| |
| |||||||
Log-Analyse und Auswertung: Umleitung auf ihavenet.comWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
19.11.2012, 16:59
| #1 |
| |  Umleitung auf ihavenet.com Hallo liebes Trojaner Board! Mein Computer hat seit kurzem das Problem, dass man sobald man auf einen Link im Google-Suchergebnis klickt auf "ihavenet.com" oder manchmal auch andere Seiten weitergeleitet wird. Ich bisher folgende Dinge unternommen: (laut Anleitungen hier im Forum)
TDSSKiller hat 4 oder 5 Sachen gefunden, die aber harmlos zu scheinen sein (Drucker- /Sound-Treiber zB) Logfiles: TDSSKiller: Code:
ATTFilter 17:13:10.0484 3052 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
17:13:10.0671 3052 ============================================================
17:13:10.0671 3052 Current date / time: 2012/11/14 17:13:10.0671
17:13:10.0671 3052 SystemInfo:
17:13:10.0671 3052
17:13:10.0671 3052 OS Version: 5.1.2600 ServicePack: 3.0
17:13:10.0671 3052 Product type: Workstation
17:13:10.0671 3052 ComputerName: HENRYFORD
17:13:10.0671 3052 UserName: BinnebMa
17:13:10.0671 3052 Windows directory: C:\WINDOWS
17:13:10.0671 3052 System windows directory: C:\WINDOWS
17:13:10.0671 3052 Processor architecture: Intel x86
17:13:10.0671 3052 Number of processors: 2
17:13:10.0671 3052 Page size: 0x1000
17:13:10.0671 3052 Boot type: Normal boot
17:13:10.0671 3052 ============================================================
17:13:12.0218 3052 Drive \Device\Harddisk0\DR0 - Size: 0x9516AE000 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1431, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054
17:13:12.0218 3052 ============================================================
17:13:12.0218 3052 \Device\Harddisk0\DR0:
17:13:12.0218 3052 MBR partitions:
17:13:12.0218 3052 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2710011
17:13:12.0234 3052 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x271008F, BlocksNum 0x2375271
17:13:12.0234 3052 ============================================================
17:13:12.0250 3052 C: <-> \Device\Harddisk0\DR0\Partition1
17:13:12.0296 3052 D: <-> \Device\Harddisk0\DR0\Partition2
17:13:12.0296 3052 ============================================================
17:13:12.0296 3052 Initialize success
17:13:12.0296 3052 ============================================================
17:13:17.0984 3216 ============================================================
17:13:17.0984 3216 Scan started
17:13:17.0984 3216 Mode: Manual; SigCheck; TDLFS;
17:13:17.0984 3216 ============================================================
17:13:19.0031 3216 ================ Scan system memory ========================
17:13:19.0703 3216 System memory - ok
17:13:19.0703 3216 ================ Scan services =============================
17:13:19.0765 3216 Abiosdsk - ok
17:13:19.0781 3216 abp480n5 - ok
17:13:19.0796 3216 [ AC407F1A62C3A300B4F2B5A9F1D55B2C ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
17:13:20.0765 3216 ACPI - ok
17:13:20.0781 3216 [ 9E1CA3160DAFB159CA14F83B1E317F75 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
17:13:20.0921 3216 ACPIEC - ok
17:13:20.0968 3216 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
17:13:20.0984 3216 AdobeFlashPlayerUpdateSvc - ok
17:13:21.0000 3216 adpu160m - ok
17:13:21.0015 3216 [ E696E749BEDCDA8B23757B8B5EA93780 ] aeaudio C:\WINDOWS\system32\drivers\aeaudio.sys
17:13:21.0046 3216 aeaudio - ok
17:13:21.0078 3216 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
17:13:21.0203 3216 aec - ok
17:13:21.0250 3216 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
17:13:21.0281 3216 AFD - ok
17:13:21.0312 3216 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
17:13:21.0453 3216 agp440 - ok
17:13:21.0453 3216 Aha154x - ok
17:13:21.0468 3216 aic78u2 - ok
17:13:21.0468 3216 aic78xx - ok
17:13:21.0515 3216 [ 738D80CC01D7BC7584BE917B7F544394 ] Alerter C:\WINDOWS\system32\alrsvc.dll
17:13:21.0640 3216 Alerter - ok
17:13:21.0671 3216 [ 190CD73D4984F94D823F9444980513E5 ] ALG C:\WINDOWS\System32\alg.exe
17:13:21.0734 3216 ALG - ok
17:13:21.0750 3216 AliIde - ok
17:13:21.0750 3216 amsint - ok
17:13:21.0828 3216 [ A5569C4429D1C5494049FBFE2B2D20FF ] AntiVirSchedulerService C:\Programme\Avira\AntiVir Desktop\sched.exe
17:13:21.0843 3216 AntiVirSchedulerService - ok
17:13:21.0875 3216 [ CB7EA00A4E70DF6828EBB68633D000D2 ] AntiVirService C:\Programme\Avira\AntiVir Desktop\avguard.exe
17:13:21.0890 3216 AntiVirService - ok
17:13:21.0921 3216 [ D45960BE52C3C610D361977057F98C54 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
17:13:22.0015 3216 AppMgmt - ok
17:13:22.0015 3216 asc - ok
17:13:22.0031 3216 asc3350p - ok
17:13:22.0031 3216 asc3550 - ok
17:13:22.0093 3216 [ E1A1206A4FB19B675E947B29CCD25FBA ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
17:13:22.0109 3216 aspnet_state ( UnsignedFile.Multi.Generic ) - warning
17:13:22.0109 3216 aspnet_state - detected UnsignedFile.Multi.Generic (1)
17:13:22.0140 3216 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
17:13:22.0265 3216 AsyncMac - ok
17:13:22.0281 3216 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
17:13:22.0421 3216 atapi - ok
17:13:22.0421 3216 Atdisk - ok
17:13:22.0453 3216 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
17:13:22.0578 3216 Atmarpc - ok
17:13:22.0609 3216 [ 58ED0D5452DF7BE732193E7999C6B9A4 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
17:13:22.0750 3216 AudioSrv - ok
17:13:22.0765 3216 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
17:13:22.0890 3216 audstub - ok
17:13:22.0906 3216 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys
17:13:23.0015 3216 avgntflt - ok
17:13:23.0046 3216 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys
17:13:23.0078 3216 avipbb - ok
17:13:23.0093 3216 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys
17:13:23.0109 3216 avkmgr - ok
17:13:23.0140 3216 [ 5175E788BCD1CB7345AB21F3E14369D2 ] b57w2k C:\WINDOWS\system32\DRIVERS\b57xp32.sys
17:13:23.0171 3216 b57w2k - ok
17:13:23.0218 3216 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
17:13:23.0343 3216 Beep - ok
17:13:23.0375 3216 [ D6F603772A789BB3228F310D650B8BD1 ] BITS C:\WINDOWS\system32\qmgr.dll
17:13:23.0515 3216 BITS - ok
17:13:23.0562 3216 [ 9B53D428DE0A2566A03499D7AA48DEC4 ] Blfp C:\WINDOWS\system32\DRIVERS\baspxp32.sys
17:13:23.0593 3216 Blfp - ok
17:13:23.0625 3216 [ B71549F23736ADF83A571061C47777FD ] Browser C:\WINDOWS\System32\browser.dll
17:13:23.0656 3216 Browser - ok
17:13:23.0687 3216 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
17:13:23.0828 3216 cbidf2k - ok
17:13:23.0843 3216 cd20xrnt - ok
17:13:23.0875 3216 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
17:13:24.0046 3216 Cdaudio - ok
17:13:24.0078 3216 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
17:13:24.0218 3216 Cdfs - ok
17:13:24.0250 3216 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
17:13:24.0390 3216 Cdrom - ok
17:13:24.0390 3216 Changer - ok
17:13:24.0421 3216 [ 28E3040D1F1CA2008CD6B29DFEBC9A5E ] CiSvc C:\WINDOWS\system32\cisvc.exe
17:13:24.0562 3216 CiSvc - ok
17:13:24.0578 3216 [ 778A30ED3C134EB7E406AFC407E9997D ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
17:13:24.0718 3216 ClipSrv - ok
17:13:24.0718 3216 CmdIde - ok
17:13:24.0734 3216 COMSysApp - ok
17:13:24.0750 3216 Cpqarray - ok
17:13:24.0765 3216 [ 611F824E5C703A5A899F84C5F1699E4D ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
17:13:24.0906 3216 CryptSvc - ok
17:13:24.0921 3216 dac2w2k - ok
17:13:24.0921 3216 dac960nt - ok
17:13:24.0953 3216 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
17:13:25.0000 3216 DcomLaunch - ok
17:13:25.0015 3216 [ C29A1C9B75BA38FA37F8C44405DEC360 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
17:13:25.0156 3216 Dhcp - ok
17:13:25.0187 3216 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
17:13:25.0328 3216 Disk - ok
17:13:25.0328 3216 dmadmin - ok
17:13:25.0375 3216 [ 0DCFC8395A99FECBB1EF771CEC7FE4EA ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
17:13:25.0578 3216 dmboot - ok
17:13:25.0593 3216 [ 53720AB12B48719D00E327DA470A619A ] dmio C:\WINDOWS\system32\drivers\dmio.sys
17:13:25.0718 3216 dmio - ok
17:13:25.0734 3216 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
17:13:25.0875 3216 dmload - ok
17:13:25.0890 3216 [ 25C83FFBBA13B554EB6D59A9B2E2EE78 ] dmserver C:\WINDOWS\System32\dmserver.dll
17:13:26.0031 3216 dmserver - ok
17:13:26.0046 3216 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
17:13:26.0187 3216 DMusic - ok
17:13:26.0218 3216 [ 407F3227AC618FD1CA54B335B083DE07 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
17:13:26.0250 3216 Dnscache - ok
17:13:26.0281 3216 [ 676E36C4FF5BCEA1900F44182B9723E6 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
17:13:26.0421 3216 Dot3svc - ok
17:13:26.0437 3216 [ 3E4B043F8BC6BE1D4820CC6C9C500306 ] Dot4 C:\WINDOWS\system32\DRIVERS\Dot4.sys
17:13:26.0578 3216 Dot4 - ok
17:13:26.0609 3216 [ 77CE63A8A34AE23D9FE4C7896D1DEBE7 ] Dot4Print C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys
17:13:26.0734 3216 Dot4Print - ok
17:13:26.0750 3216 [ 29E86AF2F3457D0441348020FE3CFBD0 ] dot4usb C:\WINDOWS\system32\DRIVERS\dot4usb.sys
17:13:26.0890 3216 dot4usb - ok
17:13:26.0906 3216 dpti2o - ok
17:13:26.0921 3216 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
17:13:27.0046 3216 drmkaud - ok
17:13:27.0125 3216 [ 4E4F2FDDAB0A0736D7671134DCCE91FB ] EapHost C:\WINDOWS\System32\eapsvc.dll
17:13:27.0343 3216 EapHost - ok
17:13:27.0359 3216 [ 877C18558D70587AA7823A1A308AC96B ] ERSvc C:\WINDOWS\System32\ersvc.dll
17:13:27.0484 3216 ERSvc - ok
17:13:27.0515 3216 [ A3EDBE9053889FB24AB22492472B39DC ] Eventlog C:\WINDOWS\system32\services.exe
17:13:27.0531 3216 Eventlog - ok
17:13:27.0562 3216 [ AF4F6B5739D18CA7972AB53E091CBC74 ] EventSystem C:\WINDOWS\system32\es.dll
17:13:27.0593 3216 EventSystem - ok
17:13:27.0609 3216 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
17:13:27.0750 3216 Fastfat - ok
17:13:27.0781 3216 [ 2DB7D303C36DDD055215052F118E8E75 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
17:13:27.0812 3216 FastUserSwitchingCompatibility - ok
17:13:27.0828 3216 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
17:13:27.0953 3216 Fdc - ok
17:13:28.0000 3216 [ B0678A548587C5F1967B0D70BACAD6C1 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
17:13:28.0125 3216 Fips - ok
17:13:28.0156 3216 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
17:13:28.0296 3216 Flpydisk - ok
17:13:28.0328 3216 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
17:13:28.0453 3216 FltMgr - ok
17:13:28.0468 3216 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
17:13:28.0593 3216 Fs_Rec - ok
17:13:28.0609 3216 [ 8F1955CE42E1484714B542F341647778 ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
17:13:28.0734 3216 Ftdisk - ok
17:13:28.0750 3216 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
17:13:28.0890 3216 Gpc - ok
17:13:28.0937 3216 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Programme\Google\Update\GoogleUpdate.exe
17:13:28.0953 3216 gupdate - ok
17:13:28.0953 3216 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Programme\Google\Update\GoogleUpdate.exe
17:13:28.0968 3216 gupdatem - ok
17:13:29.0015 3216 [ CB66BF85BF599BEFD6C6A57C2E20357F ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
17:13:29.0140 3216 helpsvc - ok
17:13:29.0156 3216 [ B35DA85E60C0103F2E4104532DA2F12B ] HidServ C:\WINDOWS\System32\hidserv.dll
17:13:29.0343 3216 HidServ - ok
17:13:29.0359 3216 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
17:13:29.0500 3216 HidUsb - ok
17:13:29.0531 3216 [ ED29F14101523A6E0E808107405D452C ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
17:13:29.0656 3216 hkmsvc - ok
17:13:29.0656 3216 hpn - ok
17:13:29.0687 3216 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
17:13:29.0734 3216 HTTP - ok
17:13:29.0750 3216 [ 9E4ADB854CEBCFB81A4B36718FEECD16 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
17:13:29.0890 3216 HTTPFilter - ok
17:13:29.0906 3216 i2omgmt - ok
17:13:29.0906 3216 i2omp - ok
17:13:29.0921 3216 [ E283B97CFBEB86C1D86BAED5F7846A92 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
17:13:30.0062 3216 i8042prt - ok
17:13:30.0125 3216 [ 9A883C3C4D91292C0D09DE7C728E781C ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
17:13:30.0234 3216 ialm - ok
17:13:30.0250 3216 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
17:13:30.0390 3216 Imapi - ok
17:13:30.0406 3216 [ D4B413AA210C21E46AEDD2BA5B68D38E ] ImapiService C:\WINDOWS\system32\imapi.exe
17:13:30.0546 3216 ImapiService - ok
17:13:30.0562 3216 ini910u - ok
17:13:30.0578 3216 [ 69C4E3C9E67A1F103B94E14FDD5F3213 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
17:13:30.0718 3216 IntelIde - ok
17:13:30.0734 3216 [ 4C7D2750158ED6E7AD642D97BFFAE351 ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
17:13:30.0859 3216 intelppm - ok
17:13:30.0890 3216 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
17:13:31.0015 3216 Ip6Fw - ok
17:13:31.0046 3216 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
17:13:31.0187 3216 IpFilterDriver - ok
17:13:31.0187 3216 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
17:13:31.0312 3216 IpInIp - ok
17:13:31.0328 3216 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
17:13:31.0468 3216 IpNat - ok
17:13:31.0484 3216 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
17:13:31.0625 3216 IPSec - ok
17:13:31.0656 3216 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
17:13:31.0734 3216 IRENUM - ok
17:13:31.0765 3216 [ 6DFB88F64135C525433E87648BDA30DE ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
17:13:31.0890 3216 isapnp - ok
17:13:31.0953 3216 [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Programme\Java\jre6\bin\jqs.exe
17:13:31.0968 3216 JavaQuickStarterService - ok
17:13:32.0000 3216 [ 1704D8C4C8807B889E43C649B478A452 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
17:13:32.0125 3216 Kbdclass - ok
17:13:32.0140 3216 [ B6D6C117D771C98130497265F26D1882 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
17:13:32.0265 3216 kbdhid - ok
17:13:32.0296 3216 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
17:13:32.0421 3216 kmixer - ok
17:13:32.0437 3216 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
17:13:32.0484 3216 KSecDD - ok
17:13:32.0531 3216 [ 2BBDCB79900990F0716DFCB714E72DE7 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
17:13:32.0562 3216 LanmanServer - ok
17:13:32.0578 3216 [ 1869B14B06B44B44AF70548E1EA3303F ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
17:13:32.0609 3216 lanmanworkstation - ok
17:13:32.0609 3216 lbrtfdc - ok
17:13:32.0640 3216 [ 636714B7D43C8D0C80449123FD266920 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
17:13:32.0765 3216 LmHosts - ok
17:13:32.0781 3216 [ B7550A7107281D170CE85524B1488C98 ] Messenger C:\WINDOWS\System32\msgsvc.dll
17:13:32.0921 3216 Messenger - ok
17:13:32.0953 3216 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
17:13:33.0078 3216 mnmdd - ok
17:13:33.0093 3216 [ C2F1D365FD96791B037EE504868065D3 ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
17:13:33.0234 3216 mnmsrvc - ok
17:13:33.0265 3216 [ 6FB74EBD4EC57A6F1781DE3852CC3362 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
17:13:33.0406 3216 Modem - ok
17:13:33.0421 3216 [ B24CE8005DEAB254C0251E15CB71D802 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
17:13:33.0562 3216 Mouclass - ok
17:13:33.0593 3216 [ 66A6F73C74E1791464160A7065CE711A ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
17:13:33.0718 3216 mouhid - ok
17:13:33.0734 3216 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
17:13:33.0875 3216 MountMgr - ok
17:13:33.0921 3216 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
17:13:33.0953 3216 MozillaMaintenance - ok
17:13:33.0953 3216 mraid35x - ok
17:13:33.0984 3216 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
17:13:34.0109 3216 MRxDAV - ok
17:13:34.0140 3216 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
17:13:34.0187 3216 MRxSmb - ok
17:13:34.0218 3216 [ 35A031AF38C55F92D28AA03EE9F12CC9 ] MSDTC C:\WINDOWS\system32\msdtc.exe
17:13:34.0375 3216 MSDTC - ok
17:13:34.0406 3216 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
17:13:34.0562 3216 Msfs - ok
17:13:34.0562 3216 MSIServer - ok
17:13:34.0578 3216 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
17:13:34.0703 3216 MSKSSRV - ok
17:13:34.0734 3216 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
17:13:34.0859 3216 MSPCLOCK - ok
17:13:34.0890 3216 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
17:13:35.0015 3216 MSPQM - ok
17:13:35.0046 3216 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
17:13:35.0171 3216 mssmbios - ok
17:13:35.0187 3216 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
17:13:35.0218 3216 Mup - ok
17:13:35.0250 3216 [ 46BB15AE2AC7D025D6D2567B876817BD ] napagent C:\WINDOWS\System32\qagentrt.dll
17:13:35.0390 3216 napagent - ok
17:13:35.0406 3216 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
17:13:35.0531 3216 NDIS - ok
17:13:35.0546 3216 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
17:13:35.0578 3216 NdisTapi - ok
17:13:35.0609 3216 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
17:13:35.0734 3216 Ndisuio - ok
17:13:35.0750 3216 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
17:13:35.0890 3216 NdisWan - ok
17:13:35.0906 3216 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
17:13:35.0937 3216 NDProxy - ok
17:13:35.0984 3216 [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
17:13:35.0984 3216 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:13:35.0984 3216 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:13:36.0015 3216 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
17:13:36.0156 3216 NetBIOS - ok
17:13:36.0171 3216 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
17:13:36.0296 3216 NetBT - ok
17:13:36.0328 3216 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDE C:\WINDOWS\system32\netdde.exe
17:13:36.0468 3216 NetDDE - ok
17:13:36.0468 3216 [ 8ACE4251BFFD09CE75679FE940E996CC ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
17:13:36.0593 3216 NetDDEdsdm - ok
17:13:36.0609 3216 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] Netlogon C:\WINDOWS\system32\lsass.exe
17:13:36.0734 3216 Netlogon - ok
17:13:36.0765 3216 [ E6D88F1F6745BF00B57E7855A2AB696C ] Netman C:\WINDOWS\System32\netman.dll
17:13:36.0906 3216 Netman - ok
17:13:36.0937 3216 [ F1B67B6B0751AE0E6E964B02821206A3 ] Nla C:\WINDOWS\System32\mswsock.dll
17:13:36.0953 3216 Nla - ok
17:13:36.0968 3216 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
17:13:37.0109 3216 Npfs - ok
17:13:37.0140 3216 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
17:13:37.0296 3216 Ntfs - ok
17:13:37.0312 3216 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
17:13:37.0437 3216 NtLmSsp - ok
17:13:37.0468 3216 [ 56AF4064996FA5BAC9C449B1514B4770 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
17:13:37.0625 3216 NtmsSvc - ok
17:13:37.0656 3216 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
17:13:37.0781 3216 Null - ok
17:13:37.0953 3216 [ 8E72E452B9CC1E455D19E3C9FA964D37 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
17:13:38.0250 3216 nv - ok
17:13:38.0281 3216 [ 934833B3CD462A6F8A96F64D024C8B20 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
17:13:38.0312 3216 NVSvc - ok
17:13:38.0328 3216 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
17:13:38.0468 3216 NwlnkFlt - ok
17:13:38.0484 3216 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
17:13:38.0609 3216 NwlnkFwd - ok
17:13:38.0656 3216 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
17:13:38.0671 3216 ose - ok
17:13:38.0828 3216 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
17:13:39.0093 3216 osppsvc - ok
17:13:39.0125 3216 [ F84785660305B9B903FB3BCA8BA29837 ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
17:13:39.0250 3216 Parport - ok
17:13:39.0265 3216 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
17:13:39.0406 3216 PartMgr - ok
17:13:39.0421 3216 [ C2BF987829099A3EAA2CA6A0A90ECB4F ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
17:13:39.0578 3216 ParVdm - ok
17:13:39.0593 3216 [ 387E8DEDC343AA2D1EFBC30580273ACD ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
17:13:39.0750 3216 PCI - ok
17:13:39.0765 3216 PCIDump - ok
17:13:39.0781 3216 [ 59BA86D9A61CBCF4DF8E598C331F5B82 ] PCIIde C:\WINDOWS\system32\drivers\PCIIde.sys
17:13:39.0921 3216 PCIIde - ok
17:13:39.0953 3216 [ A2A966B77D61847D61A3051DF87C8C97 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
17:13:40.0078 3216 Pcmcia - ok
17:13:40.0093 3216 PDCOMP - ok
17:13:40.0093 3216 PDFRAME - ok
17:13:40.0109 3216 PDRELI - ok
17:13:40.0109 3216 PDRFRAME - ok
17:13:40.0125 3216 perc2 - ok
17:13:40.0125 3216 perc2hib - ok
17:13:40.0156 3216 [ A3EDBE9053889FB24AB22492472B39DC ] PlugPlay C:\WINDOWS\system32\services.exe
17:13:40.0171 3216 PlugPlay - ok
17:13:40.0203 3216 [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
17:13:40.0218 3216 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
17:13:40.0218 3216 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
17:13:40.0234 3216 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
17:13:40.0359 3216 PolicyAgent - ok
17:13:40.0359 3216 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
17:13:40.0500 3216 PptpMiniport - ok
17:13:40.0500 3216 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
17:13:40.0625 3216 ProtectedStorage - ok
17:13:40.0656 3216 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
17:13:40.0765 3216 PSched - ok
17:13:40.0781 3216 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
17:13:40.0921 3216 Ptilink - ok
17:13:40.0921 3216 ql1080 - ok
17:13:40.0937 3216 Ql10wnt - ok
17:13:40.0937 3216 ql12160 - ok
17:13:40.0953 3216 ql1240 - ok
17:13:40.0953 3216 ql1280 - ok
17:13:40.0984 3216 [ 0087F01D35A65B32393CC8BBA46EE4A6 ] QV2KUX C:\WINDOWS\system32\DRIVERS\qv2kux.sys
17:13:41.0125 3216 QV2KUX - ok
17:13:41.0140 3216 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
17:13:41.0265 3216 RasAcd - ok
17:13:41.0296 3216 [ F5BA6CACCDB66C8F048E867563203246 ] RasAuto C:\WINDOWS\System32\rasauto.dll
17:13:41.0437 3216 RasAuto - ok
17:13:41.0453 3216 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
17:13:41.0578 3216 Rasl2tp - ok
17:13:41.0609 3216 [ F9A7B66EA345726EDB5862A46B1ECCD5 ] RasMan C:\WINDOWS\System32\rasmans.dll
17:13:41.0734 3216 RasMan - ok
17:13:41.0750 3216 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
17:13:41.0890 3216 RasPppoe - ok
17:13:41.0906 3216 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
17:13:42.0046 3216 Raspti - ok
17:13:42.0062 3216 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
17:13:42.0187 3216 Rdbss - ok
17:13:42.0187 3216 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
17:13:42.0328 3216 RDPCDD - ok
17:13:42.0343 3216 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
17:13:42.0468 3216 rdpdr - ok
17:13:42.0515 3216 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
17:13:42.0546 3216 RDPWD - ok
17:13:42.0609 3216 [ 263AF18AF0F3DB99F574C95F284CCEC9 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
17:13:42.0734 3216 RDSessMgr - ok
17:13:42.0750 3216 [ ED761D453856F795A7FE056E42C36365 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
17:13:42.0890 3216 redbook - ok
17:13:42.0906 3216 [ 0E97EC96D6942CEEC2D188CC2EB69A01 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
17:13:43.0046 3216 RemoteAccess - ok
17:13:43.0062 3216 [ E4CD1F3D84E1C2CA0B8CF7501E201593 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
17:13:43.0187 3216 RemoteRegistry - ok
17:13:43.0218 3216 [ 2A02E21867497DF20B8FC95631395169 ] RpcLocator C:\WINDOWS\system32\locator.exe
17:13:43.0359 3216 RpcLocator - ok
17:13:43.0375 3216 [ 3127AFBF2C1ED0AB14A1BBB7AAECB85B ] RpcSs C:\WINDOWS\system32\rpcss.dll
17:13:43.0406 3216 RpcSs - ok
17:13:43.0437 3216 [ 4BDD71B4B521521499DFD14735C4F398 ] RSVP C:\WINDOWS\system32\rsvp.exe
17:13:43.0578 3216 RSVP - ok
17:13:43.0609 3216 [ AFB8261B56CBA0D86AEB6DF682AF9785 ] SamSs C:\WINDOWS\system32\lsass.exe
17:13:43.0718 3216 SamSs - ok
17:13:43.0750 3216 [ DCEC079FAD95D36C8DD5CB6D779DFE32 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
17:13:43.0890 3216 SCardSvr - ok
17:13:43.0921 3216 [ A050194A44D7FA8D7186ED2F4E8367AE ] Schedule C:\WINDOWS\system32\schedsvc.dll
17:13:44.0062 3216 Schedule - ok
17:13:44.0093 3216 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
17:13:44.0156 3216 Secdrv - ok
17:13:44.0171 3216 [ BEE4CFD1D48C23B44CF4B974B0B79B2B ] seclogon C:\WINDOWS\System32\seclogon.dll
17:13:44.0312 3216 seclogon - ok
17:13:44.0328 3216 [ 2AAC9B6ED9EDDFFB721D6452E34D67E3 ] SENS C:\WINDOWS\system32\sens.dll
17:13:44.0453 3216 SENS - ok
17:13:44.0468 3216 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
17:13:44.0593 3216 serenum - ok
17:13:44.0609 3216 [ CF24EB4F0412C82BCD1F4F35A025E31D ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
17:13:44.0765 3216 Serial - ok
17:13:44.0781 3216 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
17:13:44.0937 3216 Sfloppy - ok
17:13:44.0968 3216 [ CAD058D5F8B889A87CA3EB3CF624DCEF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
17:13:45.0125 3216 SharedAccess - ok
17:13:45.0156 3216 [ 2DB7D303C36DDD055215052F118E8E75 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
17:13:45.0171 3216 ShellHWDetection - ok
17:13:45.0171 3216 Simbad - ok
17:13:45.0203 3216 [ FA3368A7039F5ABAA4B933703AC34763 ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys
17:13:45.0250 3216 smwdm - ok
17:13:45.0281 3216 [ 3978F082274F723AD5A0A8058C2417DD ] SoundMAX Agent Service (default) C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
17:13:45.0281 3216 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - warning
17:13:45.0281 3216 SoundMAX Agent Service (default) - detected UnsignedFile.Multi.Generic (1)
17:13:45.0281 3216 Sparrow - ok
17:13:45.0296 3216 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
17:13:45.0437 3216 splitter - ok
17:13:45.0468 3216 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
17:13:45.0500 3216 Spooler - ok
17:13:45.0531 3216 [ 50FA898F8C032796D3B1B9951BB5A90F ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
17:13:45.0609 3216 sr - ok
17:13:45.0625 3216 [ FE77A85495065F3AD59C5C65B6C54182 ] srservice C:\WINDOWS\system32\srsvc.dll
17:13:45.0703 3216 srservice - ok
17:13:45.0734 3216 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
17:13:45.0796 3216 Srv - ok
17:13:45.0812 3216 [ 4DF5B05DFAEC29E13E1ED6F6EE12C500 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
17:13:45.0890 3216 SSDPSRV - ok
17:13:45.0937 3216 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
17:13:45.0953 3216 ssmdrv - ok
17:13:45.0953 3216 SSPORT - ok
17:13:45.0968 3216 [ A2DBCC4C8860449DF1AB758EA28B4DE0 ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys
17:13:46.0093 3216 StillCam - ok
17:13:46.0125 3216 [ BC2C5985611C5356B24AEB370953DED9 ] stisvc C:\WINDOWS\system32\wiaservc.dll
17:13:46.0281 3216 stisvc - ok
17:13:46.0296 3216 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
17:13:46.0421 3216 swenum - ok
17:13:46.0453 3216 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
17:13:46.0578 3216 swmidi - ok
17:13:46.0593 3216 SwPrv - ok
17:13:46.0593 3216 symc810 - ok
17:13:46.0593 3216 symc8xx - ok
17:13:46.0609 3216 sym_hi - ok
17:13:46.0609 3216 sym_u3 - ok
17:13:46.0625 3216 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
17:13:46.0750 3216 sysaudio - ok
17:13:46.0781 3216 [ 2903FFFA2523926D6219428040DCE6B9 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
17:13:46.0921 3216 SysmonLog - ok
17:13:46.0953 3216 [ 05903CAC4B98908D55EA5774775B382E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
17:13:47.0093 3216 TapiSrv - ok
17:13:47.0109 3216 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
17:13:47.0140 3216 Tcpip - ok
17:13:47.0187 3216 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
17:13:47.0312 3216 TDPIPE - ok
17:13:47.0328 3216 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
17:13:47.0453 3216 TDTCP - ok
17:13:47.0484 3216 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
17:13:47.0625 3216 TermDD - ok
17:13:47.0640 3216 [ B7DE02C863D8F5A005A7BF375375A6A4 ] TermService C:\WINDOWS\System32\termsrv.dll
17:13:47.0781 3216 TermService - ok
17:13:47.0796 3216 [ 2DB7D303C36DDD055215052F118E8E75 ] Themes C:\WINDOWS\System32\shsvcs.dll
17:13:47.0812 3216 Themes - ok
17:13:47.0843 3216 [ 03681A1CE77F51586903869A5AB1DEAB ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
17:13:47.0921 3216 TlntSvr - ok
17:13:47.0937 3216 TosIde - ok
17:13:47.0953 3216 [ 626504572B175867F30F3215C04B3E2F ] TrkWks C:\WINDOWS\system32\trkwks.dll
17:13:48.0093 3216 TrkWks - ok
17:13:48.0109 3216 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
17:13:48.0234 3216 Udfs - ok
17:13:48.0250 3216 ultra - ok
17:13:48.0281 3216 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
17:13:48.0421 3216 Update - ok
17:13:48.0453 3216 [ 1DFD8975D8C89214B98D9387C1125B49 ] upnphost C:\WINDOWS\System32\upnphost.dll
17:13:48.0546 3216 upnphost - ok
17:13:48.0562 3216 [ 9B11E6118958E63E1FEF129466E2BDA7 ] UPS C:\WINDOWS\System32\ups.exe
17:13:48.0687 3216 UPS - ok
17:13:48.0718 3216 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
17:13:48.0843 3216 usbccgp - ok
17:13:48.0875 3216 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
17:13:49.0015 3216 usbehci - ok
17:13:49.0031 3216 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
17:13:49.0171 3216 usbhub - ok
17:13:49.0187 3216 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
17:13:49.0312 3216 usbprint - ok
17:13:49.0328 3216 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
17:13:49.0468 3216 USBSTOR - ok
17:13:49.0484 3216 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
17:13:49.0609 3216 usbuhci - ok
17:13:49.0625 3216 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
17:13:49.0750 3216 VgaSave - ok
17:13:49.0750 3216 ViaIde - ok
17:13:49.0765 3216 [ A5A712F4E880874A477AF790B5186E1D ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
17:13:49.0906 3216 VolSnap - ok
17:13:49.0953 3216 [ 68F106273BE29E7B7EF8266977268E78 ] VSS C:\WINDOWS\System32\vssvc.exe
17:13:50.0062 3216 VSS - ok
17:13:50.0093 3216 [ 7B353059E665F8B7AD2BBEAEF597CF45 ] W32Time C:\WINDOWS\system32\w32time.dll
17:13:50.0203 3216 W32Time - ok
17:13:50.0218 3216 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
17:13:50.0359 3216 Wanarp - ok
17:13:50.0359 3216 WDICA - ok
17:13:50.0375 3216 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
17:13:50.0500 3216 wdmaud - ok
17:13:50.0531 3216 [ 81727C9873E3905A2FFC1EBD07265002 ] WebClient C:\WINDOWS\System32\webclnt.dll
17:13:50.0656 3216 WebClient - ok
17:13:50.0703 3216 [ 6F3F3973D97714CC5F906A19FE883729 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
17:13:50.0828 3216 winmgmt - ok
17:13:50.0890 3216 [ 6E18978B749F0696A774DE3F2CB142DD ] WmdmPmSN C:\WINDOWS\system32\mspmsnsv.dll
17:13:51.0015 3216 WmdmPmSN - ok
17:13:51.0062 3216 [ FFA4D901D46D07A5BAB2D8307FBB51A6 ] Wmi C:\WINDOWS\System32\advapi32.dll
17:13:51.0125 3216 Wmi - ok
17:13:51.0156 3216 [ 93908111BA57A6E60EC2FA2DE202105C ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
17:13:51.0281 3216 WmiApSrv - ok
17:13:51.0296 3216 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
17:13:51.0421 3216 WS2IFSL - ok
17:13:51.0453 3216 [ 300B3E84FAF1A5C1F791C159BA28035D ] wscsvc C:\WINDOWS\system32\wscsvc.dll
17:13:51.0593 3216 wscsvc - ok
17:13:51.0593 3216 WSearch - ok
17:13:51.0609 3216 [ 7B4FE05202AA6BF9F4DFD0E6A0D8A085 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
17:13:51.0750 3216 wuauserv - ok
17:13:51.0781 3216 [ C4F109C005F6725162D2D12CA751E4A7 ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
17:13:51.0921 3216 WZCSVC - ok
17:13:51.0953 3216 [ 0ADA34871A2E1CD2CAAFED1237A47750 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
17:13:52.0078 3216 xmlprov - ok
17:13:52.0093 3216 ================ Scan global ===============================
17:13:52.0109 3216 [ 2C60091CA5F67C3032EAB3B30390C27F ] C:\WINDOWS\system32\basesrv.dll
17:13:52.0140 3216 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:13:52.0187 3216 [ A28CE25B59C90E12743001A1F2AE3613 ] C:\WINDOWS\system32\winsrv.dll
17:13:52.0203 3216 [ A3EDBE9053889FB24AB22492472B39DC ] C:\WINDOWS\system32\services.exe
17:13:52.0203 3216 [Global] - ok
17:13:52.0203 3216 ================ Scan MBR ==================================
17:13:52.0218 3216 [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
17:13:52.0500 3216 \Device\Harddisk0\DR0 - ok
17:13:52.0500 3216 ================ Scan VBR ==================================
17:13:52.0515 3216 [ 89DD79D2F124A000831697A2246A247C ] \Device\Harddisk0\DR0\Partition1
17:13:52.0531 3216 \Device\Harddisk0\DR0\Partition1 - ok
17:13:52.0546 3216 [ 2248DC44663A185F45200B8E73439789 ] \Device\Harddisk0\DR0\Partition2
17:13:52.0546 3216 \Device\Harddisk0\DR0\Partition2 - ok
17:13:52.0546 3216 ============================================================
17:13:52.0546 3216 Scan finished
17:13:52.0546 3216 ============================================================
17:13:52.0656 3112 Detected object count: 4
17:13:52.0656 3112 Actual detected object count: 4
17:14:55.0250 3112 aspnet_state ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112 aspnet_state ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:14:55.0250 3112 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:14:55.0250 3112 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0250 3112 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:14:55.0250 3112 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - skipped by user
17:14:55.0265 3112 SoundMAX Agent Service (default) ( UnsignedFile.Multi.Generic ) - User select action: Skip
Code:
ATTFilter C-Partition
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-14 13:45:52
-----------------------------
13:45:52.515 OS Version: Windows 5.1.2600 Service Pack 3
13:45:52.515 Number of processors: 2 586 0x304
13:45:52.515 ComputerName: HENRYFORD UserName: BinnebMa
13:45:53.078 Initialize success
13:54:09.515 AVAST engine defs: 12111400
13:54:20.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:54:20.328 Disk 0 Vendor: WDC_WD400BB-22HEA1 14.03G14 Size: 38166MB BusType: 3
13:54:20.343 Disk 0 MBR read successfully
13:54:20.343 Disk 0 MBR scan
13:54:20.421 Disk 0 Windows XP default MBR code
13:54:20.453 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 20000 MB offset 63
13:54:20.468 Disk 0 Partition - 00 0F Extended LBA 18154 MB offset 40960080
13:54:20.484 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 18154 MB offset 40960143
13:54:20.500 Disk 0 scanning sectors +78140160
13:54:20.625 Disk 0 scanning C:\WINDOWS\system32\drivers
13:54:31.656 Service scanning
13:55:21.968 Modules scanning
13:55:59.281 Disk 0 trace - called modules:
13:55:59.296
13:56:01.187 AVAST engine scan C:\
14:59:34.656 Scan finished successfully
D-Partition
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-14 15:17:18
-----------------------------
15:17:18.453 OS Version: Windows 5.1.2600 Service Pack 3
15:17:18.453 Number of processors: 2 586 0x304
15:17:18.453 ComputerName: HENRYFORD UserName: BinnebMa
15:17:18.984 Initialize success
15:17:33.015 AVAST engine defs: 12111400
15:17:41.500 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:17:41.500 Disk 0 Vendor: WDC_WD400BB-22HEA1 14.03G14 Size: 38166MB BusType: 3
15:17:41.578 Disk 0 MBR read successfully
15:17:41.578 Disk 0 MBR scan
15:17:41.671 Disk 0 Windows XP default MBR code
15:17:41.703 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 20000 MB offset 63
15:17:41.703 Disk 0 Partition - 00 0F Extended LBA 18154 MB offset 40960080
15:17:41.765 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 18154 MB offset 40960143
15:17:41.828 Disk 0 scanning sectors +78140160
15:17:42.218 Disk 0 scanning C:\WINDOWS\system32\drivers
15:18:04.375 Service scanning
15:18:22.078 Modules scanning
15:18:54.515 Disk 0 trace - called modules:
15:18:54.546
15:18:54.734 AVAST engine scan D:\
15:26:40.937 Scan finished successfully
Code:
ATTFilter OTL logfile created on: 15.11.2012 16:18:33 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\BinnebMa\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,50 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 69,27% Memory free 3,35 Gb Paging File | 2,91 Gb Available in Paging File | 86,85% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 19,53 Gb Total Space | 0,96 Gb Free Space | 4,89% Space Free | Partition Type: NTFS Drive D: | 17,73 Gb Total Space | 16,05 Gb Free Space | 90,51% Space Free | Partition Type: NTFS Drive K: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS Drive P: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS Drive V: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS Computer Name: HENRYFORD | User Name: BinnebMa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.15 16:13:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe PRC - [2012.11.06 18:29:54 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.10.16 17:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.10.16 16:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.09.19 18:20:40 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.01.02 09:07:56 | 000,843,712 | R--- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE PRC - [2009.07.14 16:15:50 | 000,622,592 | ---- | M] () -- C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe PRC - [2009.04.09 11:04:50 | 000,266,240 | ---- | M] (XEROX) -- C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2003.05.08 10:34:32 | 000,069,632 | ---- | M] (adi) -- C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe PRC - [2003.05.05 07:57:30 | 000,143,360 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMTray.exe PRC - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe ========== Modules (No Company Name) ========== MOD - [2012.09.19 18:17:40 | 000,397,088 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009.07.14 16:15:50 | 000,622,592 | ---- | M] () -- C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe MOD - [2009.04.02 09:21:58 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\XeroxFaxPort.dll MOD - [2008.06.05 13:45:36 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\ssh1ml3.dll MOD - [2001.10.28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll ========== Services (SafeList) ========== SRV - [2012.10.29 13:00:25 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.10.16 17:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.10.16 16:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.10.09 10:14:07 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2002.09.20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.11.07 16:03:24 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.11.07 16:03:24 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.11.07 16:03:24 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.07.25 00:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2008.06.06 08:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp) DRV - [2001.08.17 13:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 B5 A7 E6 6E 68 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU\..\SearchScopes\{16625B85-803E-40E9-ABD1-BF0523AB2971}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-W1&o=100000080&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=JM&apn_dtid=YYYYYYYYDE&apn_uid=5c2e7b71-3484-404e-9953-27561c9c7a2a&apn_sauid=21D19F8A-A283-4BA7-B3B6-C600C2343C03 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.10.29 13:00:25 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2012.10.29 13:00:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: D:\Programme\Mozilla Thunderbird\components [2011.08.31 14:37:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: D:\Programme\Mozilla Thunderbird\plugins [2011.08.31 14:52:48 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Mozilla\Extensions [2012.10.23 07:47:51 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Mozilla\Firefox\Profiles\ovh7ib34.default\extensions ========== Chrome ========== CHR - homepage: hxxp://www.google.com CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://www.google.com CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\23.0.1271.64\gcswf32.dll CHR - plugin: Shockwave Flash (Disabled) = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll CHR - plugin: Microsoft Office 2010 (Enabled) = D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL CHR - Extension: YouTube = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\ CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\ CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [DrvLsnr] C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe (adi) O4 - HKLM..\Run: [NSCSysTrayUI_XEROX] C:\Programme\XEROX\NetworkScan\NSCSysUI_XEROX.exe (XEROX) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Xerox PanelMgr] C:\WINDOWS\Xerox\PanelMgr\SSMMgr.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: An OneNote s&enden - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253616306953 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1022C60-21E0-4736-9D47-1C9CD19E09C7}: NameServer = 194.25.2.129,192.168.1.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.09.22 09:11:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.11.15 16:13:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe [2012.11.15 08:10:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2012.11.14 16:23:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Avira [2012.11.14 16:17:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira [2012.11.14 16:16:56 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys [2012.11.14 16:16:46 | 000,133,824 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys [2012.11.14 16:16:46 | 000,083,432 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2012.11.14 16:16:46 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys [2012.11.14 16:16:45 | 000,000,000 | ---D | C] -- C:\Programme\Avira [2012.11.14 16:16:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira [2012.11.14 13:24:31 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine [2012.11.14 13:04:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Search [2012.10.18 11:29:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Romans Testordner [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.15 16:17:15 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\defogger_reenable [2012.11.15 16:16:23 | 000,174,706 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2012.11.15 16:16:21 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.11.15 16:16:20 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.11.15 16:14:25 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\jzg664rc.exe [2012.11.15 16:13:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\OTL.exe [2012.11.15 16:13:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.11.15 16:12:50 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Defogger.exe [2012.11.15 15:46:00 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.11.15 08:06:07 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\zxowq.job [2012.11.15 08:05:50 | 000,000,320 | ---- | M] () -- C:\WINDOWS\tasks\UHQKZPYVER.job [2012.11.15 08:05:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.11.12 10:28:02 | 000,122,880 | RHS- | M] () -- C:\WINDOWS\System32\msfeedsm.dll [2012.11.12 10:28:02 | 000,122,880 | RHS- | M] () -- C:\WINDOWS\System32\dmviewb.dll [2012.11.07 16:03:24 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avipbb.sys [2012.11.07 16:03:24 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2012.11.07 16:03:24 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\WINDOWS\System32\drivers\avkmgr.sys [2012.10.29 11:31:19 | 000,419,334 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.10.29 11:31:19 | 000,383,254 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.10.29 11:31:19 | 000,074,396 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.10.29 11:31:19 | 000,053,608 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.15 16:17:15 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\defogger_reenable [2012.11.15 16:14:23 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\jzg664rc.exe [2012.11.15 16:12:49 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Desktop\Defogger.exe [2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\msfeedsm.dll [2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\dmviewb.dll [2012.11.12 10:28:02 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\zxowq.job [2012.11.12 10:28:02 | 000,000,320 | ---- | C] () -- C:\WINDOWS\tasks\UHQKZPYVER.job [2012.02.16 17:39:46 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.09.22 14:14:34 | 000,007,646 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\XeroxFaxOptions.xml [2011.09.20 13:22:42 | 000,018,944 | ---- | C] () -- C:\Dokumente und Einstellungen\BinnebMa\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.08.17 07:48:39 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\SecSNMP.dll [2011.08.17 07:48:38 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\XeroxFaxPort.dll [2011.08.17 07:48:19 | 000,483,328 | ---- | C] () -- C:\WINDOWS\ssndii.exe [2011.08.17 07:47:53 | 000,110,592 | ---- | C] () -- C:\WINDOWS\Wiainst.exe [2011.08.17 07:47:38 | 000,138,240 | ---- | C] () -- C:\WINDOWS\System32\Ssuiext.dll [2011.08.17 07:47:37 | 000,265,216 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll [2011.08.17 07:47:37 | 000,139,776 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll [2011.08.17 07:47:37 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll [2011.08.17 07:47:37 | 000,087,040 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll [2011.08.17 07:47:34 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ssh1ml3.dll [2010.11.22 15:17:15 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll ========== ZeroAccess Check ========== [2009.10.21 16:46:27 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.07.18 17:03:13 | 001,509,888 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 13:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.07.04 11:10:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Thunderbird [2011.11.07 10:44:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Desktop Search [2012.11.14 13:04:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Windows Search [2011.09.22 14:14:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\BinnebMa\Anwendungsdaten\Xerox ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 15.11.2012 16:18:33 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\BinnebMa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,50 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 69,27% Memory free
3,35 Gb Paging File | 2,91 Gb Available in Paging File | 86,85% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19,53 Gb Total Space | 0,96 Gb Free Space | 4,89% Space Free | Partition Type: NTFS
Drive D: | 17,73 Gb Total Space | 16,05 Gb Free Space | 90,51% Space Free | Partition Type: NTFS
Drive K: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive P: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Drive V: | 4613,45 Gb Total Space | 1910,35 Gb Free Space | 41,41% Space Free | Partition Type: NTFS
Computer Name: HENRYFORD | User Name: BinnebMa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hppniprint01.exe" = C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe -- (Hewlett-Packard)
"C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hpntwkexe.exe" = C:\Temp\hp_LJ3050-3052-3055-3390-3392_Full_Solution\setup\hpntwkexe.exe:*:Enabled:hpntwkexe.exe -- (Hewlett-Packard)
"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\RarSFX0\Windows Utilities\Installer32\InstallationManager.exe" = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\RarSFX0\Windows Utilities\Installer32\InstallationManager.exe:*:Enabled:Xerox Windows Common Installer
"D:\Programme\totalcmd\TOTALCMD.EXE" = D:\Programme\totalcmd\TOTALCMD.EXE:*:Disabled:Total Commander 32 bit -- (Ghisler Software GmbH)
"D:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = D:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"D:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = D:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe" = C:\Programme\xerox\NetworkScan\NSCSysUI_XEROX.exe:*:Enabled:SysTrayUI Module -- (XEROX)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5BA1655E-6CF5-47C7-95F0-311D4F676021}" =
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C5725B7-2219-410C-A364-90767F71F00C}" = Network Scan
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F870B987-18BC-45FC-9BE8-35C02DCDA10F}" = Broadcom NetXtreme Ethernet Controller
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"Google Chrome" = Google Chrome
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"KONICA MINOLTA magicolor 5570 Installer" = KONICA MINOLTA magicolor 5570
"Lightscreen" = Lightscreen
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Scan2PDF_is1" = Scan2PDF 1.6
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 2.0.1
"Xerox Phaser 3300MFP" = Xerox Phaser 3300MFP
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 12.11.2012 07:57:12 | Computer Name = HENRYFORD | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x4ebb74b2.
[ System Events ]
Error - 12.11.2012 02:59:16 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 13.11.2012 03:13:41 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.11.2012 04:34:54 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.11.2012 08:28:00 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.11.2012 08:28:00 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PCIIde
Error - 14.11.2012 08:38:47 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.11.2012 10:47:11 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 14.11.2012 10:51:54 | Computer Name = HENRYFORD | Source = Print | ID = 19
Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker KONICA MINOLTA
mc5570 PCL6, Freigabename Drucker4.
Error - 14.11.2012 10:53:14 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 15.11.2012 03:07:28 | Computer Name = HENRYFORD | Source = Service Control Manager | ID = 7000
Description = Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
< End of report >
Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-15 17:55:11
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400BB-22HEA1 rev.14.03G14
Running: jzg664rc.exe; Driver: C:\DOKUME~1\BinnebMa\LOKALE~1\Temp\fwriapob.sys
---- System - GMER 1.0.15 ----
SSDT F7A79784 ZwClose
SSDT F7A7973E ZwCreateKey
SSDT F7A7978E ZwCreateSection
SSDT F7A79734 ZwCreateThread
SSDT F7A79743 ZwDeleteKey
SSDT F7A7974D ZwDeleteValueKey
SSDT F7A7977F ZwDuplicateObject
SSDT F7A79752 ZwLoadKey
SSDT F7A79720 ZwOpenProcess
SSDT F7A79725 ZwOpenThread
SSDT F7A797A7 ZwQueryValueKey
SSDT F7A7975C ZwReplaceKey
SSDT F7A79798 ZwRequestWaitReplyPort
SSDT F7A79757 ZwRestoreKey
SSDT F7A79793 ZwSetContextThread
SSDT F7A7979D ZwSetSecurityObject
SSDT F7A79748 ZwSetValueKey
SSDT F7A797A2 ZwSystemDebugControl
SSDT F7A7972F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB9985360, 0x372FAD, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\SearchIndexer.exe[368] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
Danke schonmal im Vorraus! lebierle |
|
19.11.2012, 23:47
| #2 |
| /// Malwareteam   | Umleitung auf ihavenet.com Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1
Code:
ATTFilter :OTL
[2012.11.15 08:06:07 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.15 08:05:50 | 000,000,320 | ---- | M] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\msfeedsm.dll
[2012.11.12 10:28:02 | 000,122,880 | RHS- | C] () -- C:\WINDOWS\System32\dmviewb.dll
[2012.11.12 10:28:02 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\zxowq.job
[2012.11.12 10:28:02 | 000,000,320 | ---- | C] () -- C:\WINDOWS\tasks\UHQKZPYVER.job
:Commands
[purity]
[emptytemp]
Schritt 2 Downloade Dir bitte Malwarebytes
|
|
20.11.2012, 16:12
| #3 |
| | Umleitung auf ihavenet.com Danke schonmal für die schnell Antwort! Habe beides gemacht aber bei dem Scan mit Malewarebytes hat es nichts gefunden, was aber auch im Logfile steht.
__________________Bei den spontanen Tests jetzt grade hat die Umleitung über Google einwandfrei funktioniert (Firefox / IE / Chrome) aber ich werde es weiter beobachten und mich nochmal melden (kann ja grade nur Zufall sein). OTL: Code:
ATTFilter All processes killed
========== OTL ==========
C:\WINDOWS\tasks\zxowq.job moved successfully.
C:\WINDOWS\tasks\UHQKZPYVER.job moved successfully.
C:\WINDOWS\system32\msfeedsm.dll moved successfully.
C:\WINDOWS\system32\dmviewb.dll moved successfully.
File C:\WINDOWS\tasks\zxowq.job not found.
File C:\WINDOWS\tasks\UHQKZPYVER.job not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 132006520 bytes
->Temporary Internet Files folder emptied: 17263678 bytes
->FireFox cache emptied: 4264723 bytes
->Flash cache emptied: 592 bytes
User: All Users
User: BinnebMa
->Temp folder emptied: 136081551 bytes
->Temporary Internet Files folder emptied: 507965316 bytes
->Java cache emptied: 18227871 bytes
->FireFox cache emptied: 284818303 bytes
->Google Chrome cache emptied: 6391524 bytes
->Flash cache emptied: 16156 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: ******
->Temp folder emptied: 123480510 bytes
->Temporary Internet Files folder emptied: 342572984 bytes
->FireFox cache emptied: 58682941 bytes
->Flash cache emptied: 14825 bytes
User: *****
->Temp folder emptied: 455344 bytes
->Temporary Internet Files folder emptied: 91403434 bytes
->FireFox cache emptied: 99184983 bytes
->Flash cache emptied: 2012 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 98706 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 17209027 bytes
%systemroot%\System32 .tmp files removed: 21968263 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 74708722 bytes
RecycleBin emptied: 11939592 bytes
Total Files Cleaned = 1.859,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 11202012_153814
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.20.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 BinnebMa :: HENRYFORD [Administrator] 20.11.2012 15:51:18 mbam-log-2012-11-20 (15-51-18).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 258199 Laufzeit: 3 Minute(n), 26 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) lebierle |
|
20.11.2012, 22:08
| #4 |
| /// Malwareteam | Umleitung auf ihavenet.com Schritt 1 ESET Online Scanner
|
|
| Themen zu Umleitung auf ihavenet.com |
| .com, 32 bit, aswmbr, avira, bho, browser, computer, desktop, error, firefox, flash player, format, helper, homepage, iexplore.exe, lanmanworkstation, object, plug-in, policyagent, problem, rootkit, rundll, scan, security, senden, sigcheck, total commander, trojaner, trojaner board, unsignedfile.multi.generic, usb, windows, windows internet, windows xp, wsearch |
Textbox.
Linear-Darstellung
