|
Log-Analyse und Auswertung: Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
16.06.2011, 18:50 | #1 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Hallo zusammen, nachdem ich auf meinem einen Rechern "Malware Protection" entdeckt habe und mit Hilfe von cosinus und dem Trojaner-Board versuche den Rechner wieder sicher zu bekommen, habe ich auch auf meinem zwieten Rechner Malwarebytes' Anti-Malware installiert und durchlaufen lassen. Wieder gab es Treffer :-( Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Datenbank Version: 6863 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 16.06.2011 18:47:26 mbam-log-2011-06-16 (18-47-13).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 433397 Laufzeit: 3 Stunde(n), 16 Minute(n), 16 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{E01962F9-FA3A-CF68-AB42-661F4DB5FF54} (Trojan.ZbotR.Gen) -> Value: {E01962F9-FA3A-CF68-AB42-661F4DB5FF54} -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: c:\Users\Mia\AppData\Roaming\systemproc (Trojan.Agent) -> No action taken. Infizierte Dateien: c:\confin.sys (Malware.Trace) -> No action taken. Habe sie von Malwarebytes' Anti-Malware entfernen lassen und gerade startet der nächste Suchlauf. Was sind denn die nächsten Schritte? Dankeschön! Mia |
17.06.2011, 08:48 | #2 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? so, ist hier noch die Logdatei, nachdem ich die Malware mit Malwarebytes' Anti-Malware entfernt habe.
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Datenbank Version: 6872 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 16.06.2011 22:44:33 mbam-log-2011-06-16 (22-44-32).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 433118 Laufzeit: 3 Stunde(n), 12 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
17.06.2011, 10:48 | #3 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Edit: Achso, ist der Zweitrechner, hätte ich fast überlesen
__________________CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start wininit.exe userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT
__________________ |
17.06.2011, 14:10 | #4 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Hallo cosinus, hier ist die OTL-Logdatei OTL Logfile: Code:
ATTFilter OTL logfile created on: 17.06.2011 14:20:54 - Run 1 OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Mia\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 47,95% Memory free 4,21 Gb Paging File | 2,75 Gb Available in Paging File | 65,26% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 119,00 Gb Total Space | 7,68 Gb Free Space | 6,45% Space Free | Partition Type: NTFS Drive D: | 30,04 Gb Total Space | 7,56 Gb Free Space | 25,18% Space Free | Partition Type: FAT32 Computer Name: Mia-LAPTOP | User Name: Mia | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe PRC - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.05.05 20:56:04 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.11.05 10:48:38 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.02.18 11:43:20 | 000,490,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () -- c:\Programme\radio\Tobit ClipInc\Server\ClipInc-Server.exe PRC - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe PRC - [2008.10.28 23:00:50 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\hqtray.exe PRC - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\vmware-authd.exe PRC - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2007.12.05 17:14:34 | 000,126,976 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe PRC - [2007.12.05 17:10:52 | 000,098,304 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe PRC - [2007.06.27 20:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2007.06.27 20:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe PRC - [2007.04.13 18:14:28 | 000,016,384 | ---- | M] (Empolis GmbH) -- C:\Programme\Medion\MEDIONbox\Program\GCS.exe PRC - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe PRC - [2007.03.30 11:10:00 | 000,061,440 | ---- | M] () -- C:\Programme\Fujitsu Siemens\WinManager\WinManager.exe PRC - [2007.03.02 17:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe PRC - [2007.02.15 17:07:16 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.01.19 12:55:00 | 005,674,352 | ---- | M] (Microsoft Corporation) -- C:\Programme\MSN Messenger\msnmsgr.exe PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006.12.26 11:23:34 | 000,180,224 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\OSD.exe PRC - [2006.12.14 16:53:28 | 000,192,512 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe PRC - [2006.11.22 17:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe PRC - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe PRC - [2006.11.15 16:58:26 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2006.11.09 14:37:52 | 000,086,016 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe PRC - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe PRC - [2005.07.25 13:36:40 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe ========== Modules (SafeList) ========== MOD - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (OpenVPNService) SRV - File not found [On_Demand | Stopped] -- -- (Emdepa) SRV - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () [Auto | Running] -- c:\Program Files\Radio\Tobit ClipInc\Server\ClipInc-Server.exe -- (ClipInc001) SRV - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service) SRV - [2008.10.02 18:25:42 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.07.16 20:35:37 | 000,069,120 | ---- | M] (Google) [Disabled | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe -- (GoogleDesktopManager) SRV - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) [Auto | Running] -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe -- (srvcPVR) SRV - [2007.04.23 11:39:00 | 000,718,416 | ---- | M] (BullGuard Software) [Disabled | Stopped] -- C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe -- (BGLiveSvc) SRV - [2007.04.23 11:38:56 | 000,075,344 | ---- | M] (BullGuard, Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsMain.dll -- (BgMainSvc) SRV - [2007.04.23 11:38:56 | 000,044,112 | ---- | M] (BullGuard Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsMailProxy.dll -- (BsMailProxy) SRV - [2007.04.23 11:38:54 | 000,099,920 | ---- | M] (BullGuard Ltd.) [Disabled | Stopped] -- C:\Programme\BullGuard Software\BullGuard\BsFileScan.dll -- (BsFileScan) SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Running] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService) SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc) SRV - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) ========== Driver Services (SafeList) ========== DRV - [2011.03.18 20:08:23 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.11.25 22:24:13 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.10.28 23:01:34 | 000,054,960 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci) DRV - [2008.10.28 23:01:32 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif) DRV - [2008.10.28 23:01:32 | 000,023,216 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd) DRV - [2008.10.28 23:01:30 | 000,857,392 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86) DRV - [2008.10.28 23:01:28 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon) DRV - [2008.10.28 17:03:28 | 000,031,280 | R--- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge) DRV - [2008.10.28 17:03:28 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV - [2008.10.02 18:24:48 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2007.07.05 19:23:42 | 000,277,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B) DRV - [2007.06.21 13:00:53 | 000,320,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000.sys -- (UDXTTM6000) DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.04.18 08:44:02 | 000,016,984 | ---- | M] (BullGuard Ltd.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Software\BullGuard\Reconn.sys -- (Reconn) DRV - [2007.04.18 08:40:18 | 000,050,904 | ---- | M] (BullGuard Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BdFileSpy.sys -- (BdFileSpy) DRV - [2007.02.07 18:35:10 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2006.11.28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50) DRV - [2006.11.28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50) DRV - [2006.11.22 17:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.15 17:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2006.11.15 12:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006.11.15 10:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2006.11.02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2006.10.01 14:37:02 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0801.sys -- (tap0801) DRV - [2006.06.29 04:11:48 | 000,017,408 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000HID.sys -- (UDXTTM6000HID) DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google.de" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/" FF - prefs.js..extensions.enabledItems: {152455DE-7B40-4bcf-B5B4-C68A1BE85A91}:2.6.7 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4 FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85 FF - prefs.js..extensions.enabledItems: {75CEEE46-9B64-46f8-94BF-54012DE155F0}:0.4.6 FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009110501 FF - prefs.js..extensions.enabledItems: {89736E8E-4B14-4042-8C75-AD00B6BD3900}:1.0.5 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3 FF - prefs.js..extensions.enabledItems: janetka@pinger:1.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}:5.1.0.8 FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9 FF - prefs.js..network.proxy.autoconfig_url: "https://vw-online.hdm-stuttgart.de/eBooks/proxy.pac" FF - prefs.js..network.proxy.type: 2 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.01.22 00:15:10 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Components: C:\Program Files\Mozilla Firefox 3\components [2009.01.22 00:15:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox 3\plugins [2010.03.11 21:59:00 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.05 20:56:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.05 20:56:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\sunbird\components [2010.05.09 15:34:08 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\sunbird\plugins FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\thunderbird\components [2011.06.15 18:57:24 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\thunderbird\plugins FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Components: C:\Program Files\mozilla.org\SeaMonkey\Components [2009.03.16 21:40:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Plugins: C:\Program Files\mozilla.org\SeaMonkey\Plugins [2009.01.22 00:15:15 | 000,000,000 | ---D | M] [2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions [2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28} [2008.07.09 00:05:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\extensions [2011.06.16 19:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions [2010.10.10 20:02:24 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2010.10.10 20:02:45 | 000,000,000 | ---D | M] (Domain Details) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{152455DE-7B40-4bcf-B5B4-C68A1BE85A91} [2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.03.30 22:55:04 | 000,000,000 | ---D | M] ("Split Browser") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d} [2008.01.09 22:24:01 | 000,000,000 | ---D | M] (del.icio.us) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8} [2010.11.01 21:32:46 | 000,000,000 | ---D | M] (MeasureIt) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0} [2009.08.30 09:20:25 | 000,000,000 | ---D | M] ("TinyUrl Creator") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900} [2010.04.04 15:42:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Diigo Bookmarks and Web Annotations) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3} [2010.08.24 21:57:08 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\firebug@software.joehewitt.com [2010.05.28 23:14:19 | 000,000,000 | ---D | M] (Pinger) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\janetka@pinger [2009.01.25 18:36:50 | 000,000,000 | ---D | M] (Smart Middle Click) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\SmartMiddleClick@spiers [2010.11.01 21:32:49 | 000,000,000 | ---D | M] (Zotero) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\zotero@chnm.gmu.edu [2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Sunbird\Profiles\77qk2mf3.default\extensions [2008.07.08 22:32:38 | 000,002,295 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\blinde-kuh.xml [2011.06.05 22:46:45 | 000,002,533 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\diigo--google.xml [2010.12.30 12:17:08 | 000,002,101 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\googlede.xml [2008.01.09 20:33:40 | 000,001,907 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\leo-eng-ger.xml [2008.02.25 23:56:25 | 000,001,067 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\wikipedia-deutsch.xml [2011.06.16 19:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2009.02.18 18:20:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2002.05.02 12:22:30 | 000,991,232 | ---- | M] (MindAvenue) -- C:\Programme\Mozilla Firefox\plugins\NPAXELPlayer.dll [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.08.04 20:57:43 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.08.04 20:57:43 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.08.04 20:57:43 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.08.04 20:57:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.08.04 20:57:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found. O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [CtrlVol] File not found O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [openvpn-gui] File not found O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\Quicktime Apple\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( ) O4 - HKLM..\Run: [TVBroadcast] C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe (ODSoft multimedia) O4 - HKLM..\Run: [UVS10 Preload] C:\Programme\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe (Ulead Systems, Inc.) O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.) O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [msnmsgr] C:\Programme\MSN Messenger\msnmsgr.exe (Microsoft Corporation) O4 - HKCU..\Run: [PhonostarAgent] C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe (phonostar) O4 - HKCU..\Run: [PhonostarTimer] C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe (phonostar) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet) O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} hxxp://picasaweb.google.com/s/v/57.11/uploader2.cab (UploadListView Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183949065925 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell\AutoRun\command - "" = J:\LGAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: BGNewsAgent - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\BgNewsUI.exe (BullGuard Software) MsConfig - StartUpReg: BullGuard - hkey= - key= - C:\Program Files\BullGuard Software\BullGuard\bullguard.exe (BullGuard Software) MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\MSN Messenger\msnmsgr.exe (Microsoft Corporation) MsConfig - State: "startup" - 2 MsConfig - State: "services" - 2 SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {1FE515CC-7927-4012-63E9-B692A3E39431} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2 ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.dvacm - C:\Programme\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.) Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.MPEGacm - C:\Programme\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.) Drivers32: msacm.ulmp3acm - C:\Programme\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org) Drivers32: VIDC.VMnc - C:\Windows\System32\vmnc.dll (VMware, Inc.) Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.06.17 14:14:33 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe [2011.06.15 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Mia\AppData\Roaming\Malwarebytes [2011.06.15 20:14:22 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.06.15 20:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.06.15 20:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.06.15 20:14:16 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.06.15 20:12:24 | 000,000,000 | ---D | C] -- C:\Programme\anti-malware [2011.05.29 20:23:20 | 000,000,000 | ---D | C] -- C:\Users\Mia\.mediathek [2011.05.29 20:18:00 | 000,000,000 | ---D | C] -- C:\Programme\mediathek [2007.07.12 04:57:45 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll [3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ] [1 C:\Users\Mia\Desktop\*.tmp files -> C:\Users\Mia\Desktop\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.06.17 14:25:11 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe [2011.06.17 14:05:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003UA.job [2011.06.17 13:38:02 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.06.17 13:36:03 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.17 13:36:03 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.17 10:04:07 | 000,000,600 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd [2011.06.17 09:54:21 | 000,000,076 | ---- | M] () -- C:\Users\Mia\pfad-fuer-logs [2011.06.17 09:34:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.16 23:05:01 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003Core.job [2011.06.16 20:38:03 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.06.16 19:21:52 | 000,641,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.06.16 19:21:52 | 000,607,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.06.16 19:21:52 | 000,131,878 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.06.16 19:21:52 | 000,108,970 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.06.16 19:13:43 | 2137,186,304 | -HS- | M] () -- C:\hiberfil.sys [2011.06.16 19:02:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm [2011.06.16 19:02:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm [2011.06.15 20:14:23 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.15 18:44:40 | 000,002,094 | ---- | M] () -- C:\Users\Mia\Desktop\Google Chrome.lnk [2011.06.07 21:32:43 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.05.22 23:40:46 | 000,112,640 | ---- | M] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ] [1 C:\Users\Mia\Desktop\*.tmp files -> C:\Users\Mia\Desktop\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.06.17 09:54:21 | 000,000,076 | ---- | C] () -- C:\Users\Mia\pfad-fuer-logs [2011.06.15 20:14:23 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.12.18 15:35:49 | 000,000,506 | ---- | C] () -- C:\Windows\infothek.INI [2010.08.16 20:12:22 | 001,205,818 | ---- | C] () -- C:\Windows\System32\fendt_comic.exe [2010.08.16 20:01:52 | 000,000,051 | ---- | C] () -- C:\Windows\Fendt Comic.ini [2009.10.23 22:09:24 | 000,000,109 | ---- | C] () -- C:\Windows\jascreg.ini [2009.10.15 00:08:06 | 000,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll [2009.09.24 21:29:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.24 21:29:28 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.29 20:49:08 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll [2009.04.05 04:57:06 | 001,301,502 | ---- | C] () -- C:\Windows\System32\libswish-e-2.dll [2009.03.02 23:17:37 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2009.01.25 16:22:40 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll [2009.01.11 21:54:32 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2009.01.11 21:54:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2009.01.11 21:47:27 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf07a.dat [2009.01.04 04:01:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.12.09 23:34:35 | 000,047,104 | ---- | C] () -- C:\Windows\System32\Wh2Robo.dll [2008.05.27 19:00:19 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd [2008.05.27 18:42:14 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI [2008.05.03 20:05:33 | 000,320,384 | ---- | C] () -- C:\Windows\System32\drivers\UDXTTM6000.sys [2008.04.09 19:24:51 | 000,000,009 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\mdb.bin [2008.02.16 16:50:45 | 000,219,473 | ---- | C] () -- C:\Windows\SeaMonkeyUninstall.exe [2008.02.16 16:50:39 | 000,118,784 | ---- | C] () -- C:\Windows\GREUninstall.exe [2008.02.14 14:40:53 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI [2008.01.23 11:09:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2008.01.13 12:34:25 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Local\PUTTY.RND [2008.01.02 16:51:15 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit_.INI [2008.01.02 12:37:22 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL [2007.12.28 21:24:12 | 000,394,240 | ---- | C] () -- C:\Windows\System32\Smab.dll [2007.12.28 21:24:11 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe [2007.12.28 21:24:11 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2007.12.28 21:24:10 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe [2007.12.28 21:24:09 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe [2007.12.28 21:24:09 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe [2007.10.03 18:30:16 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini [2007.09.27 11:50:15 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.09.23 11:57:44 | 000,004,294 | ---- | C] () -- C:\Windows\mozver.dat [2007.09.22 22:39:29 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat [2007.09.06 11:13:07 | 000,112,640 | ---- | C] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.09.06 10:38:41 | 000,023,182 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\UserTile.png [2007.09.06 09:02:42 | 000,004,536 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\wklnhst.dat [2007.09.06 08:45:29 | 000,000,094 | ---- | C] () -- C:\Users\Mia\AppData\Local\fusioncache.dat [2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll [2007.07.12 04:57:45 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2007.07.09 17:32:04 | 000,087,312 | ---- | C] () -- C:\Windows\mws.exe [2007.07.06 07:39:12 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini [2007.07.06 07:39:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.07.06 07:12:57 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys [2007.07.06 06:41:51 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2007.07.06 06:41:51 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll [2007.06.20 13:44:37 | 000,000,199 | ---- | C] () -- C:\Windows\WISO.INI [2007.06.20 13:39:38 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll [2007.06.20 13:39:38 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll [2007.06.11 14:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007.06.11 14:43:51 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL [2006.12.11 06:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2006.11.02 17:33:31 | 000,641,432 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,131,878 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,379,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,607,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,108,970 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.09.20 07:34:10 | 000,000,000 | ---- | C] () -- C:\Windows\Buhl.ini [2006.08.28 04:29:02 | 000,115,001 | ---- | C] () -- C:\Windows\System32\pcre.dll [2006.08.28 04:29:02 | 000,061,447 | ---- | C] () -- C:\Windows\System32\pcreposix.dll [2006.08.27 22:48:58 | 004,484,537 | ---- | C] () -- C:\Windows\System32\libxml2-2.dll [2006.08.27 19:55:50 | 000,074,240 | ---- | C] () -- C:\Windows\System32\zlib1.dll ========== LOP Check ========== [2007.10.29 12:13:31 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\BullGuard [2010.05.30 14:48:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\elsterformular [2008.01.13 15:29:35 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FileZilla [2008.03.16 10:51:39 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FireShot [2010.09.24 16:39:13 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Houbg [2011.05.16 20:18:40 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQ [2007.10.09 13:37:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQLite [2010.09.19 15:06:41 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Idvu [2007.09.14 20:53:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InterVideo [2007.09.06 08:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\MAGIX [2009.03.22 12:24:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Nvu [2008.02.03 20:27:52 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Opera [2007.12.10 11:22:36 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\PeerNetworking [2008.03.07 15:01:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\phonostar-Player [2007.12.28 16:30:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Screenshot Studio Files [2008.12.23 19:56:58 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\T-Online [2007.09.06 09:02:51 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Template [2011.06.15 18:57:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Thunderbird [2009.04.29 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Tobit [2008.02.12 09:00:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\TVcentral-Core [2007.09.06 11:06:00 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ulead Systems [2011.06.16 19:11:54 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.06.17 14:25:11 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.05.28 20:24:10 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Adobe [2008.05.11 22:30:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\AdobeUM [2008.02.01 00:38:46 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ahead [2010.04.22 22:35:42 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Avira [2009.03.08 23:49:39 | 000,000,000 | R--D | M] -- C:\Users\Mia\AppData\Roaming\Brother [2007.10.29 12:13:31 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\BullGuard [2010.05.30 14:48:22 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\elsterformular [2008.01.13 15:29:35 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FileZilla [2008.03.16 10:51:39 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\FireShot [2007.09.22 15:23:18 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Google [2010.09.24 16:39:13 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Houbg [2011.05.16 20:18:40 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQ [2007.10.09 13:37:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\ICQLite [2007.09.06 08:45:09 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Identities [2008.06.01 20:41:28 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\IDMComp [2010.09.19 15:06:41 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Idvu [2007.09.23 17:19:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InstallShield [2007.09.14 20:53:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\InterVideo [2007.09.15 20:13:45 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Macromedia [2007.09.06 08:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\MAGIX [2011.06.15 20:15:29 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Malwarebytes [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Media Center Programs [2008.07.27 20:26:46 | 000,000,000 | --SD | M] -- C:\Users\Mia\AppData\Roaming\Microsoft [2008.05.27 18:40:19 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Microsoft Web Folders [2010.05.09 15:34:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Mozilla [2009.03.22 12:24:44 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Nvu [2008.02.03 20:27:52 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Opera [2007.12.10 11:22:36 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\PeerNetworking [2008.03.07 15:01:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\phonostar-Player [2008.02.28 13:18:23 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Real [2009.09.25 22:00:18 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Reallusion [2007.12.28 16:30:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Screenshot Studio Files [2011.06.17 14:19:53 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Skype [2011.06.17 09:34:43 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\skypePM [2008.12.23 19:56:58 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\T-Online [2008.09.14 18:47:10 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Talkback [2007.09.06 09:02:51 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Template [2011.06.15 18:57:33 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Thunderbird [2009.04.29 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Tobit [2008.02.12 09:00:15 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\TVcentral-Core [2007.09.06 11:06:00 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\Ulead Systems [2011.01.03 22:13:08 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\vlc [2010.03.10 23:33:56 | 000,000,000 | ---D | M] -- C:\Users\Mia\AppData\Roaming\VMware < %APPDATA%\*.exe /s > [2010.07.11 19:40:14 | 002,568,656 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Mia\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe [2008.02.03 20:27:47 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Mia\AppData\Roaming\Microsoft\Installer\{C619B312-19F3-460A-9F7B-443248379F18}\ARPPRODUCTICON.exe [2010.02.04 22:16:22 | 000,040,960 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe [2008.02.28 13:18:28 | 000,329,264 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Mia\AppData\Roaming\Real\RealPlayer\Update\RealPlayer11GOLD.exe < %SYSTEMDRIVE%\*.exe > [2008.03.17 23:45:22 | 007,755,399 | ---- | M] () -- C:\Install_Wise_Guys_Screensaver.exe < MD5 for: AGP440.SYS > [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2007.04.17 10:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys [2007.04.17 10:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys [2008.02.14 09:01:19 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2008.02.14 09:01:19 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008.02.14 09:01:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys [2008.02.14 09:01:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2007.07.31 20:06:30 | 000,028,791 | R--- | M] () MD5=39EE40F7A5081995CF3A44FE46CCF02F -- C:\Perl\lib\auto\Win32\EventLog\EventLog.dll < MD5 for: IASTOR.SYS > [2006.10.31 14:13:46 | 000,495,896 | ---- | M] (Intel Corporation) MD5=81EC16AFD70E3432B8C573782CCFEE6D -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys [2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys [2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\drivers\iaStor.sys [2006.10.31 13:46:36 | 000,250,368 | ---- | M] (Intel Corporation) MD5=DE01BF14FFB150C779FD561BD0E3C5C5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3bb7bc45\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2007.06.19 15:33:29 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll [2007.06.19 15:33:29 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll [2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe < MD5 for: WININIT.EXE > [2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe [2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys [2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.01.19 09:34:08 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll [2008.01.19 09:34:08 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll < > ========== Alternate Data Streams ========== @Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty @Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV < End of report > |
17.06.2011, 14:14 | #5 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Kannst du mit die auffallend vielen Ähnlichkeiten erklären, die dieses OTL-Log mit dem in diesem Strang hat? => http://www.trojaner-board.de/100260-...f-rechner.html Laufwerke/Partition, Hostname und Speicherausbau sind da ja identisch!!
__________________ Logfiles bitte immer in CODE-Tags posten |
17.06.2011, 14:22 | #6 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Ja, das ist ganz einfach - ich habe mir zeitgleich zwei identische Rechner gekauft, d.h. gleiches Betriebssystem und auch mehr oder weniger die gleiche Software installiert. Nur der Standort unterscheidet sich;-) Und als der eine das Problem mit der Malware Protection hatte, habe ich den anderen auch getestet auf Malware und Viren... |
17.06.2011, 14:23 | #7 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Ok. Wollte nur sichergehen, dass wir auch das richtige Log zum Rechner durchgehen und nicht die Logs verwechseln.
__________________ Logfiles bitte immer in CODE-Tags posten |
17.06.2011, 14:26 | #8 | ||
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?Zitat:
Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
17.06.2011, 14:40 | #9 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Bullguard war am Anfang auf dem Rechner drauf. Ich habe es dann deaktiviert - dachte ich zumindest, weil ich AntiVir als Virenschutz haben wollte. Die Probelizenz von Bullguard ist auch schon längst abgelaufen. Soll ich es zur Sicherheit deinstallieren? Werde mir gleich mal durchlesen, was du über AntiVir gepostet hast und dann mir ggf. ne was Neues suchen. Vielen Dank für deine Hilfe bis jetzt |
17.06.2011, 14:46 | #10 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
17.06.2011, 15:01 | #11 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Bullgard ist nun deinstalliert. Was nun? - ohne Drängeln und quengeln zu wollen ;-) |
17.06.2011, 21:34 | #12 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Nach einem Neustart des Rechners waren die Systemdateien alle sichtbar. Ich weiß, dass man die ganz einfach wieder unsichtbar bekommt. Mich würde aber interessieren ob das mit den Trojanern/Malware oder dem odl zu tun hat, oder ob ich noch ein anderes Problem habe. |
19.06.2011, 21:55 | #13 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Mach bitte ein neues OTL-Custom-Log.
__________________ Logfiles bitte immer in CODE-Tags posten |
22.06.2011, 06:32 | #14 |
| Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Guten morgen, ich habe Avira temporär deaktiviert. OTL als Admin ausgeführt. und einen "normalen" Scan gemacht. Hier die Logdatei: OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.06.2011 21:18:31 - Run 2 OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Mia\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,33% Memory free 4,21 Gb Paging File | 2,99 Gb Available in Paging File | 71,05% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 119,00 Gb Total Space | 9,23 Gb Free Space | 7,76% Space Free | Partition Type: NTFS Drive D: | 30,04 Gb Total Space | 7,56 Gb Free Space | 25,18% Space Free | Partition Type: FAT32 Drive E: | 4,38 Gb Total Space | 0,21 Gb Free Space | 4,85% Space Free | Partition Type: UDF Drive F: | 51,39 Gb Total Space | 4,23 Gb Free Space | 8,23% Space Free | Partition Type: NTFS Drive J: | 44,48 Gb Total Space | 10,65 Gb Free Space | 23,94% Space Free | Partition Type: NTFS Drive K: | 53,17 Gb Total Space | 19,05 Gb Free Space | 35,84% Space Free | Partition Type: NTFS Computer Name: Mia-LAPTOP | User Name: Mia | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe PRC - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.11.05 10:48:38 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () -- c:\Programme\radio\Tobit ClipInc\Server\ClipInc-Server.exe PRC - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnetdhcp.exe PRC - [2008.10.28 23:00:50 | 000,064,048 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\hqtray.exe PRC - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) -- C:\Programme\VMware\VMware Player\vmware-authd.exe PRC - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) -- C:\Windows\System32\vmnat.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.19 09:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2007.12.05 17:14:34 | 000,126,976 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe PRC - [2007.12.05 17:10:52 | 000,098,304 | ---- | M] (phonostar) -- C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe PRC - [2007.06.27 20:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2007.06.27 20:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2007.05.08 09:06:36 | 000,790,016 | ---- | M] (ODSoft multimedia) -- C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe PRC - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe PRC - [2007.04.13 18:14:28 | 000,016,384 | ---- | M] (Empolis GmbH) -- C:\Programme\Medion\MEDIONbox\Program\GCS.exe PRC - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe PRC - [2007.03.30 11:10:00 | 000,061,440 | ---- | M] () -- C:\Programme\Fujitsu Siemens\WinManager\WinManager.exe PRC - [2007.03.02 17:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe PRC - [2007.02.15 17:07:16 | 004,390,912 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.01.19 12:55:00 | 005,674,352 | ---- | M] (Microsoft Corporation) -- C:\Programme\MSN Messenger\msnmsgr.exe PRC - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006.12.26 11:23:34 | 000,180,224 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\OSD.exe PRC - [2006.12.14 16:53:28 | 000,192,512 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe PRC - [2006.11.22 17:31:26 | 000,630,784 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe PRC - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe PRC - [2006.11.15 16:58:26 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2006.11.09 14:37:52 | 000,086,016 | ---- | M] () -- C:\Programme\Launch Manager\WButton.exe PRC - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe PRC - [2005.07.25 13:36:40 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe ========== Modules (SafeList) ========== MOD - [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (OpenVPNService) SRV - File not found [On_Demand | Stopped] -- -- (Emdepa) SRV - [2011.05.08 20:20:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.18 20:08:23 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2008.11.28 16:50:22 | 002,195,720 | ---- | M] () [Auto | Running] -- c:\Program Files\Radio\Tobit ClipInc\Server\ClipInc-Server.exe -- (ClipInc001) SRV - [2008.10.28 23:01:22 | 000,326,192 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2008.10.28 23:00:40 | 000,113,200 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService) SRV - [2008.10.28 23:00:08 | 000,399,920 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service) SRV - [2008.10.02 18:25:42 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.07.16 20:35:37 | 000,069,120 | ---- | M] (Google) [Disabled | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe -- (GoogleDesktopManager) SRV - [2007.05.04 17:08:24 | 001,600,512 | ---- | M] (Buhl Data Service GmbH) [Auto | Running] -- C:\Programme\Sceneo\Bonavista\Services\PVR\pvrservice.exe -- (srvcPVR) SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Auto | Running] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService) SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.11.17 20:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc) SRV - [2006.11.15 16:57:58 | 000,081,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2006.09.28 23:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) SRV - [2005.11.17 14:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) ========== Driver Services (SafeList) ========== DRV - [2011.03.18 20:08:23 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.11.25 22:24:13 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.10.28 23:01:34 | 000,054,960 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci) DRV - [2008.10.28 23:01:32 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif) DRV - [2008.10.28 23:01:32 | 000,023,216 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd) DRV - [2008.10.28 23:01:30 | 000,857,392 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86) DRV - [2008.10.28 23:01:28 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon) DRV - [2008.10.28 17:03:28 | 000,031,280 | R--- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge) DRV - [2008.10.28 17:03:28 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV - [2008.10.02 18:24:48 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2007.07.05 19:23:42 | 000,277,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B) DRV - [2007.06.21 13:00:53 | 000,320,384 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000.sys -- (UDXTTM6000) DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.02.07 18:35:10 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2006.11.28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50) DRV - [2006.11.28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50) DRV - [2006.11.22 17:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.15 17:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2006.11.15 12:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006.11.15 10:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2006.11.02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2006.10.01 14:37:02 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0801.sys -- (tap0801) DRV - [2006.06.29 04:11:48 | 000,017,408 | ---- | M] (DTV-DVB) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UDXTTM6000HID.sys -- (UDXTTM6000HID) DRV - [2003.04.28 11:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google.de" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/" FF - prefs.js..extensions.enabledItems: {152455DE-7B40-4bcf-B5B4-C68A1BE85A91}:2.6.7 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4 FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85 FF - prefs.js..extensions.enabledItems: {75CEEE46-9B64-46f8-94BF-54012DE155F0}:0.4.6 FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009110501 FF - prefs.js..extensions.enabledItems: {89736E8E-4B14-4042-8C75-AD00B6BD3900}:1.0.5 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3 FF - prefs.js..extensions.enabledItems: janetka@pinger:1.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}:5.1.0.8 FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323 FF - prefs.js..network.proxy.autoconfig_url: "https://vw-online.hdm-stuttgart.de/eBooks/proxy.pac" FF - prefs.js..network.proxy.type: 2 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.01.22 00:15:10 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Components: C:\Program Files\Mozilla Firefox 3\components [2009.01.22 00:15:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox 3\plugins [2010.03.11 21:59:00 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.17 15:02:34 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.05 20:56:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\sunbird\components [2010.05.09 15:34:08 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\sunbird\plugins FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\thunderbird\components [2011.06.15 18:57:24 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\thunderbird\plugins FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Components: C:\Program Files\mozilla.org\SeaMonkey\Components [2009.03.16 21:40:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\SeaMonkey 1.1.8\Extensions\\Plugins: C:\Program Files\mozilla.org\SeaMonkey\Plugins [2009.01.22 00:15:15 | 000,000,000 | ---D | M] [2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions [2011.06.15 18:57:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28} [2008.07.09 00:05:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\extensions [2011.06.17 22:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions [2010.10.10 20:02:24 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2010.10.10 20:02:45 | 000,000,000 | ---D | M] (Domain Details) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{152455DE-7B40-4bcf-B5B4-C68A1BE85A91} [2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.03.30 22:55:04 | 000,000,000 | ---D | M] ("Split Browser") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d} [2008.01.09 22:24:01 | 000,000,000 | ---D | M] (del.icio.us) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8} [2010.11.01 21:32:46 | 000,000,000 | ---D | M] (MeasureIt) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0} [2009.08.30 09:20:25 | 000,000,000 | ---D | M] ("TinyUrl Creator") -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900} [2011.06.17 22:28:37 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2010.04.04 15:42:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2010.10.10 20:02:21 | 000,000,000 | ---D | M] (Diigo Bookmarks and Web Annotations) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3} [2010.08.24 21:57:08 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\firebug@software.joehewitt.com [2010.05.28 23:14:19 | 000,000,000 | ---D | M] (Pinger) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\janetka@pinger [2009.01.25 18:36:50 | 000,000,000 | ---D | M] (Smart Middle Click) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\SmartMiddleClick@spiers [2010.11.01 21:32:49 | 000,000,000 | ---D | M] (Zotero) -- C:\Users\Mia\AppData\Roaming\mozilla\Firefox\Profiles\o2tx0ldy.default\extensions\zotero@chnm.gmu.edu [2010.05.09 15:34:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mia\AppData\Roaming\mozilla\Sunbird\Profiles\77qk2mf3.default\extensions [2008.07.08 22:32:38 | 000,002,295 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\blinde-kuh.xml [2011.06.05 22:46:45 | 000,002,533 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\diigo--google.xml [2010.12.30 12:17:08 | 000,002,101 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\googlede.xml [2008.01.09 20:33:40 | 000,001,907 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\leo-eng-ger.xml [2008.02.25 23:56:25 | 000,001,067 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\Mozilla\Firefox\Profiles\o2tx0ldy.default\searchplugins\wikipedia-deutsch.xml [2011.06.17 22:28:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2009.02.18 18:20:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2010.07.11 19:35:28 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2002.05.02 12:22:30 | 000,991,232 | ---- | M] (MindAvenue) -- C:\Programme\Mozilla Firefox\plugins\NPAXELPlayer.dll [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.08.04 20:57:43 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.08.04 20:57:43 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.08.04 20:57:43 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.08.04 20:57:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.08.04 20:57:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found. O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [CtrlVol] File not found O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [openvpn-gui] File not found O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\Quicktime Apple\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( ) O4 - HKLM..\Run: [TVBroadcast] C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe (ODSoft multimedia) O4 - HKLM..\Run: [UVS10 Preload] C:\Programme\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe (Ulead Systems, Inc.) O4 - HKLM..\Run: [VMware hqtray] C:\Program Files\VMware\VMware Player\hqtray.exe (VMware, Inc.) O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [msnmsgr] C:\Programme\MSN Messenger\msnmsgr.exe (Microsoft Corporation) O4 - HKCU..\Run: [PhonostarAgent] C:\Programme\Internetradio phonostar\phonostar\ps_agent.exe (phonostar) O4 - HKCU..\Run: [PhonostarTimer] C:\Programme\Internetradio phonostar\phonostar\ps_timer.exe (phonostar) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ\version 7\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet) O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} hxxp://picasaweb.google.com/s/v/57.11/uploader2.cab (UploadListView Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183949065925 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Mia\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{a70cab19-bb6b-11df-abda-005056c00008}\Shell\AutoRun\command - "" = J:\LGAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.06.17 22:24:38 | 000,000,000 | ---D | C] -- C:\Users\Mia\Desktop\mix [2011.06.17 14:14:33 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe [2011.06.15 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Mia\AppData\Roaming\Malwarebytes [2011.06.15 20:14:22 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.06.15 20:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.06.15 20:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.06.15 20:14:16 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.06.15 20:12:24 | 000,000,000 | ---D | C] -- C:\Programme\anti-malware [2011.06.15 19:09:38 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.06.15 19:09:36 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2011.06.15 19:09:36 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.06.15 19:09:36 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.06.15 19:09:34 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2011.06.15 19:09:34 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2011.05.29 20:23:20 | 000,000,000 | ---D | C] -- C:\Users\Mia\.mediathek [2011.05.29 20:18:00 | 000,000,000 | ---D | C] -- C:\Programme\mediathek [2007.07.12 04:57:45 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll [3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.06.21 21:20:09 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8E21E027-9A81-475C-B74E-F815515A4C7B}.job [2011.06.21 21:13:54 | 000,641,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.06.21 21:13:54 | 000,607,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.06.21 21:13:54 | 000,131,878 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.06.21 21:13:54 | 000,108,970 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.06.21 21:08:19 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.06.21 21:08:10 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.21 21:08:10 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.21 21:08:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.21 21:08:01 | 2137,186,304 | -HS- | M] () -- C:\hiberfil.sys [2011.06.20 23:50:34 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm [2011.06.20 23:50:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm [2011.06.20 23:38:42 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.06.20 23:05:43 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003UA.job [2011.06.20 23:05:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-967124566-3105974339-2490099070-1003Core.job [2011.06.19 21:16:42 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2011.06.19 21:11:20 | 000,114,176 | ---- | M] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.18 23:01:29 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm [2011.06.18 23:01:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm [2011.06.17 14:16:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Mia\Desktop\OTL.exe [2011.06.17 10:04:07 | 000,000,600 | ---- | M] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd [2011.06.17 09:54:21 | 000,000,076 | ---- | M] () -- C:\Users\Mia\pfad-fuer-logs [2011.06.16 19:02:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm [2011.06.16 19:02:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm [2011.06.15 20:14:23 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.15 18:44:40 | 000,002,094 | ---- | M] () -- C:\Users\Mia\Desktop\Google Chrome.lnk [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.05.24 19:14:10 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [3 C:\Users\Mia\Documents\*.tmp files -> C:\Users\Mia\Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.06.17 09:54:21 | 000,000,076 | ---- | C] () -- C:\Users\Mia\pfad-fuer-logs [2011.06.15 20:14:23 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.12.18 15:35:49 | 000,000,506 | ---- | C] () -- C:\Windows\infothek.INI [2010.08.16 20:12:22 | 001,205,818 | ---- | C] () -- C:\Windows\System32\fendt_comic.exe [2010.08.16 20:01:52 | 000,000,051 | ---- | C] () -- C:\Windows\Fendt Comic.ini [2009.10.23 22:09:24 | 000,000,109 | ---- | C] () -- C:\Windows\jascreg.ini [2009.10.15 00:08:06 | 000,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll [2009.09.24 21:29:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.24 21:29:28 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.29 20:49:08 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll [2009.04.05 04:57:06 | 001,301,502 | ---- | C] () -- C:\Windows\System32\libswish-e-2.dll [2009.03.02 23:17:37 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2009.01.25 16:22:40 | 000,019,968 | ---- | C] () -- C:\Windows\System32\cpuinf32.dll [2009.01.11 21:54:32 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2009.01.11 21:54:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2009.01.11 21:47:27 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf07a.dat [2009.01.04 04:01:40 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.12.09 23:34:35 | 000,047,104 | ---- | C] () -- C:\Windows\System32\Wh2Robo.dll [2008.05.27 19:00:19 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\winscp.rnd [2008.05.27 18:42:14 | 000,000,403 | ---- | C] () -- C:\Windows\ODBC.INI [2008.05.03 20:05:33 | 000,320,384 | ---- | C] () -- C:\Windows\System32\drivers\UDXTTM6000.sys [2008.04.09 19:24:51 | 000,000,009 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\mdb.bin [2008.02.16 16:50:45 | 000,219,473 | ---- | C] () -- C:\Windows\SeaMonkeyUninstall.exe [2008.02.16 16:50:39 | 000,118,784 | ---- | C] () -- C:\Windows\GREUninstall.exe [2008.02.14 14:40:53 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI [2008.01.23 11:09:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2008.01.13 12:34:25 | 000,000,600 | ---- | C] () -- C:\Users\Mia\AppData\Local\PUTTY.RND [2008.01.02 16:51:15 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit_.INI [2008.01.02 12:37:22 | 000,210,944 | ---- | C] () -- C:\Windows\System32\MSVCRT10.DLL [2007.12.28 21:24:12 | 000,394,240 | ---- | C] () -- C:\Windows\System32\Smab.dll [2007.12.28 21:24:11 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe [2007.12.28 21:24:11 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll [2007.12.28 21:24:10 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe [2007.12.28 21:24:09 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe [2007.12.28 21:24:09 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe [2007.10.03 18:30:16 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini [2007.09.27 11:50:15 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.09.23 11:57:44 | 000,004,294 | ---- | C] () -- C:\Windows\mozver.dat [2007.09.22 22:39:29 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat [2007.09.06 11:13:07 | 000,114,176 | ---- | C] () -- C:\Users\Mia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.09.06 10:38:41 | 000,023,182 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\UserTile.png [2007.09.06 09:02:42 | 000,004,536 | ---- | C] () -- C:\Users\Mia\AppData\Roaming\wklnhst.dat [2007.09.06 08:45:29 | 000,000,094 | ---- | C] () -- C:\Users\Mia\AppData\Local\fusioncache.dat [2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll [2007.07.12 04:57:45 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2007.07.09 17:32:04 | 000,087,312 | ---- | C] () -- C:\Windows\mws.exe [2007.07.06 07:39:12 | 000,001,208 | ---- | C] () -- C:\Windows\mgxoschk.ini [2007.07.06 07:39:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.07.06 07:12:57 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys [2007.07.06 06:41:51 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2007.07.06 06:41:51 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll [2007.06.20 13:44:37 | 000,000,199 | ---- | C] () -- C:\Windows\WISO.INI [2007.06.20 13:39:38 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll [2007.06.20 13:39:38 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll [2007.06.11 14:43:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007.06.11 14:43:51 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\Windows\System32\OGACheckControl.DLL [2006.12.11 06:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2006.11.02 17:33:31 | 000,641,432 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,131,878 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,379,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,607,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,108,970 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.09.20 07:34:10 | 000,000,000 | ---- | C] () -- C:\Windows\Buhl.ini [2006.08.28 04:29:02 | 000,115,001 | ---- | C] () -- C:\Windows\System32\pcre.dll [2006.08.28 04:29:02 | 000,061,447 | ---- | C] () -- C:\Windows\System32\pcreposix.dll [2006.08.27 22:48:58 | 004,484,537 | ---- | C] () -- C:\Windows\System32\libxml2-2.dll [2006.08.27 19:55:50 | 000,074,240 | ---- | C] () -- C:\Windows\System32\zlib1.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty @Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV < End of report > |
22.06.2011, 11:18 | #15 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL @Alternate Data Stream - 709 bytes -> C:\Users\Mia\Desktop\Foto.eml:OECustomProperty @Alternate Data Stream - 64 bytes -> C:\P1160392.MOV.MPG:TOC.WMV :Commands [purity] [resethosts] Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Malwarebytes' Anti-Malware hat Trojan.ZbotR.Gen, Trojan.Agent und Malware.Trace entdeckt - und nun? |
anti-malware, appdata, code, dateien, entdeck, entdeckt, entfernen, explorer, hallo zusammen, installiert, malware, malwarebytes, microsoft, minute, protection, rechner, roaming, service, software, startet, trojan.agent, trojan.zbotr.gen, trojaner-board, version, versuche, zusammen |