| |
| |||||||
Log-Analyse und Auswertung: Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabeiWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
23.06.2011, 21:54
| #1 |
| |  Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei Guten Tag, vorab schon einmal vielen Dank für alle Hilfe. Ich habe folgendes Problem: Ich habe mit Malwarebytes Antimalware gestern Abend (22.06.2011) einen Scan gemacht und er hat 3 infizierte Dateien gefunden. Hier das Logfile: Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Datenbank Version: 6922 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 22.06.2011 23:18:15 mbam-log-2011-06-22 (23-18-12).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|T:\|) Durchsuchte Objekte: 293975 Laufzeit: 34 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Arbeit\AppData\Local\Temp\0fnxdkci.exe.part (Trojan.Agent) -> No action taken. c:\Users\Arbeit\AppData\Local\Temp\il4imfeu.exe.part (Trojan.Agent) -> No action taken. c:\Users\Arbeit\AppData\Local\Temp\t11bmfny.exe.part (Trojan.Agent) -> No action taken. Ich habe dann (leider) die Dateien sofort desinfiziert. Eine Google Suche hat keine Ergebnisse ergeben bis auf Hinweise das diese Meldung bei MBAM VIELLEICHT ein falscher Alarm ist. Ich habe dann alle möglichen Scanner drüber laufen lassen, meinen Sunbelt VIPRE, hatte die Testversion drauf. Der hat nichts gefunden. Diverse Online Scanner von F-Secure, Trendmicro und Anti Spyware Programme wie SUPERAntiSpyware und Lavasoft Adware haben bis auf TRACKING COOKIES nichts gefunden. Ich habe inzwischen den Sunbelt VIPRE Antivirus Testversion deinstalliert und F-Secure Internet Security installiert, bisher bin ich sehr zufrieden damit. Vorher hatte ich die Free AVG Version installiert. Auf fragwürdigen pronographischen Seiten und illegalen Seiten bin ich nicht unterwegs. An Symptonen könnte ich nur folgendes berichten: Ich habe den Eindruck, dass sowohl der IE als auch FIREFOX manchmal einen seltsamen „lag“ haben, d.h. Sie scheinen nicht direkt zu reagieren, allerdings nicht die Windows-Meldung „Keine Rückmeldung“. Alles scheint in Ordnung, nur sie reagieren auf Eingaben nicht direkt. Es ist schwierig das fest zu machen und von Performance Problemen zu unterscheiden aber das ist zumindest mein Eindruck. Nach der Desinfektion von Malwarebytes findet Malwarebytes auch nichts mehr. Also aktuell werden keine Schädlinge erkannt, weder von MBAM, Superantispyware noch F-Secure. Bisher war mein System eigentlich immer nur mit „Tracking Cookies“ „infiziert“. Ist das überhaupt vermeidbar bei normalem Surfverhalten? Weitere Logfiles unten! Ich habe den OTL Quickscan wie in der Erstanleitung des Forums beschrieben gemacht,er hat auch die „OTL“ Datei erstellt allerdings keine Datei „Extras“. Vielen Dank und Freundliche Grüße Wunderbar! defogger_disable by jpshortstuff (23.02.10.1) Log created at 22:04 on 23/06/2011 (***) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL LOGFILE: OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.06.2011 22:10:27 - Run 3[/I] OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\***\Desktop 64bit- An unknown product Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,98 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 74,10% Memory free 7,96 Gb Paging File | 6,71 Gb Available in Paging File | 84,19% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 55,80 Gb Total Space | 13,38 Gb Free Space | 23,98% Space Free | Partition Type: NTFS Drive E: | 461,23 Gb Total Space | 115,77 Gb Free Space | 25,10% Space Free | Partition Type: NTFS Computer Name: ARBEIT | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe PRC - [2011.06.23 14:10:42 | 000,484,520 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe PRC - [2011.06.23 14:09:23 | 000,983,592 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe PRC - [2011.06.23 14:09:23 | 000,508,456 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE PRC - [2011.06.23 14:09:08 | 000,061,088 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe PRC - [2011.06.23 14:08:22 | 000,221,864 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe PRC - [2011.06.23 14:08:22 | 000,201,384 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSM32.EXE PRC - [2011.06.23 14:08:22 | 000,189,096 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE PRC - [2011.06.23 14:08:22 | 000,090,792 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.05.26 19:59:18 | 001,496,528 | ---- | M] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt\TrueCrypt.exe PRC - [2011.03.25 23:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe PRC - [2011.03.25 23:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe PRC - [2011.03.25 23:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe PRC - [2011.03.25 22:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe ========== Modules (SafeList) ========== MOD - [2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe MOD - [2011.06.23 14:08:27 | 000,332,456 | ---- | M] (F-Secure Corporation) -- c:\program files (x86)\f-secure\hips\fshook32.dll MOD - [2010.11.20 03:55:10 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.05.04 19:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Disabled | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE) SRV:64bit: - [2011.04.20 04:04:18 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.06.23 14:09:08 | 000,061,088 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe -- (FSORSPClient) SRV - [2011.06.23 14:08:24 | 000,849,576 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD) SRV - [2011.06.23 14:08:22 | 000,221,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter) SRV - [2011.06.23 14:08:22 | 000,189,096 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE -- (FSMA) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.06.01 14:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.05.16 14:58:36 | 002,151,128 | ---- | M] (Lavasoft Limited) [Disabled | Stopped] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2011.03.25 23:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2011.03.25 23:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service) SRV - [2011.03.25 23:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2011.03.25 22:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService) SRV - [2010.08.19 13:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.06.23 14:08:26 | 000,046,664 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fses.sys -- (FSES) DRV:64bit: - [2011.06.23 14:08:24 | 000,095,784 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fsdfw.sys -- (FSFW) DRV:64bit: - [2011.05.26 19:59:18 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2011.05.26 11:08:22 | 000,769,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\arusb_win7x.sys -- (arusb_win7x) DRV:64bit: - [2011.04.29 12:12:00 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd) DRV:64bit: - [2011.04.20 04:44:48 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.04.20 03:22:32 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.04.13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.03.25 23:27:36 | 000,068,720 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86) DRV:64bit: - [2011.03.25 23:27:34 | 000,081,008 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci) DRV:64bit: - [2011.03.25 23:27:28 | 000,030,832 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport) DRV:64bit: - [2011.03.25 23:25:46 | 000,031,856 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd) DRV:64bit: - [2011.03.25 23:25:34 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif) DRV:64bit: - [2011.03.25 22:27:36 | 000,038,512 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon) DRV:64bit: - [2011.03.25 20:05:00 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb) DRV:64bit: - [2011.03.25 20:04:58 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge) DRV:64bit: - [2011.03.25 20:04:58 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2011.02.11 23:23:34 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (npf) DRV:64bit: - [2011.02.08 13:30:52 | 000,064,512 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronXHCI.sys -- (EtronXHCI) DRV:64bit: - [2011.02.08 13:30:52 | 000,039,936 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronHub3.sys -- (EtronHub3) DRV:64bit: - [2010.11.26 01:31:56 | 000,017,408 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\DisplayLinkUsbPort_5.5.29055.0.sys -- (DisplayLinkUsbPort) DRV:64bit: - [2010.11.20 05:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 05:32:48 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2010.11.20 05:32:48 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 03:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.18 12:54:10 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\E63C.tmp -- (MEMSWEEP2) DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2011.06.23 14:09:59 | 000,198,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper) DRV - [2011.06.23 14:08:27 | 000,061,960 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys -- (F-Secure HIPS) DRV - [2011.06.23 14:08:22 | 000,041,896 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys -- (F-Secure Filter) DRV - [2011.06.23 14:08:22 | 000,027,304 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys -- (F-Secure Recognizer) DRV - [2011.06.23 14:08:22 | 000,015,016 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys -- (fsvista) DRV - [2010.08.19 13:56:38 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2010.02.17 20:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV) DRV - [2010.02.17 20:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DE FA 7D 4B AA 1B CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG10\Firefox4\ [2011.06.03 10:27:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\congstar\Internetmanager\Bin\addon FF - HKLM\software\mozilla\Firefox\Extensions\\litmus-ff@f-secure.com: C:\Program Files (x86)\F-Secure\NRS\litmus-ff@f-secure.com [2011.06.23 14:09:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.06.23 19:50:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.20 11:48:32 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.06.22 10:26:48 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.05.26 11:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2011.05.26 11:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.05.26 11:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\q57vlm80.default\extensions [2011.05.26 11:27:43 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\q57vlm80.default\extensions\foxmarks@kei.com [2011.06.23 20:05:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.05.26 15:55:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.05.26 12:55:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} File not found (No name found) -- File not found (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q57VLM80.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI File not found (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q57VLM80.DEFAULT\EXTENSIONS\FOXMARKS@KEI.COM [2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.05.26 12:55:55 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.07.20 17:21:40 | 000,106,192 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npstrlnk.dll [2011.03.22 20:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation) O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found. O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files (x86)\F-Secure\Common\FSM32.EXE (F-Secure Corporation) O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe (F-Secure Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat - Schnellstart.lnk - - File not found MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk - - File not found MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MCtlSvc.lnk - - File not found MsConfig:64bit - StartUpFolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - C:\Users\DANIEL~1\AppData\Roaming\Dropbox\bin\Dropbox.exe - (Dropbox, Inc.) MsConfig:64bit - StartUpFolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk - C:\PROGRA~2\Evernote\Evernote\EVERNO~2.EXE - (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) MsConfig:64bit - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - File not found MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - File not found MsConfig:64bit - StartUpReg: CanoScan Toolbox 4.9 - hkey= - key= - File not found MsConfig:64bit - StartUpReg: Eraser - hkey= - key= - File not found MsConfig:64bit - StartUpReg: FlashPlayerUpdate - hkey= - key= - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe (Adobe Systems, Inc.) MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) MsConfig:64bit - StartUpReg: NapsterShell - hkey= - key= - C:\Program Files (x86)\Napster\napster.exe (Napster) MsConfig:64bit - StartUpReg: PDF5 Registry Controller - hkey= - key= - C:\Program Files (x86)\Nuance\PDF Professional 5\RegistryController.exe (Nuance Communications, Inc.) MsConfig:64bit - StartUpReg: PDFHook - hkey= - key= - C:\Program Files (x86)\Nuance\PDF Professional 5\pdfpro5hook.exe (Nuance Communications, Inc.) MsConfig:64bit - StartUpReg: SpiderOak - hkey= - key= - File not found MsConfig:64bit - StartUpReg: VMware hqtray - hkey= - key= - C:\Program Files (x86)\VMware\VMware Player\hqtray.exe (VMware, Inc.) MsConfig:64bit - State: "startup" - Reg Error: Key error. MsConfig:64bit - State: "services" - Reg Error: Key error. CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.06.23 21:53:18 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2011.06.23 20:23:10 | 000,000,000 | ---D | C] -- C:\Dropbox Backup_ohne VS [2011.06.23 14:08:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\F-Secure Internet Security 2011 [2011.06.23 14:08:35 | 000,046,664 | ---- | C] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fses.sys [2011.06.23 14:08:34 | 000,095,784 | ---- | C] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fsdfw.sys [2011.06.23 14:08:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\F-Secure [2011.06.23 13:50:40 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg [2011.06.23 13:35:11 | 000,000,000 | ---D | C] -- C:\Temp [2011.06.23 12:59:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos [2011.06.23 12:59:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos [2011.06.23 12:38:40 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys [2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft [2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft [2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2011.06.23 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\SUPERAntiSpyware.com [2011.06.23 11:26:03 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2011.06.23 11:26:01 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE [2011.06.23 11:26:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware [2011.06.23 11:25:57 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware [2011.06.23 11:04:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\f-secure [2011.06.23 11:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure [2011.06.22 13:06:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon [2011.06.22 13:06:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Canon [2011.06.20 11:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Napster [2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sonic Shared [2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Roxio Shared [2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Napster Shared [2011.06.20 10:55:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Nuance [2011.06.20 10:55:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PDF Professional 5 [2011.06.20 10:55:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ScanSoft Shared [2011.06.20 10:55:09 | 000,000,000 | ---D | C] -- C:\ProgramData\zeon [2011.06.20 10:54:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nuance [2011.06.20 10:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Macrovision [2011.06.20 10:31:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Internetmanager [2011.06.16 17:02:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Microsoft Help [2011.06.16 17:02:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.06.15 23:24:06 | 000,049,752 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2011.06.15 23:24:06 | 000,045,904 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\sbbd.exe [2011.06.14 12:09:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KeePass Password Safe [2011.06.11 22:08:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Wireshark [2011.06.11 22:06:01 | 000,000,000 | ---D | C] -- C:\Programme\Wireshark [2011.06.08 10:19:37 | 001,377,856 | ---- | C] (VirusBuster Kft.) -- C:\Windows\SysNative\drivers\vbcorent-x64.sys [2011.06.07 12:11:51 | 000,000,000 | ---D | C] -- C:\Programme\WinPcap [2011.06.07 12:11:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nmap [2011.06.04 13:30:33 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SupportAppZXH [2011.06.03 15:55:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer [2011.06.03 12:45:43 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\TeamViewer [2011.06.02 14:43:26 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Diagnostics [2011.06.02 14:05:22 | 000,000,000 | -H-D | C] -- C:\$AVG [2011.05.31 10:33:48 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Updater5 [2011.05.31 10:33:16 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2011.05.30 14:26:48 | 000,000,000 | ---D | C] -- C:\tmprdp [2011.05.27 12:25:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG10 [2011.05.27 12:25:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2011.05.27 12:24:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG [2011.05.27 12:24:11 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData [2011.05.27 12:22:46 | 000,000,000 | ---D | C] -- C:\SMCLpav [2011.05.26 23:07:59 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011.05.26 21:52:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpiderOak [2011.05.26 19:59:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\TrueCrypt [2011.05.26 19:59:18 | 000,230,352 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.05.26 19:59:18 | 000,000,000 | ---D | C] -- C:\Programme\TrueCrypt [2011.05.26 19:59:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt [2011.05.26 18:32:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\VMware [2011.05.26 18:32:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\VMware [2011.05.26 18:26:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\skypePM [2011.05.26 18:26:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras [2011.05.26 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Skype [2011.05.26 18:25:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.05.26 17:49:15 | 000,000,000 | ---D | C] -- C:\Users\***\.edlohn [2011.05.26 15:56:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\OpenOffice.org [2011.05.26 15:56:21 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3 [2011.05.26 15:55:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3 [2011.05.26 15:53:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt [2011.05.26 15:51:23 | 000,127,488 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZSPOOL.DLL [2011.05.26 15:51:23 | 000,115,200 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZLhp1020.DLL [2011.05.26 15:51:23 | 000,061,952 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZIMF.DLL [2011.05.26 15:51:23 | 000,049,664 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZTAG.DLL [2011.05.26 15:50:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eDocPrinter PDF Pro [2011.05.26 15:50:11 | 000,000,000 | ---D | C] -- C:\Programme\ITEKSOFT [2011.05.26 15:45:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Evernote [2011.05.26 15:45:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote [2011.05.26 15:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Evernote [2011.05.26 15:44:47 | 000,000,000 | ---D | C] -- C:\Programme\HP [2011.05.26 15:39:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2011.05.26 15:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\theWord [2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\The Word [2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\ProgramData\The Word [2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The Word [2011.05.26 15:13:01 | 000,000,000 | ---D | C] -- C:\Programme\CrystalDiskMark [2011.05.26 15:13:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskMark [2011.05.26 13:33:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Canon [2011.05.26 13:14:49 | 000,081,008 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmci.sys [2011.05.26 13:14:48 | 000,068,720 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmx86.sys [2011.05.26 13:14:48 | 000,030,832 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\VMparport.sys [2011.05.26 13:14:28 | 000,334,448 | ---- | C] (VMware, Inc.) -- C:\Windows\SysWow64\vmnetdhcp.exe [2011.05.26 13:14:25 | 000,404,080 | ---- | C] (VMware, Inc.) -- C:\Windows\SysWow64\vmnat.exe [2011.05.26 13:14:24 | 000,030,320 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmnetuserif.sys [2011.05.26 13:14:23 | 000,968,816 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\vnetlib64.dll [2011.05.26 13:14:20 | 000,031,856 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\VMkbd.sys [2011.05.26 13:14:19 | 000,038,512 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\hcmon.sys [2011.05.26 13:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware [2011.05.26 13:14:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\VMware [2011.05.26 13:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\VMware [2011.05.26 13:13:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VMware [2011.05.26 13:08:55 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip [2011.05.26 13:08:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2011.05.26 13:01:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works [2011.05.26 12:56:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2011.05.26 12:56:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2011.05.26 12:55:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2011.05.26 12:53:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LibreOffice [2011.05.26 12:52:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LibreOffice 3 [2011.05.26 12:43:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview [2011.05.26 12:33:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Adobe [2011.05.26 12:31:29 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll [2011.05.26 12:31:16 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll [2011.05.26 12:30:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders [2011.05.26 12:25:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\RDP6 [2011.05.26 12:22:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Macromedia [2011.05.26 12:22:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Adobe [2011.05.26 12:22:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2011.05.26 12:21:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe [2011.05.26 12:21:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2011.05.26 12:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2011.05.26 12:20:37 | 000,000,000 | R--D | C] -- C:\Users\***\Documents\Scanned Documents [2011.05.26 12:20:37 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Fax [2011.05.26 12:20:29 | 000,000,000 | -H-D | C] -- C:\CanoScan [2011.05.26 12:19:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus [2011.05.26 12:19:42 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft IntelliPoint [2011.05.26 12:18:51 | 000,000,000 | ---D | C] -- C:\Programme\DisplayLink Core Software [2011.05.26 12:05:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.05.26 12:05:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2011.05.26 12:05:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Google [2011.05.26 12:04:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp [2011.05.26 12:04:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Roxio [2011.05.26 12:04:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in [2011.05.26 12:04:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect [2011.05.26 12:04:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Winamp [2011.05.26 12:04:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp [2011.05.26 12:03:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes [2011.05.26 12:03:29 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.05.26 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.05.26 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.05.26 12:03:26 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.05.26 12:03:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.05.26 12:03:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.05.26 12:03:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2011.05.26 12:02:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.05.26 12:02:45 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2011.05.26 11:56:51 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2011.05.26 11:48:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine [2011.05.26 11:48:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2011.05.26 11:48:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Napster [2011.05.26 11:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Napster [2011.05.26 11:44:39 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\WISO Mein Geld [2011.05.26 11:44:23 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Buhl Data Service [2011.05.26 11:44:20 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Buhl Data Service GmbH [2011.05.26 11:44:20 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Buhl Data Service [2011.05.26 11:43:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Panda Security [2011.05.26 11:42:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security [2011.05.26 11:38:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Mein Geld 2011 [2011.05.26 11:38:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Buhl Data Service GmbH [2011.05.26 11:37:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Buhl [2011.05.26 11:30:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Thunderbird [2011.05.26 11:30:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Thunderbird [2011.05.26 11:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup [2011.05.26 11:29:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup [2011.05.26 11:26:38 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Mozilla [2011.05.26 11:26:38 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Mozilla [2011.05.26 11:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2011.05.26 11:24:29 | 000,000,000 | R--D | C] -- C:\Users\***\Dropbox [2011.05.26 11:24:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird [2011.05.26 11:24:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird [2011.05.26 11:23:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox [2011.05.26 11:23:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dropbox [2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Intel Corporation [2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\ATI [2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ATI [2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2011.05.26 11:18:39 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\InstallShield [2011.05.26 11:17:47 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2011.05.26 11:17:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Etron Technology [2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\ATI Technologies [2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2011.05.26 11:17:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2011.05.26 11:17:10 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2011.05.26 11:17:10 | 000,000,000 | ---D | C] -- C:\Programme\ATI [2011.05.26 11:16:38 | 000,000,000 | ---D | C] -- C:\Programme\ATI Technologies [2011.05.26 11:16:16 | 000,000,000 | ---D | C] -- C:\ATI [2011.05.26 11:15:05 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll [2011.05.26 11:15:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2011.05.26 11:15:01 | 000,000,000 | ---D | C] -- C:\Intel [2011.05.26 11:06:30 | 000,000,000 | ---D | C] -- C:\ProgramData\TP-LINK [2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\Searches [2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.05.26 11:02:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Identities [2011.05.26 11:01:58 | 000,000,000 | R--D | C] -- C:\Users\***\Contacts [2011.05.26 11:01:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\VirtualStore [2011.05.26 11:01:55 | 000,000,000 | --SD | C] -- C:\Users\***\AppData\Roaming\Microsoft [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Videos [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Saved Games [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Pictures [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Music [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Links [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Favorites [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Downloads [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Documents [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Desktop [2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Vorlagen [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Verlauf [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Temporary Internet Files [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Startmenü [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\SendTo [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Recent [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Netzwerkumgebung [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Lokale Einstellungen [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Videos [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Musik [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Eigene Dateien [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Bilder [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Druckumgebung [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Cookies [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Anwendungsdaten [2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Anwendungsdaten [2011.05.26 11:01:55 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData [2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Temp [2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Microsoft [2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Media Center Programs [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Programme [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.05.26 11:01:51 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.05.26 10:58:10 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2011.05.26 10:58:02 | 000,000,000 | -HSD | C] -- C:\System Volume Information [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.06.23 22:10:08 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.23 22:10:08 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.23 22:10:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.06.23 22:08:38 | 001,528,372 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.06.23 22:08:38 | 000,663,740 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.06.23 22:08:38 | 000,625,622 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.06.23 22:08:38 | 000,134,254 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.06.23 22:08:38 | 000,110,644 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.06.23 22:06:08 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.06.23 22:03:06 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Scheduled scanning task.job [2011.06.23 22:03:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.23 22:03:03 | 3207,610,368 | -HS- | M] () -- C:\hiberfil.sys [2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2011.06.23 21:51:59 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable [2011.06.23 20:19:01 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe [2011.06.23 14:12:53 | 000,042,664 | ---- | M] () -- C:\Windows\SysWow64\drivers\fsbts.sys [2011.06.23 14:08:52 | 000,001,158 | ---- | M] () -- C:\Users\Public\Desktop\F-Secure Internet Security 2011.lnk [2011.06.23 14:08:35 | 001,550,624 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.06.23 14:08:26 | 000,046,664 | ---- | M] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fses.sys [2011.06.23 14:08:24 | 000,095,784 | ---- | M] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fsdfw.sys [2011.06.23 12:40:16 | 000,049,752 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2011.06.23 12:40:14 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe [2011.06.23 12:38:40 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.06.23 11:54:31 | 000,000,036 | ---- | M] () -- C:\Users\***\AppData\Local\housecall.guid.cache [2011.06.23 11:26:00 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.06.22 23:21:02 | 000,441,240 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.06.20 10:55:57 | 000,000,406 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2011.06.10 11:50:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2011.06.03 18:33:30 | 000,002,288 | ---- | M] () -- C:\Users\***\ClientEditor.properties [2011.06.03 15:54:40 | 000,000,907 | ---- | M] () -- C:\Users\***\Desktop\Downloads.lnk [2011.06.02 13:44:02 | 000,290,954 | ---- | M] () -- C:\Users\***\Desktop\TCPView.zip [2011.05.30 10:24:33 | 000,011,849 | ---- | M] () -- C:\Users\***\Desktop\EDLohn.jnlp [2011.05.30 07:16:44 | 001,377,856 | ---- | M] (VirusBuster Kft.) -- C:\Windows\SysNative\drivers\vbcorent-x64.sys [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.05.29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.05.27 16:10:19 | 000,000,498 | ---- | M] () -- C:\Users\***\Desktop\Dropbox Crypt.lnk [2011.05.27 12:35:54 | 000,001,193 | ---- | M] () -- C:\Users\***\Desktop\Dropbox.lnk [2011.05.27 11:38:45 | 000,000,999 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.05.26 19:59:18 | 000,230,352 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.05.26 18:26:37 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat [2011.05.26 15:58:09 | 000,001,235 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011.05.26 15:33:35 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf [2011.05.26 15:33:35 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf [2011.05.26 15:15:20 | 000,000,079 | ---- | M] () -- C:\Users\***\AppData\Local\CrystalDiskMark30.ini [2011.05.26 13:14:18 | 000,001,024 | ---- | M] () -- C:\.rnd [2011.05.26 12:19:56 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf [2011.05.26 11:19:30 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2011.05.26 11:08:22 | 000,769,024 | ---- | M] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\arusb_win7x.sys [2011.05.26 11:00:01 | 000,054,699 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.05.26 11:00:01 | 000,054,699 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2011.05.26 10:58:33 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.06.23 21:51:59 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable [2011.06.23 21:51:10 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe [2011.06.23 16:12:20 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe [2011.06.23 14:22:06 | 000,000,530 | ---- | C] () -- C:\Windows\tasks\Scheduled scanning task.job [2011.06.23 14:08:52 | 000,001,158 | ---- | C] () -- C:\Users\Public\Desktop\F-Secure Internet Security 2011.lnk [2011.06.23 14:08:42 | 000,042,664 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys [2011.06.23 12:38:40 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.06.23 11:54:31 | 000,000,036 | ---- | C] () -- C:\Users\***\AppData\Local\housecall.guid.cache [2011.06.23 11:26:00 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2011.06.20 10:55:48 | 000,000,406 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2011.06.15 11:56:35 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.06.14 12:09:16 | 000,001,110 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk [2011.06.11 22:06:08 | 000,001,565 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk [2011.06.10 11:50:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2011.06.03 15:55:31 | 000,001,181 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk [2011.06.03 15:54:40 | 000,000,907 | ---- | C] () -- C:\Users\***\Desktop\Downloads.lnk [2011.06.02 13:44:09 | 000,290,954 | ---- | C] () -- C:\Users\***\Desktop\TCPView.zip [2011.05.30 10:24:33 | 000,011,849 | ---- | C] () -- C:\Users\***\Desktop\EDLohn.jnlp [2011.05.27 16:10:05 | 000,000,498 | ---- | C] () -- C:\Users\***\Desktop\Dropbox Crypt.lnk [2011.05.27 12:35:54 | 000,001,193 | ---- | C] () -- C:\Users\***\Desktop\Dropbox.lnk [2011.05.27 11:38:45 | 000,000,999 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2011.05.26 18:58:28 | 000,002,288 | ---- | C] () -- C:\Users\***\ClientEditor.properties [2011.05.26 18:26:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.05.26 15:58:09 | 000,001,235 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011.05.26 15:51:23 | 000,574,100 | ---- | C] () -- C:\Windows\SysNative\hp1022n.img [2011.05.26 15:51:23 | 000,569,344 | ---- | C] () -- C:\Windows\SysNative\ZSHP1020.EXE [2011.05.26 15:51:23 | 000,206,768 | ---- | C] () -- C:\Windows\SysNative\hp1022.img [2011.05.26 15:51:23 | 000,128,380 | ---- | C] () -- C:\Windows\SysNative\hp1020.img [2011.05.26 15:51:23 | 000,010,698 | ---- | C] () -- C:\Windows\SysNative\ZSHP1020.CHM [2011.05.26 15:33:35 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf [2011.05.26 15:33:35 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf [2011.05.26 15:13:03 | 000,000,079 | ---- | C] () -- C:\Users\***\AppData\Local\CrystalDiskMark30.ini [2011.05.26 13:14:18 | 000,001,024 | ---- | C] () -- C:\.rnd [2011.05.26 13:14:15 | 001,550,624 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.05.26 12:31:37 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd [2011.05.26 12:31:29 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml [2011.05.26 12:31:18 | 000,146,389 | ---- | C] () -- C:\Windows\SysWow64\printmanagement.msc [2011.05.26 12:31:18 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml [2011.05.26 12:31:18 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml [2011.05.26 12:31:18 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml [2011.05.26 12:19:56 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf [2011.05.26 12:05:04 | 000,001,128 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.05.26 12:05:04 | 000,001,124 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.05.26 11:26:36 | 000,001,153 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.05.26 11:19:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.05.26 11:02:09 | 000,001,405 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.05.26 11:02:06 | 000,001,439 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.05.26 10:59:55 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2011.05.26 10:59:54 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2011.05.26 10:58:33 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.05.26 10:58:02 | 3207,610,368 | -HS- | C] () -- C:\hiberfil.sys [2011.03.17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2011.01.04 16:52:46 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\epdf0407.dll [2011.01.04 16:41:52 | 000,139,264 | ---- | C] () -- C:\Windows\SysWow64\epdf0406.dll [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.05.27 12:25:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG10 [2011.05.26 11:44:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service [2011.05.26 11:44:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service GmbH [2011.05.26 13:33:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon [2011.06.23 22:09:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox [2011.06.23 11:04:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\f-secure [2011.06.20 10:31:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Internetmanager [2011.05.26 12:53:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice [2011.05.26 15:56:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org [2011.05.26 11:43:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Panda Security [2011.06.23 16:09:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RDP6 [2011.06.03 16:15:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer [2011.06.23 21:50:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\The Word [2011.05.26 11:30:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird [2011.05.27 09:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TrueCrypt [2011.06.11 22:08:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Wireshark [2009.07.14 07:08:49 | 000,016,758 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.06.23 22:03:06 | 000,000,530 | ---- | M] () -- C:\Windows\Tasks\Scheduled scanning task.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.06.02 14:05:22 | 000,000,000 | -H-D | M] -- C:\$AVG [2011.06.04 13:40:25 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.05.26 11:16:16 | 000,000,000 | ---D | M] -- C:\ATI [2011.05.26 12:20:29 | 000,000,000 | -H-D | M] -- C:\CanoScan [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.06.23 20:23:23 | 000,000,000 | ---D | M] -- C:\Dropbox Backup_ohne VS [2011.05.26 11:15:01 | 000,000,000 | ---D | M] -- C:\Intel [2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.06.23 19:47:36 | 000,000,000 | R--D | M] -- C:\Programme [2011.06.23 20:05:17 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.06.23 13:57:08 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Programme [2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.05.27 12:23:31 | 000,000,000 | ---D | M] -- C:\SMCLpav [2011.06.23 22:10:51 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.06.23 13:40:19 | 000,000,000 | ---D | M] -- C:\Temp [2011.06.23 16:09:57 | 000,000,000 | ---D | M] -- C:\tmprdp [2011.06.04 13:40:23 | 000,000,000 | R--D | M] -- C:\Users [2011.06.23 14:49:54 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 04:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2010.11.20 05:24:46 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > [I]< End of report > |
|
24.06.2011, 09:55
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabeiZitat:
__________________ |
|
| Themen zu Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei |
| 64-bit, 7-zip, ad-aware, adware, antivirus, avg, bho, c:\hiberfil.sys, c:\windows\system32\rundll32.exe, cache.dat, canon, diagnostics, druck, drvstore, eigene bilder, eraser, error, ezsidmv.dat, firefox, firefox laggt, format, google, google earth, hiberfil.sys, hkcu\~\run values retrieved., infizierte dateien, installation, langs, laufzeit, logfile, malwarebytes trojan.agent, mozilla, mozilla thunderbird, netzwerkumgebung, object, performance, plug-in, prefetch, problem, recycle.bin, registry, rundll, scan, searchplugins, security, shell32.dll, software, spyware, start menu, system, syswow64, trojan.agent, usb, webcheck, windows xp, wiso |
Linear-Darstellung
