 . 2013-02-12 18:31        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\DSETUP.dll

2013-02-12 18:31 . 2013-02-12 18:31        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\DXSETUP.exe

2013-02-12 18:31 . 2013-02-12 18:31        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\dsetup32.dll

2013-02-12 18:30 . 2013-02-12 18:30        --------        d-----w-        c:\program files (x86)\FileHippo.com

2013-02-12 17:54 . 2013-02-12 17:56        --------        d-----w-        c:\users\Standard

2013-02-12 17:46 . 2013-02-12 17:46        --------        d-----w-        c:\users\Geschäft\AppData\Local\Macromedia

2013-02-12 17:34 . 2012-08-23 15:09        3584        ----a-w-        c:\windows\system32\drivers\de-DE\tsusbflt.sys.mui

2013-02-12 17:34 . 2013-02-12 17:34        --------        d-----w-        c:\program files\Microsoft Mouse and Keyboard Center

2013-02-12 17:34 . 2012-08-23 13:41        13312        ----a-w-        c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2013-02-12 17:34 . 2012-08-23 13:40        13312        ----a-w-        c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2013-02-12 17:34 . 2012-08-23 13:24        15360        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2013-02-12 17:31 . 2012-08-24 18:09        458712        ----a-w-        c:\windows\system32\drivers\cng.sys

2013-02-12 17:31 . 2012-08-24 18:05        340992        ----a-w-        c:\windows\system32\schannel.dll

2013-02-12 17:31 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2013-02-12 17:31 . 2012-08-24 18:13        154480        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2013-02-12 17:31 . 2012-08-24 18:03        1448448        ----a-w-        c:\windows\system32\lsasrv.dll

2013-02-12 17:31 . 2012-08-24 16:57        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2013-02-12 17:31 . 2012-08-24 16:53        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2013-02-12 17:31 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll

2013-02-12 17:31 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2013-02-12 17:23 . 2013-02-12 17:23        --------        d-----w-        c:\users\Geschäft\AppData\Local\Secunia PSI

2013-02-12 17:23 . 2013-02-12 17:23        --------        d-----w-        c:\program files (x86)\Secunia

2013-02-12 15:20 . 2013-01-08 05:32        9161176        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DE2F879D-CB62-4095-86F9-835C30D49BAC}\mpengine.dll

2013-02-12 15:18 . 2013-02-12 15:19        --------        d-----w-        c:\users\Geschäft\AppData\Local\{A88BC2B0-6F7A-4968-88CA-B1BFE52F7131}

2013-02-11 10:01 . 2013-02-11 10:01        --------        d-----w-        c:\users\Geschäft\AppData\Local\{00CF2887-4693-451A-A10B-2CB3B1743947}

2013-02-10 18:23 . 2013-02-10 18:23        --------        d-----w-        c:\windows\ERUNT

2013-02-10 18:23 . 2013-02-11 10:10        --------        d-----w-        C:\JRT

2013-02-10 10:36 . 2013-02-10 10:37        --------        d-----w-        c:\users\Geschäft\AppData\Local\{7C8FD56C-6633-4783-B7E7-A35AAF4C4F45}

2013-02-09 15:59 . 2013-02-09 15:59        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4F507A2D-AF31-4CFA-814D-B196611C82EE}

2013-02-09 10:59 . 2013-02-09 10:59        --------        d-----w-        c:\program files (x86)\Common Files\Java

2013-02-09 10:58 . 2013-02-09 10:58        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2013-02-09 10:58 . 2013-02-09 10:58        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2013-02-09 10:58 . 2013-02-09 10:58        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-02-09 10:58 . 2013-02-09 10:58        --------        d-----w-        c:\program files (x86)\Java

2013-02-08 21:36 . 2013-02-08 21:36        --------        d-----w-        c:\users\Geschäft\AppData\Local\{B5FB406F-6EFD-4F09-8E5F-45641CFAA3D8}

2013-02-08 09:35 . 2013-02-08 09:36        --------        d-----w-        c:\users\Geschäft\AppData\Local\{51BF1668-2ABC-43E5-B830-F50A38B9A68E}

2013-02-07 18:10 . 2013-02-07 18:11        --------        d-----w-        c:\users\Geschäft\AppData\Local\{339A6E8F-3B9E-4CCD-9105-EB762E0A3B4E}

2013-02-06 21:43 . 2013-02-06 21:43        --------        d-----w-        c:\users\Geschäft\AppData\Local\{171CA74C-C5DE-4E68-91B8-CC29D0CBC447}

2013-02-06 09:27 . 2013-02-06 09:27        --------        d-----w-        c:\users\Geschäft\AppData\Local\{6BA7239A-9413-4293-8E6E-B0C86357C326}

2013-02-05 21:22 . 2013-02-05 21:22        --------        d-----w-        c:\users\Geschäft\AppData\Local\{ECEDFA12-27A1-41F9-A665-47EBDE9A1D8F}

2013-02-04 22:54 . 2013-02-04 22:55        --------        d-----w-        c:\users\Geschäft\AppData\Local\{D884BA10-6A64-4EBF-8C83-C87BC64898D0}

2013-02-04 10:40 . 2013-02-04 10:40        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4D8512B9-747B-4D8B-BA81-28AFF8317830}

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\users\Geschäft\AppData\Roaming\Malwarebytes

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\programdata\Malwarebytes

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\users\Geschäft\AppData\Local\Programs

2013-02-03 09:52 . 2013-02-03 09:52        --------        d-----w-        c:\users\Geschäft\AppData\Local\{0A5A1C98-7C19-4431-B37D-47FD8BCA6E93}

2013-02-02 18:05 . 2013-02-02 18:05        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2013-02-02 18:05 . 2013-02-02 18:05        --------        d-----r-        c:\program files (x86)\Skype

2013-02-02 08:54 . 2013-02-02 08:55        --------        d-----w-        c:\users\Geschäft\AppData\Local\{FADACF9A-79EE-48EF-A897-A92923FF3825}

2013-02-01 13:44 . 2013-02-01 13:44        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4144D4F2-EB83-4F0F-B041-87B6B9160A7E}

2013-01-31 16:14 . 2013-01-31 16:14        --------        d-----w-        c:\users\Geschäft\AppData\Local\{82B2F28E-30E5-4122-A95B-0FE311A0A662}

2013-01-30 16:09 . 2013-01-30 16:09        16504        ----a-w-        c:\windows\system32\drivers\GdPhyMem.sys

2013-01-30 14:15 . 2013-01-30 14:15        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4E10F33D-91C6-4737-BE9D-2B1A5DEAED63}

2013-01-29 13:59 . 2013-01-29 13:59        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4A475983-D59C-44F6-AB23-0E986EFFCBA1}

2013-01-28 14:26 . 2013-01-28 14:26        --------        d-----w-        c:\users\Geschäft\AppData\Local\{2FDF62D3-2A54-4526-83F7-049A5F5585D7}

2013-01-27 10:05 . 2013-01-27 10:05        --------        d-----w-        c:\users\Geschäft\AppData\Local\{BB3F8CAE-3BC5-45BC-A701-A684C552E12B}

2013-01-26 20:39 . 2012-11-23 03:13        68608        ----a-w-        c:\windows\system32\taskhost.exe

2013-01-26 20:31 . 2013-01-26 20:32        --------        d-----w-        c:\users\Geschäft\AppData\Local\{5A8EBA0F-9E99-45D7-9BBD-00641D0C831E}

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-02-14 14:41 . 2012-06-09 19:57        25640        ----a-w-        c:\windows\gdrv.sys

2013-02-13 13:58 . 2012-06-12 20:32        70004024        ----a-w-        c:\windows\system32\MRT.exe

2013-02-13 13:50 . 2012-06-09 20:24        71024        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-13 13:50 . 2012-06-09 20:24        691568        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-01-29 13:56 . 2012-06-09 21:41        62368        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2013-01-28 17:47 . 2012-06-09 21:41        64416        ----a-w-        c:\windows\system32\drivers\HookCentre.sys

2013-01-28 17:47 . 2012-06-09 21:41        54176        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2013-01-28 17:47 . 2012-06-09 21:41        126880        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2013-01-28 17:47 . 2012-06-09 21:41        65008        ----a-w-        c:\windows\system32\drivers\gdwfpcd64.sys

2013-01-17 00:28 . 2012-06-09 19:55        273840        ------w-        c:\windows\system32\MpSigStub.exe

2013-01-10 13:35 . 2012-06-09 22:11        11240        ----a-w-        c:\windows\SysWow64\GdScrSv.de.dll

2013-01-05 10:22 . 2013-01-05 10:22        50800        ----a-w-        c:\windows\system32\drivers\point64.sys

2013-01-05 10:22 . 2013-01-05 10:22        1795952        ----a-w-        c:\windows\system32\WdfCoInstaller01011.dll

2013-01-04 04:43 . 2013-02-13 13:54        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-12-16 17:11 . 2012-12-23 22:56        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-23 22:56        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-23 22:56        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-23 22:56        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-09 22:14 . 2012-12-09 22:14        916456        ----a-w-        c:\windows\system32\deployJava1.dll

2012-12-09 22:14 . 2012-12-09 22:14        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-03-28 08:14 . 2012-07-02 16:45        1456640        ----a-w-        c:\program files (x86)\Common Files\Falk Navi-Manager.msi

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-06-10 39408]

"FileHippo.com"="c:\program files (x86)\FileHippo.com\UpdateChecker.exe" [2012-11-23 307712]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2013-01-09 1035216]

"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2012-11-29 1475096]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-11-26 573024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

.

R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-11-26 659040]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2010-12-24 29288]

R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]

R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-06-10 30528]

R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-06-21 13728]

R3 npusbio;npusbio;c:\windows\system32\Drivers\npusbio_x64.sys [2009-12-17 45600]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 SaiH0BAC;SaiH0BAC;c:\windows\system32\DRIVERS\SaiH0BAC.sys [2007-07-02 176128]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-06-21 68512]

R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-05-22 15736]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2013-01-28 54176]

S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2013-01-28 126880]

S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2013-01-28 65008]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2012-06-09 106648]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2013-01-28 64416]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-11-29 1548312]

S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [2012-11-29 469016]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2012-11-29 2012592]

S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-11-26 1225312]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]

S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2012-08-02 8786848]

S2 TouchServiceWacom;Wacom Professional Touch Service;c:\program files\Tablet\Wacom\Wacom_TouchService.exe [2012-08-02 565152]

S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]

S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-03-07 40832]

S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-03-07 65280]

S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2012-11-29 2377736]

S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2013-01-29 62368]

S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]

S3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2007-05-09 16032]

S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2007-05-09 50208]

S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-05 50800]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-02-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 13:50]

.

2013-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-10 11:49]

.

2013-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-10 11:49]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-24 11780712]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]

"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-11-02 1464944]

"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 2076272]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.afterwork-wellness.info/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Geschäft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.afterwork-wellness.info/|hxxp://www.babybauchfoto.com/|hxxp://www.fotoinside.info/|hxxp://www.fotografie-emotion.de/|hxxp://www.unser-licht.info/

FF - ExtSQL: 2013-02-12 19:24; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF - ExtSQL: 2013-02-12 20:03; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF - ExtSQL: 2013-02-12 20:03; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM-Run-Corel Photo Downloader - c:\program files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe

AddRemove-_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF} - c:\program files (x86)\Corel\Corel Painter Essentials 3\MSILauncher {0C180787-F8C8-42FD-A9D3-689BA44BEAAF}

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-02-14  16:45:25

ComboFix-quarantined-files.txt  2013-02-14 15:45

.

Vor Suchlauf: 11 Verzeichnis(se), 511.358.218.240 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 511.231.991.808 Bytes frei

.

- - End Of File - - 4C675B7596F895C80FF97006977C9599

...und bereit für weiteren Input :dummguck:

LG, Andi

Falls jetzt alles ist, wie es sein soll sind soweit durch ;)

:daumenrunter:

in der Systemconfiguration im Reiter Systemstart ist immer noch das zwar abgewählte aber vorhandene Kästchen mit dem 'runctf' ersichtlich.

:heulen:

:)

Scan mit SystemLook

Hiermit prüfe ich, ob für diese Infektion übliche Einträge noch vorhanden sind. Das Tool ändert nichts, wirft mir nur die nötigen Infos aus.

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop (falls noch nicht vorhanden).

User mit 64Bit-Windows-Versionen benutzen diese Version => http://jpshortstuff.247fixes.com/SystemLook_x64.exe

Doppelklick auf die SystemLook.exe, um das Tool zu starten.
Vista- und Windows 7-User unbedingt mit Rechtsklick und als Administrator starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:regfind runctf :folderfind *runctf* :filefind *runctf*
Klicke nun auf den Button Look, um den Scan zu starten.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Schon geschehen:

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 12:16 on 16/02/2013 by Geschäft

Administrator - Elevation successful
 

========== regfind ==========
 

Searching for "runctf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"path"="C:\Users\Geschäft\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"backup"="C:\Windows\pss\runctf.lnk.Startup"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Geschäft^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^runctf.lnk]

"item"="runctf"
 

========== folderfind ==========
 

Searching for "*runctf*"

No folders found.
 

========== filefind ==========
 

Searching for "*runctf*"

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4IWUY1SV\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-3[1].htm        --a---- 92100 bytes        [11:15 16/02/2013]        [11:15 16/02/2013] 42282846D025024859645A41F4C1E636

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4IWUY1SV\runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart_ltr[1].gif        --a---- 1035 bytes        [15:25 15/02/2013]        [15:25 15/02/2013] 279A7CCAE1D652E0EB03D9FB5B067B16

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\750F5J1R\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-2[1].htm        --a---- 89571 bytes        [11:14 16/02/2013]        [11:14 16/02/2013] 317D053352093385A4AC3030644B6760

C:\Users\Geschäft\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A8OLR6AB\130567-runctf-webcam-verbliebene-systemsicherheit-deaktivierung-autostart-3[1].htm        --a---- 51587 bytes        [15:47 14/02/2013]        [15:47 14/02/2013] D3C5DACED88633AB60EECB532791AC2B

C:\Users\Geschäft\Favorites\runctf mit Webcam - verbliebene Systemsicherheit nach Deaktivierung im Autostart - Trojaner-Board.url        --a---- 779 bytes        [21:11 06/02/2013]        [21:11 06/02/2013] 75A39D8FC76A838B3B06E736F0B0A7F0

C:\Windows\pss\runctf.lnk.Startup        ------- 1077 bytes        [22:44 02/02/2013]        [18:50 02/02/2013] C5AC6A5CF4F27C859934F91893583E62
 

Searching for "         "

No files found.
 

-= EOF =-

MfG

Andi

Anscheinend hast du die CFScript ohne Inhalt erstellt.

Habe sie dir angehaengt.

Diese Datei auf die Combofix-Datei ziehen.

Och, meine Datei war schon richtig, ich habe sie noch einmal verglichen...

Habs denoch noch einmal laufen lassen und deine Datei genommen - hier das ERgebnis:

Code:

ComboFix 13-02-13.02 - Geschäft 16.02.2013  23:27:58.3.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8189.5870 [GMT 1:00]

ausgeführt von:: c:\users\Geschäft\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Geschäft\Desktop\CFScript.txt.txt

AV: G Data InternetSecurity 2013 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}

FW: G Data Personal Firewall *Enabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}

SP: G Data InternetSecurity 2013 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\pss\runctf.lnk.Startup"

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-01-16 bis 2013-02-16  ))))))))))))))))))))))))))))))

.

.

2013-02-16 22:35 . 2013-02-16 22:35        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-02-16 22:35 . 2013-02-16 22:35        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-02-15 14:41 . 2013-01-08 05:32        9161176        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D2C497E-1F04-4315-A387-1F5338822082}\mpengine.dll

2013-02-13 13:56 . 2013-01-09 01:10        996352        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 13:56 . 2013-01-08 22:01        768000        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 13:53 . 2013-01-03 06:00        1913192        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-02-13 13:53 . 2013-01-03 06:00        288088        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2013-02-12 18:39 . 2013-02-12 18:39        --------        d-----w-        c:\windows\en

2013-02-12 18:38 . 2013-02-12 18:38        --------        d-----w-        c:\windows\de

2013-02-12 18:35 . 2013-02-12 18:35        --------        d-----w-        c:\program files\Windows Live

2013-02-12 18:34 . 2010-06-02 03:55        77656        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2013-02-12 18:34 . 2010-06-02 03:55        74072        ----a-w-        c:\windows\SysWow64\XAPOFX1_5.dll

2013-02-12 18:34 . 2010-06-02 03:55        527192        ----a-w-        c:\windows\SysWow64\XAudio2_7.dll

2013-02-12 18:34 . 2010-06-02 03:55        518488        ----a-w-        c:\windows\system32\XAudio2_7.dll

2013-02-12 18:34 . 2010-05-26 10:41        2526056        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        2106216        ----a-w-        c:\windows\SysWow64\D3DCompiler_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        276832        ----a-w-        c:\windows\system32\d3dx11_43.dll

2013-02-12 18:34 . 2010-05-26 10:41        248672        ----a-w-        c:\windows\SysWow64\d3dx11_43.dll

2013-02-12 18:34 . 2009-09-04 16:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll

2013-02-12 18:34 . 2009-09-04 16:29        523088        ----a-w-        c:\windows\system32\d3dx10_42.dll

2013-02-12 18:33 . 2006-11-29 12:06        4398360        ----a-w-        c:\windows\system32\d3dx9_32.dll

2013-02-12 18:33 . 2006-11-29 12:06        3426072        ----a-w-        c:\windows\SysWow64\d3dx9_32.dll

2013-02-12 18:33 . 2013-02-12 18:33        525656        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\DXSETUP.exe

2013-02-12 18:33 . 2013-02-12 18:33        1691480        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\dsetup32.dll

2013-02-12 18:33 . 2013-02-12 18:33        94040        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\6f6be1421ce094f04\DSETUP.dll

2013-02-12 18:33 . 2013-02-12 18:33        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\DSETUP.dll

2013-02-12 18:33 . 2013-02-12 18:33        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\DXSETUP.exe

2013-02-12 18:33 . 2013-02-12 18:33        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\696eeb121ce094f01\dsetup32.dll

2013-02-12 18:31 . 2013-02-12 18:31        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\DSETUP.dll

2013-02-12 18:31 . 2013-02-12 18:31        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\DXSETUP.exe

2013-02-12 18:31 . 2013-02-12 18:31        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\389110d61ce094f02\dsetup32.dll

2013-02-12 18:30 . 2013-02-12 18:30        --------        d-----w-        c:\program files (x86)\FileHippo.com

2013-02-12 17:54 . 2013-02-12 17:56        --------        d-----w-        c:\users\Standard

2013-02-12 17:46 . 2013-02-12 17:46        --------        d-----w-        c:\users\Geschäft\AppData\Local\Macromedia

2013-02-12 17:34 . 2012-08-23 15:09        3584        ----a-w-        c:\windows\system32\drivers\de-DE\tsusbflt.sys.mui

2013-02-12 17:34 . 2013-02-12 17:34        --------        d-----w-        c:\program files\Microsoft Mouse and Keyboard Center

2013-02-12 17:34 . 2012-08-23 13:41        13312        ----a-w-        c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2013-02-12 17:34 . 2012-08-23 13:40        13312        ----a-w-        c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2013-02-12 17:34 . 2012-08-23 13:24        15360        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2013-02-12 17:31 . 2012-08-24 18:09        458712        ----a-w-        c:\windows\system32\drivers\cng.sys

2013-02-12 17:31 . 2012-08-24 18:05        340992        ----a-w-        c:\windows\system32\schannel.dll

2013-02-12 17:31 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2013-02-12 17:31 . 2012-08-24 18:13        154480        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2013-02-12 17:31 . 2012-08-24 18:03        1448448        ----a-w-        c:\windows\system32\lsasrv.dll

2013-02-12 17:31 . 2012-08-24 16:57        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2013-02-12 17:31 . 2012-08-24 16:53        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2013-02-12 17:31 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll

2013-02-12 17:31 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2013-02-12 17:23 . 2013-02-12 17:23        --------        d-----w-        c:\users\Geschäft\AppData\Local\Secunia PSI

2013-02-12 17:23 . 2013-02-12 17:23        --------        d-----w-        c:\program files (x86)\Secunia

2013-02-12 15:18 . 2013-02-12 15:19        --------        d-----w-        c:\users\Geschäft\AppData\Local\{A88BC2B0-6F7A-4968-88CA-B1BFE52F7131}

2013-02-11 10:01 . 2013-02-11 10:01        --------        d-----w-        c:\users\Geschäft\AppData\Local\{00CF2887-4693-451A-A10B-2CB3B1743947}

2013-02-10 18:23 . 2013-02-10 18:23        --------        d-----w-        c:\windows\ERUNT

2013-02-10 18:23 . 2013-02-11 10:10        --------        d-----w-        C:\JRT

2013-02-10 10:36 . 2013-02-10 10:37        --------        d-----w-        c:\users\Geschäft\AppData\Local\{7C8FD56C-6633-4783-B7E7-A35AAF4C4F45}

2013-02-09 15:59 . 2013-02-09 15:59        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4F507A2D-AF31-4CFA-814D-B196611C82EE}

2013-02-09 10:59 . 2013-02-09 10:59        --------        d-----w-        c:\program files (x86)\Common Files\Java

2013-02-09 10:58 . 2013-02-09 10:58        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2013-02-09 10:58 . 2013-02-09 10:58        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2013-02-09 10:58 . 2013-02-09 10:58        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-02-09 10:58 . 2013-02-09 10:58        --------        d-----w-        c:\program files (x86)\Java

2013-02-08 21:36 . 2013-02-08 21:36        --------        d-----w-        c:\users\Geschäft\AppData\Local\{B5FB406F-6EFD-4F09-8E5F-45641CFAA3D8}

2013-02-08 09:35 . 2013-02-08 09:36        --------        d-----w-        c:\users\Geschäft\AppData\Local\{51BF1668-2ABC-43E5-B830-F50A38B9A68E}

2013-02-07 18:10 . 2013-02-07 18:11        --------        d-----w-        c:\users\Geschäft\AppData\Local\{339A6E8F-3B9E-4CCD-9105-EB762E0A3B4E}

2013-02-06 21:43 . 2013-02-06 21:43        --------        d-----w-        c:\users\Geschäft\AppData\Local\{171CA74C-C5DE-4E68-91B8-CC29D0CBC447}

2013-02-06 09:27 . 2013-02-06 09:27        --------        d-----w-        c:\users\Geschäft\AppData\Local\{6BA7239A-9413-4293-8E6E-B0C86357C326}

2013-02-05 21:22 . 2013-02-05 21:22        --------        d-----w-        c:\users\Geschäft\AppData\Local\{ECEDFA12-27A1-41F9-A665-47EBDE9A1D8F}

2013-02-04 22:54 . 2013-02-04 22:55        --------        d-----w-        c:\users\Geschäft\AppData\Local\{D884BA10-6A64-4EBF-8C83-C87BC64898D0}

2013-02-04 10:40 . 2013-02-04 10:40        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4D8512B9-747B-4D8B-BA81-28AFF8317830}

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\users\Geschäft\AppData\Roaming\Malwarebytes

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\programdata\Malwarebytes

2013-02-03 23:33 . 2013-02-03 23:33        --------        d-----w-        c:\users\Geschäft\AppData\Local\Programs

2013-02-03 09:52 . 2013-02-03 09:52        --------        d-----w-        c:\users\Geschäft\AppData\Local\{0A5A1C98-7C19-4431-B37D-47FD8BCA6E93}

2013-02-02 18:05 . 2013-02-02 18:05        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2013-02-02 18:05 . 2013-02-02 18:05        --------        d-----r-        c:\program files (x86)\Skype

2013-02-02 08:54 . 2013-02-02 08:55        --------        d-----w-        c:\users\Geschäft\AppData\Local\{FADACF9A-79EE-48EF-A897-A92923FF3825}

2013-02-01 13:44 . 2013-02-01 13:44        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4144D4F2-EB83-4F0F-B041-87B6B9160A7E}

2013-01-31 16:14 . 2013-01-31 16:14        --------        d-----w-        c:\users\Geschäft\AppData\Local\{82B2F28E-30E5-4122-A95B-0FE311A0A662}

2013-01-30 16:09 . 2013-01-30 16:09        16504        ----a-w-        c:\windows\system32\drivers\GdPhyMem.sys

2013-01-30 14:15 . 2013-01-30 14:15        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4E10F33D-91C6-4737-BE9D-2B1A5DEAED63}

2013-01-29 13:59 . 2013-01-29 13:59        --------        d-----w-        c:\users\Geschäft\AppData\Local\{4A475983-D59C-44F6-AB23-0E986EFFCBA1}

2013-01-28 14:26 . 2013-01-28 14:26        --------        d-----w-        c:\users\Geschäft\AppData\Local\{2FDF62D3-2A54-4526-83F7-049A5F5585D7}

2013-01-27 10:05 . 2013-01-27 10:05        --------        d-----w-        c:\users\Geschäft\AppData\Local\{BB3F8CAE-3BC5-45BC-A701-A684C552E12B}

2013-01-26 20:39 . 2012-11-23 03:13        68608        ----a-w-        c:\windows\system32\taskhost.exe

2013-01-26 20:31 . 2013-01-26 20:32        --------        d-----w-        c:\users\Geschäft\AppData\Local\{5A8EBA0F-9E99-45D7-9BBD-00641D0C831E}

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-02-16 22:19 . 2012-06-09 19:57        25640        ----a-w-        c:\windows\gdrv.sys

2013-02-13 13:58 . 2012-06-12 20:32        70004024        ----a-w-        c:\windows\system32\MRT.exe

2013-02-13 13:50 . 2012-06-09 20:24        71024        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-13 13:50 . 2012-06-09 20:24        691568        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-01-29 13:56 . 2012-06-09 21:41        62368        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2013-01-28 17:47 . 2012-06-09 21:41        64416        ----a-w-        c:\windows\system32\drivers\HookCentre.sys

2013-01-28 17:47 . 2012-06-09 21:41        54176        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2013-01-28 17:47 . 2012-06-09 21:41        126880        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2013-01-28 17:47 . 2012-06-09 21:41        65008        ----a-w-        c:\windows\system32\drivers\gdwfpcd64.sys

2013-01-17 00:28 . 2012-06-09 19:55        273840        ------w-        c:\windows\system32\MpSigStub.exe

2013-01-10 13:35 . 2012-06-09 22:11        11240        ----a-w-        c:\windows\SysWow64\GdScrSv.de.dll

2013-01-05 10:22 . 2013-01-05 10:22        50800        ----a-w-        c:\windows\system32\drivers\point64.sys

2013-01-05 10:22 . 2013-01-05 10:22        1795952        ----a-w-        c:\windows\system32\WdfCoInstaller01011.dll

2013-01-04 04:43 . 2013-02-13 13:54        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-12-16 17:11 . 2012-12-23 22:56        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-23 22:56        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-23 22:56        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-23 22:56        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-09 22:14 . 2012-12-09 22:14        916456        ----a-w-        c:\windows\system32\deployJava1.dll

2012-12-09 22:14 . 2012-12-09 22:14        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-03-28 08:14 . 2012-07-02 16:45        1456640        ----a-w-        c:\program files (x86)\Common Files\Falk Navi-Manager.msi

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-06-10 39408]

"FileHippo.com"="c:\program files (x86)\FileHippo.com\UpdateChecker.exe" [2012-11-23 307712]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2013-01-09 1035216]

"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2012-11-29 1475096]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-11-26 573024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-11-26 659040]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2010-12-24 29288]

R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]

R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-06-10 30528]

R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-06-21 13728]

R3 npusbio;npusbio;c:\windows\system32\Drivers\npusbio_x64.sys [2009-12-17 45600]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 SaiH0BAC;SaiH0BAC;c:\windows\system32\DRIVERS\SaiH0BAC.sys [2007-07-02 176128]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-06-21 68512]

R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-05-22 15736]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2013-01-28 54176]

S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-01-10 21104]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2013-01-28 126880]

S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2013-01-28 65008]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2012-06-09 106648]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2013-01-28 64416]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-11-29 1548312]

S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [2012-11-29 469016]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2012-11-29 2012592]

S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]

S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-11-26 1225312]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]

S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2012-08-02 8786848]

S2 TouchServiceWacom;Wacom Professional Touch Service;c:\program files\Tablet\Wacom\Wacom_TouchService.exe [2012-08-02 565152]

S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]

S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-03-07 40832]

S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-03-07 65280]

S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2012-11-29 2377736]

S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2013-01-29 62368]

S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]

S3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2007-05-09 16032]

S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2007-05-09 50208]

S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-05 50800]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-13 413800]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-02-16 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 13:50]

.

2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-10 11:49]

.

2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-10 11:49]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-24 11780712]

"Corel Photo Downloader"="c:\program files (x86)\Corel\Corel MediaOne\Corel Photo Downloader.exe" [BU]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]

"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-11-02 1464944]

"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 2076272]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.afterwork-wellness.info/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Geschäft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.afterwork-wellness.info/|hxxp://www.babybauchfoto.com/|hxxp://www.fotoinside.info/|hxxp://www.fotografie-emotion.de/|hxxp://www.unser-licht.info/

FF - ExtSQL: 2013-02-12 19:24; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF - ExtSQL: 2013-02-12 20:03; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF - ExtSQL: 2013-02-12 20:03; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\GeschÃƒÂ¤ft\AppData\Roaming\Mozilla\Firefox\Profiles\ziyof0n5.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF} - c:\program files (x86)\Corel\Corel Painter Essentials 3\MSILauncher {0C180787-F8C8-42FD-A9D3-689BA44BEAAF}

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-1571012534-911800545-3409040398-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-02-16  23:37:10

ComboFix-quarantined-files.txt  2013-02-16 22:37

ComboFix2.txt  2013-02-14 15:45

.

Vor Suchlauf: 15 Verzeichnis(se), 510.641.676.288 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 510.590.631.936 Bytes frei

.

- - End Of File - - E33BB66307F1EECBD1926AC42526F4C8

...und hej... - runctf ist aus dem Autostart raus :-)

Vielen dank für alles and ich hoffe, ich brauche euch nicht so schnell erneut

Beste Grüße

Andi :daumenhoc

wir wuenschen eine virenfreie Zeit ;)