|
Vermute Virus bzw. Wurm auf System Hallo, Ich habe die Vermutung das sich auf meinem Notebook ein Virus bzw. ein Wurm oder ähnliches befinden könnte. Ich habe dazu schon einige Beiträge durchgelesen und auch das HiJackThis Programm installiert und ausgeführt. Aber leider kam folgende Meldung bei mir und nicht der Text wie in HiJackThis Anleitung beschrieben: "For some reason your system deniede write access to the Hosts file. If an hijacked domains are in this file, HijackThis may NOT be able to fix this. If that happens, you need to edit the file yourself. To do this, click Start, Run and type: notepad C:\Windows\System32\drivers\etc\hosts and press Enter. Find the line(s) HijackThis reports and delete them. Save the file as 'hosts.' (with quotes), and reboot. For Vista: simply, exit HijackThis, right click on the HijackThis icon, choose 'Run as administrator'." Ich wollte das Programm dann als Administrator ausführen, aber immer wenn ich rechtsklick mache (habe Vista) erscheint nichts mit Administrator ausführen. Also habe ich es erstmal seingelassen und habe dann mal den BitDefender QuickScan durchlaufen lassen, der mir folgendes mitgeteilt hat: QuickScan Beta 32-bit v0.9.9.18 ------------------------------- Scan date: Sat Apr 24 05:13:46 2010 Machine ID: 88FA0FDB Found 2 infected files! ----------------------- C:\Users\user\AppData\Local\Temp\Pgj.exe --> Gen:Variant.Renos.6 --> Process Pgj.exe (2368) C:\Users\user\AppData\Local\Temp\Pgk.exe --> Gen:Variant.Renos.6 --> Process Pgk.exe (5168) Processes --------- <unsigned> Pgj.exe 2368 C:\Users\user\AppData\Local\Temp\Pgj.exe <unsigned> Pgk.exe 5168 C:\Users\user\AppData\Local\Temp\Pgk.exe <unsigned> UIExec.exe 524 C:\Program Files\Join Air\UIExec.exe <verified> avast! Antivirus 364 C:\Program Files\Alwil Software\Avast4\ashDisp.exe <verified> Betriebssystem Microsoft® Windows® 1432 C:\Program Files\Windows Media Player\wmpnscfg.exe <verified> Betriebssystem Microsoft® Windows® 796 C:\Program Files\Windows Sidebar\sidebar.exe <verified> Betriebssystem Microsoft® Windows® 1912 C:\Windows\Explorer.EXE <verified> Betriebssystem Microsoft® Windows® 1872 C:\Windows\system32\Dwm.exe <verified> Betriebssystem Microsoft® Windows® 2224 C:\Windows\system32\taskeng.exe <verified> Catalyst Control Centre 1976 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe <verified> Catalyst Control Centre 1028 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE <verified> Firefox 5908 C:\Program Files\Mozilla Firefox\firefox.exe <verified> HD Audio Control Panel 228 C:\Windows\RtHDVCpl.exe <verified> Java(TM) Platform SE Auto Updater 2 0 544 C:\Program Files\Common Files\Java\Java Update\jusched.exe <verified> Microsoft® Windows® Operating System 2540 C:\Windows\ehome\ehmsas.exe <verified> Microsoft® Windows® Operating System 1812 C:\Windows\ehome\ehtray.exe <verified> RAID Event Monitor 376 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe <verified> SM56 Helper Win32 Utility 372 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe <verified> Windows Defender 2044 C:\Program Files\Windows Defender\MSASCui.exe <verified> Windows® Internet Explorer 4020 C:\Program Files\Internet Explorer\iexplore.exe <verified> Windows® Internet Explorer 4908 C:\Program Files\Internet Explorer\iexplore.exe <verified> Windows® Internet Explorer 5304 C:\Program Files\Internet Explorer\iexplore.exe <verified> Windows® Internet Explorer 6140 C:\Program Files\Internet Explorer\iexplore.exe Network activity ---------------- Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.73.162 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.73.155 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.73.155 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.73.162 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 78.108.180.141 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 78.108.180.141 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.82.19 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 88.85.82.19 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 78.108.180.141 Process Pgk.exe (5168) connected on port 80 (HTTP) --> 78.108.180.141 Process firefox.exe (5908) connected on port 1935 --> ns210038.ovh.net Autoruns and critical files --------------------------- <unsigned> Orb C:\Program Files\Winamp Remote\bin\OrbTray.exe <unsigned> Pgj.exe C:\Users\user\AppData\Local\Temp\Pgj.exe <unsigned> Pgk.exe C:\Users\user\AppData\Local\Temp\Pgk.exe <unsigned> UIExec.exe C:\Program Files\Join Air\UIExec.exe <verified> ManyCam Application C:\Program Files\ManyCam 2.4\ManyCam.exe <verified> Adobe Acrobat C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe <verified> Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe <verified> avast! Antivirus C:\Program Files\Alwil Software\Avast4\ashDisp.exe <verified> Betriebssystem Microsoft® Windows® C:\Program Files\Windows Media Player\wmpnscfg.exe <verified> Betriebssystem Microsoft® Windows® C:\Program Files\Windows Sidebar\sidebar.exe <verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\browseui.dll <verified> Betriebssystem Microsoft® Windows® c:\windows\system32\userinit.exe <verified> CLIStart.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe <verified> Google Update C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe <verified> HD Audio Control Panel C:\Windows\RtHDVCpl.exe <verified> Java(TM) Platform SE Auto Updater 2 0 C:\Program Files\Common Files\Java\Java Update\jusched.exe <verified> Microsoft® Windows® Operating System C:\Windows\ehome\ehtray.exe <verified> RAID Event Monitor C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe <verified> Realtek Voice Manager C:\Windows\Skytel.exe <verified> SM56 Helper Win32 Utility C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe <verified> Windows Defender C:\Program Files\Windows Defender\MSASCui.exe <verified> Windows® Internet Explorer C:\Windows\System32\webcheck.dll Browser plugins --------------- <unsigned> Winamp Application Detector C:\Program Files\Mozilla Firefox\plugins\npwachk.dll <verified> AcroIEHelperShim Library C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll <verified> Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll <verified> Adobe® Flash® Player ActiveX C:\Windows\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe <verified> Adobe® Flash® Player ActiveX C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe <verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\mswsock.dll <verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\NapiNSP.dll <verified> Betriebssystem Microsoft® Windows® C:\Windows\System32\pnrpnsp.dll <verified> BitDefender QuickScan C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll <verified> BitDefender QuickScan C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll <verified> Java Deployment Toolkit 6.0.190.4 C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll <verified> Java(TM) Platform SE 6 U19 C:\Program Files\Java\jre6\bin\jp2ssv.dll <verified> libcurl.dll C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll <verified> libexpatw.dll C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll <verified> Microsoft® Visual Studio .NET C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll <verified> Microsoft® Visual Studio .NET C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll <verified> Microsoft® Windows Media Player Firefox C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll <verified> Microsoft® Windows® Operating System C:\Windows\System32\nlaapi.dll <verified> Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll <verified> Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll <verified> nppdf32.DEU C:\Program Files\Mozilla Firefox\plugins\nppdf32.DEU <verified> NPSWF32.dll C:\Windows\System32\Macromed\Flash\NPSWF32.dll <verified> The OpenSSL Toolkit C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll <verified> The OpenSSL Toolkit C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll <verified> TVU Web Player for FireFox C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll <verified> Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll <verified> Windows® Internet Explorer C:\Windows\System32\ieframe.dll <verified> zlib C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll Missing files ------------- File not found: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll referenced in: HLKM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0\"Path" File not found: C:\Windows\system32\drivers\blbdrive.sys referenced in: HKLM\System\ControlSet001\services\blbdrive\"ImagePath" File not found: system32\DRIVERS\ipinip.sys referenced in: HKLM\System\ControlSet001\services\IpInIp\"ImagePath" File not found: system32\DRIVERS\nwlnkflt.sys referenced in: HKLM\System\ControlSet001\services\NwlnkFlt\"ImagePath" File not found: system32\DRIVERS\nwlnkfwd.sys referenced in: HKLM\System\ControlSet001\services\NwlnkFwd\"ImagePath" Scan ---- <unsigned> MD5: 6ca1292225b47a5421e941b3cfef48af C:\Program Files\Alwil Software\Avast4\Aavm4h.dll <unsigned> MD5: f3eac60879ae425d81dba70c3da76d13 C:\Program Files\Alwil Software\Avast4\AavmRpch.dll <unsigned> MD5: 02bd0feacaa1a65f77806a3c3debd046 C:\Program Files\Alwil Software\Avast4\AhRuiMai.dll <unsigned> MD5: 27bb54223d4aaebbeb0e65df776cf6c2 C:\Program Files\Alwil Software\Avast4\ahRuiMes.dll <unsigned> MD5: 99c120153031fbd057d4fa0499fff755 C:\Program Files\Alwil Software\Avast4\AhRuiNS.dll <unsigned> MD5: 9625471205dfc433fb73e231fc9cbb01 C:\Program Files\Alwil Software\Avast4\AhRuiOut.dll <unsigned> MD5: e5c7e4c34e43bfd68de1cf2034fe9af8 C:\Program Files\Alwil Software\Avast4\ahRuiP2P.dll <unsigned> MD5: cb39a7024be54e75e3b696272fdc0987 C:\Program Files\Alwil Software\Avast4\AhRuiStd.dll <unsigned> MD5: 8f933065a585eafd798dd5e49598cdcb C:\Program Files\Alwil Software\Avast4\AhRuiWS.dll <unsigned> MD5: e8b0edd5c8518d9a1f73ac0c54a94d7c C:\Program Files\Alwil Software\Avast4\ashBase.dll <unsigned> MD5: 0b9dbfe71f4eb4355985ee60e6a1dc3f C:\Program Files\Alwil Software\Avast4\ashTask.dll <unsigned> MD5: fce48f51523e38c5e74969766b353d73 C:\Program Files\Alwil Software\Avast4\ashUInt.dll <unsigned> MD5: 8ea778943b7e155991ae9e3c818269ab C:\Program Files\Alwil Software\Avast4\aswAux.dll <unsigned> MD5: f8df17a0090f29ee330b34145152f38a C:\Program Files\Alwil Software\Avast4\aswCmnB.dll <unsigned> MD5: 6d6416fa182fa865d265dffa5a03c3c2 C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll <unsigned> MD5: 7d79cd441ed208d062b326145c7b3aed C:\Program Files\Alwil Software\Avast4\aswCmnS.dll <unsigned> MD5: 68cf2e89bfb303567e78f9ac3482e5e9 C:\Program Files\Alwil Software\Avast4\GERMAN\Base.dll <unsigned> MD5: c37a82cab55ca0cc1df3079ebdfbaff3 C:\Program Files\Alwil Software\Avast4\GERMAN\Lang.dll <unsigned> MD5: 6c08604b5465de19eaac58c6a537d0bf C:\Program Files\Alwil Software\Avast4\XT1922.dll <unsigned> MD5: 3a9f70479a886dcc8e5151326156472d C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll <unsigned> MD5: caa2d58bfc41233a082c8b19d67b458d C:\Program Files\Java\jre6\bin\awt.dll <unsigned> MD5: f2ddab039241c453a7fb9e1d039b154d C:\Program Files\Java\jre6\bin\client\jvm.dll <unsigned> MD5: 5ac803360c5cb072fd089de1ce165386 C:\Program Files\Java\jre6\bin\deploy.dll <unsigned> MD5: b99688c2024fb0813b26beeaaf87615d C:\Program Files\Java\jre6\bin\hpi.dll <unsigned> MD5: 87739b517d98ade82df0e14edcda179e C:\Program Files\Java\jre6\bin\java.dll <unsigned> MD5: 2c6c7ad0e07da4d1f38dab01d1b0fd95 C:\Program Files\Java\jre6\bin\jp2native.dll <unsigned> MD5: 6655a2ecc5e0e99ac20987e668ee3857 C:\Program Files\Java\jre6\bin\net.dll <unsigned> MD5: d34e74f7a9cff2fa42e040312d559a5a C:\Program Files\Java\jre6\bin\nio.dll <unsigned> MD5: 03150330eac52a3a15f006be1ee01d36 C:\Program Files\Java\jre6\bin\regutils.dll <unsigned> MD5: 7605ce091c0b2a32e8bdbd630502fa38 C:\Program Files\Java\jre6\bin\verify.dll <unsigned> MD5: b7863bd54427e4ff1212503a4f270d05 C:\Program Files\Java\jre6\bin\zip.dll <unsigned> MD5: a447361e6156afef47a42ae9e89b2bb3 C:\Program Files\Join Air\AssistantServices.exe <unsigned> MD5: 4ef08a95991555dd2981c09367cca6c8 C:\Program Files\Join Air\UIExec.exe <unsigned> MD5: 26b018758226a5dc06de45496c394d40 C:\Program Files\Mozilla Firefox\freebl3.dll <unsigned> MD5: 9dfb30f203999a3ae0f258a33fa598f9 C:\Program Files\Mozilla Firefox\nssdbm3.dll <unsigned> MD5: 3d50c41f6ac9f395bc77477f14b07194 C:\Program Files\Mozilla Firefox\plugins\npwachk.dll <unsigned> MD5: 1fd6c03c0001a5e1eaf61596c2502f0c C:\Program Files\Mozilla Firefox\softokn3.dll <unsigned> MD5: 5a4cd8c1747b0c5e66f1a7b6a93453eb C:\Program Files\Winamp Remote\bin\OrbTray.exe <unsigned> MD5: e0a7d542b66725fe81eb9f5aeb9b1e82 C:\Program Files\WinRAR\RarExt.dll <unsigned> MD5: 421a25d626e5c2da375e357b1a9f0d80 C:\PROGRA~1\7-PDF\7-PDFM~1\7p.dll <unsigned> MD5: 63d660fe32a72da91af4ce02c1268f7a C:\Users\user\AppData\Local\Temp\Pgj.exe <unsigned> MD5: d18e59c18cffe15bcd76994141c8535a C:\Users\user\AppData\Local\Temp\Pgk.exe <unsigned> MD5: ffb6f6d5dab74e61b47c91245eed5090 C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2791.32001__90ba9c70f846762e\CLI.Component.Runtime.Shared.DLL <unsigned> MD5: 3c97e7131026a968c69892a3002f4003 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\894183c0c47bd4772fbfad4c1a7e3b71\mscorlib.ni.dll <unsigned> MD5: 31d759eb90cccadc5641b6461c8ae180 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\57e722244d3b48cb92b340bc92d7a191\System.Drawing.ni.dll <unsigned> MD5: 4005c194272628cd1362a7ac88b50718 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\425e95df110b77abad261a46fca54e99\System.Windows.Forms.ni.dll <unsigned> MD5: 5ed7722d11473666528dadc758e4edf1 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\99e7927ccb9099e607035349814d4cf6\System.Xml.ni.dll <unsigned> MD5: 96d9ccdfcbdab436bf49ad0ed15c18e3 C:\Windows\assembly\NativeImages_v2.0.50727_32\System\13cce38e8de5fd54853390e4e98abd0e\System.ni.dll <unsigned> MD5: ecc76d49e38c7a1847a97aaf77d6e33e C:\Windows\System32\dossec.dll <unsigned> MD5: eb638a6775788b474fbf88e8ff3b2cab C:\Windows\System32\Interop.SHDocVw.dll No file uploaded. Scan finished - communication took 1 sec Total traffic - 0.02 MB sent, 0.31 KB recvd Scanned 926 files and modules - 22 seconds Ich hoffe das kann euch schonmal weiterhelfen. Mir sagt es auf jeden Fall das ich 2 Verseuchte Dateien auf meinem Rechner habe, aber kann ich ihn jetzt noch retten !? Mit freundlichen Grüßen Petra |
Hallo und :hallo: Zitat:
Bitte nun einen Vollscan mit malwarebytes machen und Log posten. Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
|
Zitat:
Zitat:
Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 4032 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 24.04.2010 21:30:05 mbam-log-2010-04-24 (21-30-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 208895 Laufzeit: 56 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (hxxp://flvdirect.iamwired.net/) Good: (hxxp://www.google.com) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Program Files\7-PDF\7-PDF Maker\lib\App\OOo\URE\bin\unicows.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Users\user\AppData\Local\Temp\Pgk.exe (Trojan.FakeAlert) -> Delete on reboot. C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. Info: Bestimmte Objekte konnten nicht entfernt werden. Eine Logdatei wurde im Logdatei-Verzeichnis gespeichert. |
Anschließend der OTL Log: OTL logfile created on: 24.04.2010 21:42:21 - Run 1 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Users\user\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 78,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 166,64 Gb Free Space | 71,56% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: USER-PC Current User Name: user Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) PRC - C:\Program Files\Join Air\AssistantServices.exe () PRC - C:\Program Files\Join Air\UIExec.exe () PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE () PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (UI Assistant Service) -- C:\Program Files\Join Air\AssistantServices.exe () SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) ========== Driver Services (SafeList) ========== DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (ALWIL Software) DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software) DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software) DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software) DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software) DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated) DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated) DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated) DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated) DRV - (ManyCam) -- C:\Windows\System32\drivers\ManyCam.sys (ManyCam LLC.) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s125mgmt.sys (MCCI Corporation) DRV - (s125obex) -- C:\Windows\System32\drivers\s125obex.sys (MCCI Corporation) DRV - (s125mdm) -- C:\Windows\System32\drivers\s125mdm.sys (MCCI Corporation) DRV - (s125mdfl) -- C:\Windows\System32\drivers\s125mdfl.sys (MCCI Corporation) DRV - (s125bus) Sony Ericsson Device 125 driver (WDM) -- C:\Windows\System32\drivers\s125bus.sys (MCCI Corporation) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (itecir) -- C:\Windows\System32\drivers\itecir.sys (Windows (R) Codename Longhorn DDK provider) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation) DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=" FF - prefs.js..browser.search.order.1: "GMX Suche" FF - prefs.js..browser.search.order.2: "1und1 Suche" FF - prefs.js..browser.search.order.3: "amazon.de" FF - prefs.js..browser.search.order.4: "WEB.DE Suche" FF - prefs.js..browser.search.selectedEngine: "Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {95f24680-9e31-11da-a746-0800200c9a66}:0.1.5.5 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 5 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.18 FF - prefs.js..keyword.URL: "hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.03 12:38:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.20 02:29:14 | 000,000,000 | ---D | M] [2009.12.16 23:08:53 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Extensions [2010.04.24 04:08:21 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions [2009.12.17 00:36:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.01.27 03:19:55 | 000,000,000 | ---D | M] (Update Notifier) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{95f24680-9e31-11da-a746-0800200c9a66} [2010.04.22 23:00:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2010.04.05 02:56:27 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\79jwbfte.default\extensions\firefox@tvunetworks.com [2010.03.16 00:09:00 | 000,000,266 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\FireFox\Profiles\79jwbfte.default\searchplugins\Search.xml [2010.03.30 22:14:21 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [UIExec] C:\Program Files\Join Air\UIExec.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ManyCam] C:\Program Files\ManyCam 2.4\ManyCam.exe (ManyCam LLC) O4 - HKCU..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\user\AppData\Local\Temp\Pgk.exe File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\user\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\user\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.04.24 21:40:07 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2010.04.24 20:28:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes [2010.04.24 20:28:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.24 20:28:08 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.24 20:28:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010.04.24 20:28:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.04.24 04:27:39 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis [2010.04.23 19:53:54 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\MGM [2010.04.22 23:01:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\QuickScan [2010.04.17 18:53:15 | 000,000,000 | ---D | C] -- C:\Program Files\Latte! [2010.04.15 19:20:59 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Eigene WinZip-Dateien [2010.04.15 18:58:44 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZip [2010.04.15 18:32:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\7-PDFMaker [2010.04.15 18:32:13 | 000,000,000 | ---D | C] -- C:\Program Files\7-PDF [2010.04.15 18:26:18 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\RoNaSoft.de [2010.04.15 16:09:21 | 000,000,000 | ---D | C] -- C:\Games [2010.04.15 12:44:14 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\EleFun Games [2010.04.14 22:28:56 | 003,600,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.04.14 22:28:56 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.04.14 22:28:42 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.04.14 22:28:21 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010.04.14 22:28:21 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010.04.14 13:32:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\URSE Games [2010.04.13 03:16:30 | 000,000,000 | ---D | C] -- C:\ProgramData\GameXzone [2010.04.13 03:13:46 | 000,000,000 | ---D | C] -- C:\Program Files\MyRealGames.com [2010.04.08 01:47:44 | 000,000,000 | ---D | C] -- C:\Program Files\StreamTorrent 1.0 [2010.04.08 01:47:44 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\StreamTorrent [2010.04.05 02:59:42 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\TVU Networks [2010.04.05 02:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\TVU Networks [2010.04.05 02:56:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\TVUAx [2010.04.05 01:01:57 | 000,000,000 | ---D | C] -- C:\Program Files\SopCast [2010.03.31 12:30:38 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.03.31 12:30:37 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2010.03.31 12:30:37 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.03.31 12:30:37 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.03.31 12:30:37 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.03.31 12:30:36 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.03.31 12:30:36 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2010.03.31 12:30:36 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2010.03.31 12:30:36 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2010.03.31 12:30:36 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2010.03.31 12:30:36 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2010.03.31 12:30:36 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.03.31 12:30:36 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.03.31 12:30:36 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.03.31 12:30:35 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.03.30 22:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.03.30 22:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010.03.30 22:14:19 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.03.30 22:14:19 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.03.30 22:14:19 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.03.26 20:51:03 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP-2.0 [2009.06.16 14:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.04.24 21:44:17 | 001,418,612 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.04.24 21:44:17 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.04.24 21:44:17 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.04.24 21:44:17 | 000,122,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.04.24 21:44:17 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.04.24 21:41:21 | 002,097,152 | -HS- | M] () -- C:\Users\user\NTUSER.DAT [2010.04.24 21:40:09 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2010.04.24 21:37:49 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.04.24 21:37:46 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.04.24 21:37:46 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.04.24 21:37:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.04.24 21:37:35 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys [2010.04.24 21:36:59 | 000,524,288 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.04.24 21:36:59 | 000,065,536 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.04.24 21:36:26 | 006,291,456 | -H-- | M] () -- C:\Users\user\AppData\Local\IconCache.db [2010.04.24 21:21:01 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4201475959-196226615-1442939389-1000UA.job [2010.04.24 20:28:12 | 000,000,778 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.24 04:38:29 | 000,002,611 | ---- | M] () -- C:\Users\user\Desktop\HiJackThis.lnk [2010.04.24 01:21:00 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4201475959-196226615-1442939389-1000Core.job [2010.04.23 19:55:03 | 000,000,515 | ---- | M] () -- C:\Users\user\Desktop\MINIGOLF - Verknüpfung.lnk [2010.04.21 00:24:54 | 000,002,037 | ---- | M] () -- C:\Users\user\Desktop\Google Chrome.lnk [2010.04.20 02:29:15 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010.04.17 18:56:53 | 000,000,736 | ---- | M] () -- C:\Users\user\Desktop\Latte! - Verknüpfung.lnk [2010.04.15 18:32:24 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\7-PDF Maker.lnk [2010.04.15 15:43:38 | 000,000,951 | ---- | M] () -- C:\Users\user\Desktop\Sky Fight.lnk [2010.04.15 12:43:37 | 000,001,004 | ---- | M] () -- C:\Users\user\Desktop\Egyptian Ball.lnk [2010.04.15 12:03:54 | 000,001,008 | ---- | M] () -- C:\Users\user\Desktop\Fun And Bullets.lnk [2010.04.15 11:57:27 | 000,000,951 | ---- | M] () -- C:\Users\user\Desktop\Mini Golf.lnk [2010.04.14 13:31:20 | 000,000,944 | ---- | M] () -- C:\Users\user\Desktop\Gem Ball.lnk [2010.04.13 03:13:55 | 000,000,975 | ---- | M] () -- C:\Users\user\Desktop\Tibet Quest.lnk [2010.04.08 01:47:44 | 000,000,874 | ---- | M] () -- C:\Users\user\Desktop\StreamTorrent 1.0.lnk [2010.04.05 01:01:58 | 000,000,748 | ---- | M] () -- C:\Users\user\Desktop\SopCast.lnk [2010.03.29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.03.29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.03.26 21:01:13 | 000,005,239 | ---- | M] () -- C:\Users\user\.recently-used.xbel [2010.03.26 20:51:26 | 000,000,858 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.04.24 20:28:12 | 000,000,778 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.04.24 04:27:40 | 000,002,611 | ---- | C] () -- C:\Users\user\Desktop\HiJackThis.lnk [2010.04.23 19:55:03 | 000,000,515 | ---- | C] () -- C:\Users\user\Desktop\MINIGOLF - Verknüpfung.lnk [2010.04.17 18:56:53 | 000,000,736 | ---- | C] () -- C:\Users\user\Desktop\Latte! - Verknüpfung.lnk [2010.04.15 18:32:24 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\7-PDF Maker.lnk [2010.04.15 15:43:38 | 000,000,951 | ---- | C] () -- C:\Users\user\Desktop\Sky Fight.lnk [2010.04.15 12:43:37 | 000,001,004 | ---- | C] () -- C:\Users\user\Desktop\Egyptian Ball.lnk [2010.04.15 12:03:54 | 000,001,008 | ---- | C] () -- C:\Users\user\Desktop\Fun And Bullets.lnk [2010.04.15 11:57:27 | 000,000,951 | ---- | C] () -- C:\Users\user\Desktop\Mini Golf.lnk [2010.04.14 13:31:20 | 000,000,944 | ---- | C] () -- C:\Users\user\Desktop\Gem Ball.lnk [2010.04.13 03:13:55 | 000,000,975 | ---- | C] () -- C:\Users\user\Desktop\Tibet Quest.lnk [2010.04.08 01:47:44 | 000,000,874 | ---- | C] () -- C:\Users\user\Desktop\StreamTorrent 1.0.lnk [2010.04.05 01:01:58 | 000,000,748 | ---- | C] () -- C:\Users\user\Desktop\SopCast.lnk [2010.03.26 21:01:13 | 000,005,239 | ---- | C] () -- C:\Users\user\.recently-used.xbel [2010.03.26 20:51:26 | 000,000,858 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2010.03.16 00:18:32 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2010.01.25 20:47:50 | 000,138,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.09.24 00:15:32 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.14 08:08:36 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2009.06.16 14:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini < End of report > |
UND:OTL EXTRAS Logfile: Code: OTL Extras logfile created on: 24.04.2010 21:42:21 - Run 1 |
Starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code: :OTLDas Logfilemüsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. |
So, habe ich gemacht: Code: All processes killed |
Ok. Das mit dem Rechtsklick, als Administrator ausführen muss ich in Deinem ersten Beitrag irgendwie überlesen haben, klappt das jetzt wieder? Unabhängig davon ob das klappt oder nicht, bitte ein Log mit CF machen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
http://saved.im/mtm0nzyzmzd5/cofi.jpg
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! |
Zitat:
Nur als kleine zusätzliche Info, die Fenster (IE) mit der Werbung gehen nicht mehr auf. :daumenhoc Ich werde nun das ComboFix downloaden, installieren und ausführen. |
So, ebenfalls erledigt. Kann ich nun den Schutz wieder einschalten? Code: ComboFix 10-04-21.01 - user 25.04.2010 15:48:54.1.2 - x86 |
Das Log sieht ok aus. Noch Probleme mit dem Rechner? Ich vermute, das mit dem Rechtsklick als Admin ausführen geht immer noch nicht. Geht das grundsätzlich nicht mehr oder nur bei Hijackthis? :confused: mach bitte zur Kontrolle auch Logs mit OSAM und GMER und poste sie. |
Zitat:
Nur HijackThis kann ich nicht mit Rechtsklick als Administrator öffnen. Erstelle nun die geforderten Logs. |
Bei Hijackthis können wir das eh vernachlässigen, das Tool ist ziemlich in die Jahre gekommen und reicht für Analysen bei der heutigen Malware nicht mehr aus. |
Hier nun das osam Log: Code: Report of OSAM: Autorun Manager v5.0.11926.0Code: GMER 1.0.15.15281 - hxxp://www.gmer.net |
Sieht ok aus. Mach bitte Kontrollscans mit Malwarebytes und SASW und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 15:48 Uhr. |
Copyright ©2000-2025, Trojaner-Board