| |
| |||||||
Log-Analyse und Auswertung: Ordner auf externer Festplatte nur noch als VerknüpfungenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.09.2011, 02:20
| #1 | |
| |  Ordner auf externer Festplatte nur noch als Verknüpfungen Hallo! Ich habe quasi die Lösung für mein Problem gefunden. Denn am 23.06.2011, um 11:06 Uhr hat jemand mit dem Namen "Was nun tun" bereits das gleiche Problem (oder zumindest ein sehr sehr ähnliches) geschildert: Zitat: Zitat:
Es wird empfohlen mit OTL (ein programm das mir bis dahin nicht bekannt war) einen quick scan durchzuführen. Welches ich auch gemacht habe. Hier meine Ergebnisse bin mir nämlich nicht ganz sicher welches von den beiden txt richtig ist: Code:
ATTFilter OTL Extras logfile created on: 12.09.2011 21:51:14 - Run 1
OTL by OldTimer - Version 3.2.28.0 Folder = C:\Users\Burak\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,99 Gb Total Physical Memory | 1,66 Gb Available Physical Memory | 55,46% Memory free
6,19 Gb Paging File | 4,88 Gb Available in Paging File | 78,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 210,06 Gb Free Space | 70,47% Space Free | Partition Type: NTFS
Drive D: | 330,79 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 1,87 Gb Total Space | 0,38 Gb Free Space | 20,17% Space Free | Partition Type: FAT
Drive G: | 81,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive H: | 930,82 Gb Total Space | 788,90 Gb Free Space | 84,75% Space Free | Partition Type: NTFS
Computer Name: BURAK-PC | User Name: Burak | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0904B587-01DC-4B5A-9E1E-B6205CC2F271}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4C10218C-6432-4188-B740-8CA093819B02}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{70A26AC2-09DC-42A7-BFEB-EA73DB062B3D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{78ABB001-58C6-4B6D-AD8A-C2A909F691A9}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A0225E14-4230-4616-AD4E-385059301B56}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CA3EB679-EB7B-44F9-A3E2-290AEAC8C141}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D6C9697E-6BA5-449D-85F1-BB4A41269E9C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EAF11EEB-08CA-42D5-B472-16130406D892}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F5EF5067-9B24-4738-8A77-B2DF2EA0A045}" = lport=10243 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1231E70E-3059-4237-9A95-3B5C77249886}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1246FFA4-47CA-4C2D-8CAE-E938163AA978}" = dir=in | app=c:\users\burak\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{19BC1BEA-CE70-4D46-9B78-784A92670178}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2EE90D8D-51F8-4894-8EB2-15E076DB01D0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{36BCD21B-30D2-444A-9F2F-4F4D999A403B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{44571C97-3A16-439A-A829-AFCA4230CD4D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{570B629E-C2CC-4E2C-8AF4-9C9E9AA76CAF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{67B59370-3750-4060-A4C6-BCFBE7F90D97}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8D6C6F00-9C2C-4F65-B651-CE49375361B1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{95E029DC-0610-4C8C-B091-3D863D540A5A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{961EC056-05D5-4F02-A69C-72B720CCDB19}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B1E73530-FFD8-42D5-9A55-346A6A3B1499}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BF3BEAA9-6F10-4382-AF3E-085E4EB694A6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C37E2EE2-356C-4905-8AC5-5C93FE967B9C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CA0E4450-56E0-4528-9E9C-280875B1222E}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{CC3DA64C-5D77-45DF-9803-0CE49754DB77}" = protocol=6 | dir=out | app=system |
"{D29EDE34-8144-4BF5-912B-B279B6E5C660}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EAB418C3-86C8-4729-8996-5A54CBAE0FED}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{EBA3F310-82FB-4DF2-9F33-366F6B12709B}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F0356BFE-BA42-4767-846A-001E8FDAB121}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F0C294F1-E5A7-4920-9073-2974C3649D30}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{72F07D60-0650-4783-A091-630A32792031}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{87EA7A82-FECD-481A-807D-410A3E942A66}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{9697A1CC-6D46-43C9-95B4-E5074183AA27}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{5BCBCBEF-F85C-42B7-A819-2BAF3DFD8CFD}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{89FC69C5-ED0A-4FE8-BF0B-748CCE5178A5}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{FF225E5C-9EAA-4CE2-A53D-6EF4288A48EB}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04FCD5DE-1662-4F99-BDA9-C57212113EF2}" = RemoteComms External Disk Access
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{084709F7-38C5-4609-B55F-2417939315EB}" = Adobe Premiere Pro
"{1CE60928-8325-49A8-8B06-633E48DD2B67}" = Cisco Systems VPN Client 5.0.07.0410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{27107EAA-34E0-43BF-B537-7F8EF6880F5A}" = Facebook Video Calling 1.0.0.8177
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Azurewave Wireless LAN
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D901E911-3478-466F-8EA0-0AEE85F22E4B}" = wGet-Installer
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F803D042-5A46-42E8-86CA-C8A0A5C63518}" = Iomega Encryption
"A21C8DB81A474239909E6CB8B8DFC590_is1" = A1 Website Download
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Artisteer 2" = Artisteer 2
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"facetheme" = Facetheme
"foobar2000" = foobar2000 v1.1.7
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NAV" = Norton AntiVirus
"NVIDIA Drivers" = NVIDIA Drivers
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.5.0
"Google Chrome" = Google Chrome
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12.09.2011 08:51:56 | Computer Name = Burak-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.09.2011 11:07:37 | Computer Name = Burak-PC | Source = Bonjour Service | ID = 100
Description = 356: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 12.09.2011 11:07:37 | Computer Name = Burak-PC | Source = Bonjour Service | ID = 100
Description = 352: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 12.09.2011 11:07:37 | Computer Name = Burak-PC | Source = Bonjour Service | ID = 100
Description = 372: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
vom Remotehost geschlossen.)
Error - 12.09.2011 14:35:15 | Computer Name = Burak-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Nnyyyl.exe, Version 1.0.0.0, Zeitstempel 0x4dd18d33,
fehlerhaftes Modul Nnyyyl.exe, Version 1.0.0.0, Zeitstempel 0x4dd18d33, Ausnahmecode
0xc0000005, Fehleroffset 0x00010910, Prozess-ID 0xf00, Anwendungsstartzeit 01cc717ab6956325.
Error - 12.09.2011 14:36:25 | Computer Name = Burak-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.09.2011 19:43:08 | Computer Name = Burak-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Nnyyyl.exe, Version 1.0.0.0, Zeitstempel 0x4dd18d33,
fehlerhaftes Modul Nnyyyl.exe, Version 1.0.0.0, Zeitstempel 0x4dd18d33, Ausnahmecode
0xc0000005, Fehleroffset 0x00010910, Prozess-ID 0xe88, Anwendungsstartzeit 01cc71a5b9d65e2d.
Error - 12.09.2011 19:44:18 | Computer Name = Burak-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.09.2011 21:20:12 | Computer Name = Burak-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.28.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 149c Anfangszeit: 01cc71b30afde5ed Zeitpunkt der Beendigung:
2
Error - 12.09.2011 21:51:03 | Computer Name = Burak-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.28.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: cb8 Anfangszeit: 01cc71b782c5f91d Zeitpunkt der Beendigung:
3
[ System Events ]
Error - 10.09.2011 19:29:36 | Computer Name = Burak-PC | Source = HTTP | ID = 15016
Description =
Error - 10.09.2011 19:30:28 | Computer Name = Burak-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 11.09.2011 10:24:41 | Computer Name = Burak-PC | Source = HTTP | ID = 15016
Description =
Error - 11.09.2011 10:26:08 | Computer Name = Burak-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 11.09.2011 17:33:14 | Computer Name = Burak-PC | Source = HTTP | ID = 15016
Description =
Error - 11.09.2011 16:34:12 | Computer Name = Burak-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 12.09.2011 08:50:29 | Computer Name = Burak-PC | Source = HTTP | ID = 15016
Description =
Error - 12.09.2011 08:51:56 | Computer Name = Burak-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 12.09.2011 14:34:58 | Computer Name = Burak-PC | Source = HTTP | ID = 15016
Description =
Error - 12.09.2011 14:36:25 | Computer Name = Burak-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Code:
ATTFilter OTL logfile created on: 12.09.2011 21:51:14 - Run 1 OTL by OldTimer - Version 3.2.28.0 Folder = C:\Users\Burak\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,99 Gb Total Physical Memory | 1,66 Gb Available Physical Memory | 55,46% Memory free 6,19 Gb Paging File | 4,88 Gb Available in Paging File | 78,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 298,09 Gb Total Space | 210,06 Gb Free Space | 70,47% Space Free | Partition Type: NTFS Drive D: | 330,79 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive F: | 1,87 Gb Total Space | 0,38 Gb Free Space | 20,17% Space Free | Partition Type: FAT Drive G: | 81,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive H: | 930,82 Gb Total Space | 788,90 Gb Free Space | 84,75% Space Free | Partition Type: NTFS Computer Name: BURAK-PC | User Name: Burak | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.12 21:17:48 | 000,581,632 | ---- | M] (OldTimer Tools) -- C:\Users\Burak\Downloads\OTL.exe PRC - [2011.08.10 08:52:54 | 000,138,760 | R--- | M] (Symantec Corporation) -- C:\Programme\Norton AntiVirus\Engine\19.1.0.28\ccSvcHst.exe PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.09.27 11:58:24 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe PRC - [2008.10.29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.07.24 12:16:02 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.01.20 22:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.20 22:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.20 22:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2008.01.20 22:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe ========== Modules (No Company Name) ========== MOD - [2011.09.03 08:28:23 | 000,400,440 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\ppGoogleNaClPluginChrome.dll MOD - [2011.09.03 08:28:22 | 004,118,072 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\pdf.dll MOD - [2011.09.03 08:26:51 | 000,104,520 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\avutil-50.dll MOD - [2011.09.03 08:26:49 | 000,203,848 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\avformat-52.dll MOD - [2011.09.03 08:26:48 | 001,846,344 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\avcodec-52.dll MOD - [2011.09.03 06:35:01 | 006,338,720 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\Application\13.0.782.220\gcswf32.dll MOD - [2011.09.03 06:35:01 | 006,338,720 | ---- | M] () -- C:\Users\Burak\AppData\Local\Google\Chrome\APPLIC~1\130782~1.220\gcswf32.dll MOD - [2011.05.28 16:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2011.05.22 13:21:36 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll ========== Win32 Services (SafeList) ========== SRV - [2011.08.10 08:52:54 | 000,138,760 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton AntiVirus\Engine\19.1.0.28\ccSvcHst.exe -- (NAV) SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.09.27 11:58:24 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2009.08.24 08:16:12 | 000,378,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2008.01.20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.09.12 21:12:50 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\VirusDefs\20110912.020\navex15.sys -- (NAVEX15) DRV - [2011.09.12 21:12:50 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\VirusDefs\20110912.020\naveng.sys -- (NAVENG) DRV - [2011.09.12 20:41:47 | 000,127,096 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2011.08.09 21:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2011.08.08 11:38:12 | 000,132,744 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\ccSetx86.sys -- (ccSet_NAV) DRV - [2011.08.02 14:22:10 | 000,566,904 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\SRTSP.SYS -- (SRTSP) DRV - [2011.08.02 14:22:10 | 000,031,864 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL) DRV - [2011.07.28 15:20:02 | 000,897,656 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\SYMEFA.SYS -- (SymEFA) DRV - [2011.07.25 14:18:40 | 000,344,184 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\SYMTDIV.SYS -- (SYMTDIV) DRV - [2011.07.25 14:18:36 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\SYMDS.SYS -- (SymDS) DRV - [2011.07.25 14:15:52 | 000,149,624 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NAV\1301000.01C\Ironx86.SYS -- (SymIRON) DRV - [2011.07.25 14:15:12 | 000,815,736 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\BASHDefs\20110723.001\BHDrvx86.sys -- (BHDrvx86) DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.07.20 13:43:24 | 000,368,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\IPSDefs\20110726.001\IDSvix86.sys -- (IDSVix86) DRV - [2010.09.27 11:56:00 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.09.28 03:55:38 | 000,052,656 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OXSDIDRV_x32.sys -- (OXSDIDRV_x32) Oxford Semi eSATA Filter (x32) DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2008.08.07 22:15:00 | 007,555,136 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008.08.06 10:26:08 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008.08.05 18:59:26 | 000,044,576 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA) DRV - [2008.04.28 00:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.11.30 09:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF) DRV - [2003.08.11 04:07:46 | 000,014,604 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pfc.sys -- (pfc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Burak\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Burak\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Burak\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\IPSFFPlgn\ [2011.09.12 20:42:20 | 000,000,000 | ---D | M] O1 HOSTS File: ([2006.09.18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton AntiVirus\Engine\19.1.0.28\IPS\IPSBHO.dll (Symantec Corporation) O2 - BHO: (Facetheme) - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - C:\Programme\Object\bho_project.dll (InternetEngine) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Facebook Update] C:\Users\Burak\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [Nnyyyl] C:\Users\Burak\AppData\Roaming\Nnyyyl.exe () O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ACBBFB3F-0677-4C09-9FE8-BD8166E02CB3}: DhcpNameServer = 10.0.1.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006.10.28 08:27:39 | 000,000,175 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{96e2a9f7-c3d8-11e0-b17c-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{96e2a9f7-c3d8-11e0-b17c-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE -- [2006.10.28 08:27:39 | 000,463,152 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{96e2a9f7-c3d8-11e0-b17c-806e6f6e6963}\Shell\configure\command - "" = D:\SETUP.EXE -- [2006.10.28 08:27:39 | 000,463,152 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{96e2a9f7-c3d8-11e0-b17c-806e6f6e6963}\Shell\install\command - "" = D:\SETUP.EXE -- [2006.10.28 08:27:39 | 000,463,152 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\F\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: aux - wdmaud.drv (Microsoft Corporation) Drivers32: aux1 - wdmaud.drv (Microsoft Corporation) Drivers32: midi - wdmaud.drv (Microsoft Corporation) Drivers32: midi1 - wdmaud.drv (Microsoft Corporation) Drivers32: midi2 - wdmaud.drv (Microsoft Corporation) Drivers32: midimapper - midimap.dll (Microsoft Corporation) Drivers32: mixer - wdmaud.drv (Microsoft Corporation) Drivers32: mixer1 - wdmaud.drv (Microsoft Corporation) Drivers32: mixer2 - wdmaud.drv (Microsoft Corporation) Drivers32: msacm.imaadpcm - imaadp32.acm (Microsoft Corporation) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.msadpcm - msadp32.acm (Microsoft Corporation) Drivers32: msacm.msg711 - msg711.acm (Microsoft Corporation) Drivers32: msacm.msgsm610 - msgsm32.acm (Microsoft Corporation) Drivers32: MSVideo8 - VfWWDM32.dll (Microsoft Corporation) Drivers32: vidc.cvid - iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - i420vfw.dll (www.helixcommunity.org) Drivers32: VIDC.IYUV - iyuv_32.dll (Microsoft Corporation) Drivers32: vidc.mrle - msrle32.dll (Microsoft Corporation) Drivers32: vidc.msvc - msvidc32.dll (Microsoft Corporation) Drivers32: VIDC.UYVY - msyuv.dll (Microsoft Corporation) Drivers32: VIDC.YUY2 - msyuv.dll (Microsoft Corporation) Drivers32: vidc.yv12 - yv12vfw.dll (www.helixcommunity.org) Drivers32: VIDC.YVU9 - tsbyuv.dll (Microsoft Corporation) Drivers32: VIDC.YVYU - msyuv.dll (Microsoft Corporation) Drivers32: wave - wdmaud.drv (Microsoft Corporation) Drivers32: wave1 - wdmaud.drv (Microsoft Corporation) Drivers32: wave2 - wdmaud.drv (Microsoft Corporation) Drivers32: wavemapper - msacm32.drv (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.09.12 20:41:47 | 000,127,096 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS [2011.09.12 20:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared [2011.09.12 20:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec [2011.09.12 20:41:14 | 000,897,656 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\SymEFA.sys [2011.09.12 20:41:14 | 000,566,904 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\srtsp.sys [2011.09.12 20:41:14 | 000,344,184 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\symtdiv.sys [2011.09.12 20:41:14 | 000,340,088 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\SymDS.sys [2011.09.12 20:41:14 | 000,314,488 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\symnets.sys [2011.09.12 20:41:14 | 000,149,624 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\Ironx86.sys [2011.09.12 20:41:14 | 000,132,744 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\ccSetx86.sys [2011.09.12 20:41:14 | 000,031,864 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NAV\1301000.01C\srtspx.sys [2011.09.12 20:41:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NAV [2011.09.12 20:41:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NAV\1301000.01C [2011.09.12 20:40:58 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus [2011.09.12 20:40:58 | 000,000,000 | ---D | C] -- C:\Program Files\Norton AntiVirus [2011.09.12 20:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton [2011.09.12 20:40:44 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller [2011.09.12 20:40:44 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller [2011.09.12 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\Avira [2011.09.12 20:14:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.09.12 20:14:40 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.09.12 20:14:39 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.09.12 20:14:39 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.09.12 20:14:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.09.12 20:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.09.12 19:20:48 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Local\PlxTech [2011.09.10 19:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Systems VPN Client [2011.09.10 19:26:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Deterministic Networks [2011.09.10 19:26:01 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Systems [2011.09.07 00:27:52 | 000,000,000 | ---D | C] -- C:\Users\Burak\Desktop\Robert Musil - Die Verwirrungen des Zöglings Törleß [2011.09.05 18:57:38 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\vlc [2011.09.04 17:21:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2011.09.04 17:21:00 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2011.09.03 16:42:57 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Local\Facebook [2011.09.03 06:15:39 | 000,000,000 | ---D | C] -- C:\Users\Burak\Desktop\Tausend strahlende Sonnen [2011.08.30 19:05:41 | 000,000,000 | ---D | C] -- C:\Users\Burak\Documents\Artisteer Templates [2011.08.29 14:42:38 | 000,000,000 | ---D | C] -- C:\Users\Burak\Desktop\kanada [2011.08.28 08:17:52 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\FileZilla [2011.08.28 08:17:32 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client [2011.08.28 08:17:29 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client [2011.08.28 07:59:04 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\Artisteer [2011.08.28 07:51:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Artisteer 2 [2011.08.28 07:50:54 | 000,000,000 | ---D | C] -- C:\Program Files\Artisteer 2 [2011.08.27 22:45:49 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\Skype [2011.08.27 22:45:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.08.27 22:45:37 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2011.08.27 22:45:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011.08.27 03:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2011.08.27 03:16:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works [2011.08.27 03:16:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2011.08.27 03:15:10 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2011.08.27 03:15:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2011.08.27 02:55:31 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Local\Microsoft Help [2011.08.27 02:55:18 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office [2011.08.27 02:55:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.08.27 02:53:49 | 000,000,000 | RH-D | C] -- C:\MSOCache [2011.08.27 02:23:55 | 000,000,000 | ---D | C] -- C:\Users\Burak\Start Menu [2011.08.23 09:05:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother [2011.08.23 05:13:28 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Local\Adobe [2011.08.23 05:12:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2011.08.18 18:48:26 | 000,000,000 | ---D | C] -- C:\Users\Burak\Documents\Microsys [2011.08.18 18:48:26 | 000,000,000 | ---D | C] -- C:\Users\Burak\AppData\Roaming\Microsys [2011.08.18 18:48:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsys [2011.08.18 18:48:19 | 000,000,000 | ---D | C] -- C:\Program Files\Microsys [2011.08.18 18:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\wGet 1.9 [2011.08.18 18:46:37 | 000,000,000 | ---D | C] -- C:\Program Files\WGET [2011.08.18 18:46:14 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations [2011.08.14 12:52:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.08.14 12:51:12 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2 C:\Users\Burak\AppData\Roaming\*.tmp files -> C:\Users\Burak\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.12 21:42:48 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.09.12 21:42:48 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.09.12 21:08:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000UA.job [2011.09.12 21:01:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.09.12 20:42:16 | 001,661,071 | ---- | M] () -- C:\Windows\System32\drivers\NAV\1301000.01C\Cat.DB [2011.09.12 20:41:47 | 000,127,096 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS [2011.09.12 20:41:47 | 000,007,510 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT [2011.09.12 20:41:47 | 000,000,806 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF [2011.09.12 20:41:38 | 000,002,125 | ---- | M] () -- C:\Users\Public\Desktop\Norton AntiVirus.lnk [2011.09.12 20:15:47 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.09.12 20:15:47 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.09.12 20:15:47 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.09.12 20:15:47 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.09.12 20:14:49 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.09.12 19:48:01 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000UA.job [2011.09.12 19:43:00 | 000,106,357 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011.09.12 19:42:53 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.09.12 19:42:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.09.12 19:42:33 | 3215,855,616 | -HS- | M] () -- C:\hiberfil.sys [2011.09.12 08:56:11 | 000,123,914 | ---- | M] () -- C:\Users\Burak\Documents\Fee Fall.jpg [2011.09.11 22:48:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000Core.job [2011.09.11 19:00:28 | 000,013,312 | ---- | M] () -- C:\Users\Burak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.09.10 19:27:39 | 000,001,594 | ---- | M] () -- C:\Windows\VPNInstall.MIF [2011.09.10 19:26:07 | 000,001,982 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2011.09.10 13:28:32 | 001,431,508 | ---- | M] () -- C:\Users\Burak\Documents\IMG_0380.JPG [2011.09.10 12:03:58 | 000,179,712 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\Nnyyyl.exe [2011.09.10 00:08:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000Core.job [2011.09.04 19:49:16 | 000,000,680 | ---- | M] () -- C:\Users\Burak\AppData\Local\d3d9caps.dat [2011.09.04 17:21:15 | 000,000,859 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2011.09.03 08:34:00 | 000,001,549 | ---- | M] () -- C:\Users\Burak\Desktop\Uni Freiburg2.lnk [2011.09.03 08:33:59 | 000,001,547 | ---- | M] () -- C:\Users\Burak\Desktop\$RECYCLE.BIN.lnk [2011.09.02 16:18:20 | 000,106,357 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011.09.02 02:52:37 | 004,590,471 | ---- | M] () -- C:\Users\Burak\Desktop\Mapback2010.pdf [2011.09.02 02:51:08 | 003,292,930 | ---- | M] () -- C:\Users\Burak\Desktop\MapFront2010.pdf [2011.09.01 13:16:46 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FE8D.exe [2011.09.01 10:44:44 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\CC53.exe [2011.09.01 06:46:08 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\DB9E.exe [2011.08.31 17:32:29 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\C4B5.exe [2011.08.31 16:16:43 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\CE36.exe [2011.08.31 02:52:48 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\F8B0.exe [2011.08.30 11:21:40 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FD9F.exe [2011.08.30 05:22:37 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FC67.exe [2011.08.29 13:32:23 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\9691.exe [2011.08.29 13:24:06 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\1C1.exe [2011.08.29 13:07:01 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\5C0E.exe [2011.08.28 18:40:34 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\5479.exe [2011.08.28 18:28:40 | 000,000,385 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\6E2F.exe [2011.08.28 17:25:06 | 000,000,385 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\3A60.exe [2011.08.28 08:17:34 | 000,001,785 | ---- | M] () -- C:\Users\Burak\Desktop\FileZilla Client.lnk [2011.08.28 07:51:46 | 000,000,918 | ---- | M] () -- C:\Users\Burak\Desktop\Artisteer 2.lnk [2011.08.27 22:45:38 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2011.08.27 10:08:58 | 000,265,000 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.08.23 09:05:46 | 000,000,416 | ---- | M] () -- C:\Windows\BRWMARK.INI [2011.08.23 09:05:46 | 000,000,034 | ---- | M] () -- C:\Windows\System32\BXD2140.DAT [2011.08.18 17:40:50 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\NAV\1301000.01C\isolate.ini [2 C:\Users\Burak\AppData\Roaming\*.tmp files -> C:\Users\Burak\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.12 20:41:50 | 001,661,071 | ---- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\Cat.DB [2011.09.12 20:41:47 | 000,007,510 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT [2011.09.12 20:41:47 | 000,000,806 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF [2011.09.12 20:41:38 | 000,002,125 | ---- | C] () -- C:\Users\Public\Desktop\Norton AntiVirus.lnk [2011.09.12 20:41:09 | 000,003,433 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymEFA.inf [2011.09.12 20:41:09 | 000,002,852 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymDS.inf [2011.09.12 20:41:09 | 000,001,468 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymNetV.inf [2011.09.12 20:41:09 | 000,001,440 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymNet.inf [2011.09.12 20:41:09 | 000,001,389 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\srtspx.inf [2011.09.12 20:41:09 | 000,001,389 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\srtsp.inf [2011.09.12 20:41:09 | 000,000,828 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\ccSetx86.inf [2011.09.12 20:41:09 | 000,000,742 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\Iron.inf [2011.09.12 20:41:01 | 000,002,801 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymVTcer.dat [2011.09.12 20:41:00 | 000,007,877 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\symnetv.cat [2011.09.12 20:41:00 | 000,007,510 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\ccSetx86.cat [2011.09.12 20:41:00 | 000,007,498 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymEFA.cat [2011.09.12 20:41:00 | 000,007,496 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\srtspx.cat [2011.09.12 20:41:00 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymDS.cat [2011.09.12 20:41:00 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\srtsp.cat [2011.09.12 20:41:00 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\iron.cat [2011.09.12 20:41:00 | 000,007,458 | R--- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\SymNet.cat [2011.09.12 20:41:00 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\NAV\1301000.01C\isolate.ini [2011.09.12 20:14:49 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.09.12 19:15:27 | 000,001,547 | ---- | C] () -- C:\Users\Burak\Desktop\$RECYCLE.BIN.lnk [2011.09.12 16:11:05 | 000,001,549 | ---- | C] () -- C:\Users\Burak\Desktop\Uni Freiburg2.lnk [2011.09.12 08:56:11 | 000,123,914 | ---- | C] () -- C:\Users\Burak\Documents\Fee Fall.jpg [2011.09.10 19:26:07 | 000,001,982 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk [2011.09.10 19:25:51 | 000,001,594 | ---- | C] () -- C:\Windows\VPNInstall.MIF [2011.09.10 13:27:32 | 001,431,508 | ---- | C] () -- C:\Users\Burak\Documents\IMG_0380.JPG [2011.09.10 12:03:50 | 000,179,712 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\Nnyyyl.exe [2011.09.04 17:21:15 | 000,000,859 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2011.09.03 16:43:01 | 000,000,928 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000UA.job [2011.09.03 16:43:00 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000Core.job [2011.09.02 02:52:44 | 004,590,471 | ---- | C] () -- C:\Users\Burak\Desktop\Mapback2010.pdf [2011.09.02 02:51:14 | 003,292,930 | ---- | C] () -- C:\Users\Burak\Desktop\MapFront2010.pdf [2011.09.01 13:16:46 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\FE8D.exe [2011.09.01 10:44:44 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\CC53.exe [2011.09.01 06:46:08 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\DB9E.exe [2011.08.31 17:32:29 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\C4B5.exe [2011.08.31 16:16:43 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\CE36.exe [2011.08.31 02:52:48 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\F8B0.exe [2011.08.30 11:21:40 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\FD9F.exe [2011.08.30 05:22:37 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\FC67.exe [2011.08.29 13:32:23 | 000,406,493 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\9691.exe [2011.08.29 13:24:06 | 000,000,028 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\1C1.exe [2011.08.29 13:07:01 | 000,000,028 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\5C0E.exe [2011.08.28 18:40:34 | 000,000,028 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\5479.exe [2011.08.28 18:28:40 | 000,000,385 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\6E2F.exe [2011.08.28 17:25:06 | 000,000,385 | ---- | C] () -- C:\Users\Burak\AppData\Roaming\3A60.exe [2011.08.28 08:17:34 | 000,001,785 | ---- | C] () -- C:\Users\Burak\Desktop\FileZilla Client.lnk [2011.08.28 07:51:46 | 000,000,918 | ---- | C] () -- C:\Users\Burak\Desktop\Artisteer 2.lnk [2011.08.27 22:45:38 | 000,001,880 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2011.08.23 09:05:46 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.08.23 09:05:46 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BXD2140.DAT [2011.08.23 05:13:19 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.08.14 12:51:25 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.08.14 12:51:24 | 000,001,092 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.08.12 21:29:51 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2011.08.12 21:29:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2011.08.12 10:18:13 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2011.08.12 10:17:12 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll [2011.08.11 21:45:03 | 000,013,312 | ---- | C] () -- C:\Users\Burak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.08.11 01:38:38 | 000,000,143 | ---- | C] () -- C:\Windows\RtDefLvl.ini [2011.08.11 01:38:12 | 000,106,357 | ---- | C] () -- C:\ProgramData\nvModes.dat [2011.08.11 01:38:12 | 000,106,357 | ---- | C] () -- C:\ProgramData\nvModes.001 [2011.08.11 01:25:44 | 000,024,880 | ---- | C] () -- C:\Windows\System32\drivers\OXUDIDRV_x32.sys [2011.08.11 01:22:58 | 000,000,680 | ---- | C] () -- C:\Users\Burak\AppData\Local\d3d9caps.dat [2010.09.27 12:03:08 | 000,201,512 | ---- | C] () -- C:\Windows\System32\vpnapi.dll [2009.09.28 03:55:38 | 000,052,656 | ---- | C] () -- C:\Windows\System32\drivers\OXSDIDRV_x32.sys [2009.09.28 03:55:16 | 000,048,688 | ---- | C] () -- C:\Windows\System32\OXSDICIN_x32.dll [2008.01.21 03:15:58 | 000,618,442 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 03:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 03:15:58 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 03:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 08:47:37 | 000,265,000 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 06:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 06:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2003.11.14 08:19:30 | 000,225,280 | ---- | C] () -- C:\Windows\System32\wget.exe [2003.10.01 04:50:40 | 000,159,744 | ---- | C] () -- C:\Windows\System32\ssleay32.dll [2003.10.01 04:50:18 | 000,876,544 | ---- | C] () -- C:\Windows\System32\libeay32.dll ========== LOP Check ========== [2011.08.28 07:59:04 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Artisteer [2011.08.12 11:52:04 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Canneverbe Limited [2011.08.31 16:49:54 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\FileZilla [2011.08.12 10:27:41 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\foobar2000 [2011.08.18 18:48:26 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Microsys [2011.09.11 22:48:00 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000Core.job [2011.09.12 19:48:01 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2258927344-2437860437-160122833-1000UA.job [2011.09.12 19:41:03 | 000,032,616 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.08.23 05:13:28 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Adobe [2011.08.27 02:12:04 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Apple Computer [2011.08.28 07:59:04 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Artisteer [2011.09.12 20:15:29 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Avira [2011.08.12 11:52:04 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Canneverbe Limited [2011.08.31 16:49:54 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\FileZilla [2011.08.12 10:27:41 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\foobar2000 [2011.08.11 01:23:02 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Identities [2011.08.11 01:42:20 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\InstallShield [2011.08.11 01:58:45 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Macromedia [2006.11.02 08:37:34 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Media Center Programs [2011.09.12 19:16:40 | 000,000,000 | --SD | M] -- C:\Users\Burak\AppData\Roaming\Microsoft [2011.08.18 18:48:26 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Microsys [2011.09.12 21:50:02 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\Skype [2011.09.05 18:58:01 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\vlc [2011.08.12 10:13:32 | 000,000,000 | ---D | M] -- C:\Users\Burak\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2011.08.29 13:24:06 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\1C1.exe [2011.08.28 17:25:06 | 000,000,385 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\3A60.exe [2011.08.28 18:40:34 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\5479.exe [2011.08.29 13:07:01 | 000,000,028 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\5C0E.exe [2011.08.28 18:28:40 | 000,000,385 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\6E2F.exe [2011.08.29 13:32:23 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\9691.exe [2011.08.31 17:32:29 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\C4B5.exe [2011.09.01 10:44:44 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\CC53.exe [2011.08.31 16:16:43 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\CE36.exe [2011.09.01 06:46:08 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\DB9E.exe [2011.08.31 02:52:48 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\F8B0.exe [2011.08.30 05:22:37 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FC67.exe [2011.08.30 11:21:40 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FD9F.exe [2011.09.01 13:16:46 | 000,406,493 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\FE8D.exe [2011.09.10 12:03:58 | 000,179,712 | ---- | M] () -- C:\Users\Burak\AppData\Roaming\Nnyyyl.exe [2 C:\Users\Burak\AppData\Roaming\*.tmp files -> C:\Users\Burak\AppData\Roaming\*.tmp -> ] < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.20 22:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.20 22:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.20 22:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.20 22:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 05:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.20 22:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.20 22:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.20 22:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 05:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTOR.SYS > [2008.07.20 11:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\Users\Burak\Driver\Vista\Floppy_Inf\IaStor.sys [2008.07.20 11:44:44 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\Users\Burak\Driver\WinXP\Floppy_Inf\IaStor.sys < MD5 for: IASTORV.SYS > [2008.01.20 22:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.20 22:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.20 22:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 02:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.20 22:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll [2008.01.20 22:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.20 22:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.20 22:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.20 22:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.20 22:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll [2008.01.20 22:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 02:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2009.04.11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2008.01.20 22:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2008.01.20 22:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll < MD5 for: USERINIT.EXE > [2008.01.20 22:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.20 22:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.20 22:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.20 22:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.20 22:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe [2008.01.20 22:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.20 22:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.20 22:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.20 23:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.20 23:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.20 23:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.01.20 22:24:26 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll [2008.01.20 22:24:26 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll < End of report > Gruß Wasnuntun2 (ich hoffe ich habe nicht gegen die Forenregeln verstoßen - wenn doch bitte ich hiermit um entschuldigung!) Geändert von Wasnuntun2 (13.09.2011 um 02:36 Uhr) |
|
13.09.2011, 14:26
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Ordner auf externer Festplatte nur noch als Verknüpfungen Hallo und
__________________ Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Führe danach auch bitte ESET aus, danach sehen wir weiter. ESET Online Scanner
n.
__________________ |
|
13.09.2011, 18:10
| #3 |
| | Ordner auf externer Festplatte nur noch als Verknüpfungen Hallo!
__________________zuerst einmal danke für die schnelle antwort! ich konnte nachdem ich OTL ausgeführt hatte plötzlich meine daten unsichtbar auf der externen festplatte sehen (zwar sind sie unsichtbar und ich kann es nicht ändern) aber ich habe sie sicherheitshalber auf meinen rechner gezogen in den ordner "rettung" naja dann habe ich die anweisungen befolgt und heraus kam das: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6cff271c4d839548b5829dcfae9b4d40
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-13 06:04:46
# local_time=2011-09-13 02:04:46 (-0500, Eastern Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16774141 100 94 0 51520093 0 0
# compatibility_mode=3589 16777214 60 43 0 134030294 0 0
# compatibility_mode=5892 16776574 100 100 0 152538958 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=147563
# found=3
# cleaned=0
# scan_time=5656
C:\$Recycle.Bin\S-1-5-21-2258927344-2437860437-160122833-1000\$R30J7K0.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
C:\$Recycle.Bin\S-1-5-21-2258927344-2437860437-160122833-1000\$RL0Y9XK.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
C:\Users\Burak\Desktop\Rettung\$RECYCLE.BIN\S-1-5-21-2258927344-2437860437-160122833-1000\$RNN334Q.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
Code:
ATTFilter 10:41:57 Burak MESSAGE Protection started successfully
10:42:01 Burak MESSAGE IP Protection started successfully
10:55:12 Burak MESSAGE Protection started successfully
10:55:16 Burak MESSAGE IP Protection started successfully
10:56:25 Burak DETECTION C:\Users\Burak\AppData\Roaming\Nnyyyl.exe Trojan.EnoV.Gen QUARANTINE
10:56:28 Burak DETECTION C:\USERS\BURAK\APPDATA\ROAMING\NNYYYL.EXE Trojan.EnoV.Gen DENY
10:56:36 Burak DETECTION C:\Users\Burak\AppData\Roaming\Nnyyyl.exe Trojan.EnoV.Gen DENY
13:11:09 Burak MESSAGE Scheduled update executed successfully
13:11:10 Burak MESSAGE IP Protection stopped
13:11:32 Burak MESSAGE Database updated successfully
13:11:33 Burak MESSAGE IP Protection started successfully
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6cff271c4d839548b5829dcfae9b4d40
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-13 06:04:46
# local_time=2011-09-13 02:04:46 (-0500, Eastern Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16774141 100 94 0 51520093 0 0
# compatibility_mode=3589 16777214 60 43 0 134030294 0 0
# compatibility_mode=5892 16776574 100 100 0 152538958 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=147563
# found=3
# cleaned=0
# scan_time=5656
C:\$Recycle.Bin\S-1-5-21-2258927344-2437860437-160122833-1000\$R30J7K0.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
C:\$Recycle.Bin\S-1-5-21-2258927344-2437860437-160122833-1000\$RL0Y9XK.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
C:\Users\Burak\Desktop\Rettung\$RECYCLE.BIN\S-1-5-21-2258927344-2437860437-160122833-1000\$RNN334Q.lnk Win32/Dorkbot.D worm (unable to clean) 00000000000000000000000000000000 I
 aber wie werde ich die komischen "neuen" dateien jetzt los? liebe grüße burak |
|
13.09.2011, 19:03
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ordner auf externer Festplatte nur noch als Verknüpfungen Log von Malwarebytes fehlt, dafür wurde das von ESET doppelt gepostet.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.09.2011, 18:44
| #5 |
| | Ordner auf externer Festplatte nur noch als Verknüpfungen oh sorry habe ich gar nicht gesehen... Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 7708
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
13.09.2011 12:21:46
mbam-log-2011-09-13 (12-21-46).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|H:\|)
Durchsuchte Objekte: 361882
Laufzeit: 1 Stunde(n), 24 Minute(n), 31 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 17
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\Users\Burak\AppData\Local\Temp\loko2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\FC67.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\9691.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\96C3.tmp (Trojan.EnoV.Gen) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\FD9F.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\FE8D.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\C4B5.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\CC53.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\CE36.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\DA0A.tmp (Malware.Packer.as) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\DB9E.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\AppData\Roaming\F8B0.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Users\Burak\Desktop\Rettung\RECYCLER\0x2d9fa278.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
f:\RECYCLER\f4448e25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
h:\RECYCLER\0x2d9fa278.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
h:\system volume information\_restore{dd33a3fc-0dd2-4ac4-a1ca-4044c79ded2e}\RP131\A0163174.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
h:\system volume information\_restore{dd33a3fc-0dd2-4ac4-a1ca-4044c79ded2e}\RP131\A0163185.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
liebe grüße |
|
14.09.2011, 21:06
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ordner auf externer Festplatte nur noch als Verknüpfungen Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________ --> Ordner auf externer Festplatte nur noch als Verknüpfungen |
|
| Themen zu Ordner auf externer Festplatte nur noch als Verknüpfungen |
| 32-bit, 4d36e972-e325-11ce-bfc1-08002be10318, adobe, avira, bonjour, c:\windows\system32\rundll32.exe, desktop, error, excel, excel.exe, festplatte, flash player, format, google, google chrome, google earth, home, install.exe, limited.com/facebook, logfile, microsoft office word, nvlddmkm.sys, nvstor.sys, problem, programm, realtek, registry, rundll, scan, security, shell32.dll, shortcut, software, stick, super, svchost.exe, tcp, udp, version=1.0, vista, wrapper |
