Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 23.06.2011, 21:54   #1
wunderbar
 
Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei - Standard

Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei



Guten Tag,


vorab schon einmal vielen Dank für alle Hilfe.

Ich habe folgendes Problem:

Ich habe mit Malwarebytes Antimalware gestern Abend (22.06.2011) einen Scan gemacht und er hat 3 infizierte Dateien gefunden. Hier das Logfile:


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6922

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

22.06.2011 23:18:15
mbam-log-2011-06-22 (23-18-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|T:\|)
Durchsuchte Objekte: 293975
Laufzeit: 34 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Arbeit\AppData\Local\Temp\0fnxdkci.exe.part (Trojan.Agent) -> No action taken.
c:\Users\Arbeit\AppData\Local\Temp\il4imfeu.exe.part (Trojan.Agent) -> No action taken.
c:\Users\Arbeit\AppData\Local\Temp\t11bmfny.exe.part (Trojan.Agent) -> No action taken.


Ich habe dann (leider) die Dateien sofort desinfiziert. Eine Google Suche hat keine Ergebnisse ergeben bis auf Hinweise das diese Meldung bei MBAM VIELLEICHT ein falscher Alarm ist.

Ich habe dann alle möglichen Scanner drüber laufen lassen, meinen Sunbelt VIPRE, hatte die Testversion drauf. Der hat nichts gefunden. Diverse Online Scanner von F-Secure, Trendmicro und Anti Spyware Programme wie SUPERAntiSpyware und Lavasoft Adware haben bis auf TRACKING COOKIES nichts gefunden.

Ich habe inzwischen den Sunbelt VIPRE Antivirus Testversion deinstalliert und F-Secure Internet Security installiert, bisher bin ich sehr zufrieden damit. Vorher hatte ich die Free AVG Version installiert. Auf fragwürdigen pronographischen Seiten und illegalen Seiten bin ich nicht unterwegs.

An Symptonen könnte ich nur folgendes berichten:

Ich habe den Eindruck, dass sowohl der IE als auch FIREFOX manchmal einen seltsamen „lag“ haben, d.h. Sie scheinen nicht direkt zu reagieren, allerdings nicht die Windows-Meldung „Keine Rückmeldung“. Alles scheint in Ordnung, nur sie reagieren auf Eingaben nicht direkt. Es ist schwierig das fest zu machen und von Performance Problemen zu unterscheiden aber das ist zumindest mein Eindruck.

Nach der Desinfektion von Malwarebytes findet Malwarebytes auch nichts mehr. Also aktuell werden keine Schädlinge erkannt, weder von MBAM, Superantispyware noch F-Secure. Bisher war mein System eigentlich immer nur mit „Tracking Cookies“ „infiziert“. Ist das überhaupt vermeidbar bei normalem Surfverhalten?


Weitere Logfiles unten! Ich habe den OTL Quickscan wie in der Erstanleitung des Forums beschrieben gemacht,er hat auch die „OTL“ Datei erstellt allerdings keine Datei „Extras“.

Vielen Dank und Freundliche Grüße


Wunderbar!

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:04 on 23/06/2011 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-



OTL LOGFILE:


OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 23.06.2011 22:10:27 - Run 3[/I]
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\***\Desktop
64bit- An unknown product Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,98 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 74,10% Memory free
7,96 Gb Paging File | 6,71 Gb Available in Paging File | 84,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55,80 Gb Total Space | 13,38 Gb Free Space | 23,98% Space Free | Partition Type: NTFS
Drive E: | 461,23 Gb Total Space | 115,77 Gb Free Space | 25,10% Space Free | Partition Type: NTFS
 
Computer Name: ARBEIT | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2011.06.23 14:10:42 | 000,484,520 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe
PRC - [2011.06.23 14:09:23 | 000,983,592 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe
PRC - [2011.06.23 14:09:23 | 000,508,456 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
PRC - [2011.06.23 14:09:08 | 000,061,088 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
PRC - [2011.06.23 14:08:22 | 000,221,864 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
PRC - [2011.06.23 14:08:22 | 000,201,384 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSM32.EXE
PRC - [2011.06.23 14:08:22 | 000,189,096 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
PRC - [2011.06.23 14:08:22 | 000,090,792 | ---- | M] (F-Secure Corporation) -- C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.26 19:59:18 | 001,496,528 | ---- | M] (TrueCrypt Foundation) -- C:\Programme\TrueCrypt\TrueCrypt.exe
PRC - [2011.03.25 23:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.03.25 23:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.03.25 23:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.03.25 22:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
MOD - [2011.06.23 14:08:27 | 000,332,456 | ---- | M] (F-Secure Corporation) -- c:\program files (x86)\f-secure\hips\fshook32.dll
MOD - [2010.11.20 03:55:10 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.05.04 19:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Disabled | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2011.04.20 04:04:18 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2011.06.23 14:09:08 | 000,061,088 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe -- (FSORSPClient)
SRV - [2011.06.23 14:08:24 | 000,849,576 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD)
SRV - [2011.06.23 14:08:22 | 000,221,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter)
SRV - [2011.06.23 14:08:22 | 000,189,096 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE -- (FSMA)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.06.01 14:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.05.16 14:58:36 | 002,151,128 | ---- | M] (Lavasoft Limited) [Disabled | Stopped] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011.03.25 23:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.03.25 23:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.03.25 23:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.03.25 22:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010.08.19 13:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.06.23 14:08:26 | 000,046,664 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fses.sys -- (FSES)
DRV:64bit: - [2011.06.23 14:08:24 | 000,095,784 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fsdfw.sys -- (FSFW)
DRV:64bit: - [2011.05.26 19:59:18 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2011.05.26 11:08:22 | 000,769,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\arusb_win7x.sys -- (arusb_win7x)
DRV:64bit: - [2011.04.29 12:12:00 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2011.04.20 04:44:48 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.04.20 03:22:32 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.04.13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.03.25 23:27:36 | 000,068,720 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.03.25 23:27:34 | 000,081,008 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.03.25 23:27:28 | 000,030,832 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\VMparport.sys -- (VMparport)
DRV:64bit: - [2011.03.25 23:25:46 | 000,031,856 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.03.25 23:25:34 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.03.25 22:27:36 | 000,038,512 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.03.25 20:05:00 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:64bit: - [2011.03.25 20:04:58 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.03.25 20:04:58 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2011.02.11 23:23:34 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)
DRV:64bit: - [2011.02.08 13:30:52 | 000,064,512 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronXHCI.sys -- (EtronXHCI)
DRV:64bit: - [2011.02.08 13:30:52 | 000,039,936 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronHub3.sys -- (EtronHub3)
DRV:64bit: - [2010.11.26 01:31:56 | 000,017,408 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\DisplayLinkUsbPort_5.5.29055.0.sys -- (DisplayLinkUsbPort)
DRV:64bit: - [2010.11.20 05:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 05:32:48 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 05:32:48 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 03:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.18 12:54:10 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\E63C.tmp -- (MEMSWEEP2)
DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2011.06.23 14:09:59 | 000,198,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper)
DRV - [2011.06.23 14:08:27 | 000,061,960 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys -- (F-Secure HIPS)
DRV - [2011.06.23 14:08:22 | 000,041,896 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys -- (F-Secure Filter)
DRV - [2011.06.23 14:08:22 | 000,027,304 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Program Files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys -- (F-Secure Recognizer)
DRV - [2011.06.23 14:08:22 | 000,015,016 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys -- (fsvista)
DRV - [2010.08.19 13:56:38 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2010.02.17 20:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2010.02.17 20:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DE FA 7D 4B AA 1B CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG10\Firefox4\ [2011.06.03 10:27:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files (x86)\congstar\Internetmanager\Bin\addon
FF - HKLM\software\mozilla\Firefox\Extensions\\litmus-ff@f-secure.com: C:\Program Files (x86)\F-Secure\NRS\litmus-ff@f-secure.com [2011.06.23 14:09:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.06.23 19:50:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.20 11:48:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.06.22 10:26:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2011.05.26 11:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2011.05.26 11:30:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.05.26 11:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\q57vlm80.default\extensions
[2011.05.26 11:27:43 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\q57vlm80.default\extensions\foxmarks@kei.com
[2011.06.23 20:05:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.05.26 15:55:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.05.26 12:55:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) -- 
File not found (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q57VLM80.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
File not found (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q57VLM80.DEFAULT\EXTENSIONS\FOXMARKS@KEI.COM
[2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.05.26 12:55:55 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.20 17:21:40 | 000,106,192 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npstrlnk.dll
[2011.03.22 20:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files (x86)\F-Secure\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe (F-Secure Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files (x86)\F-Secure\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat - Schnellstart.lnk - - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk - - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MCtlSvc.lnk - - File not found
MsConfig:64bit - StartUpFolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk - C:\Users\DANIEL~1\AppData\Roaming\Dropbox\bin\Dropbox.exe - (Dropbox, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk - C:\PROGRA~2\Evernote\Evernote\EVERNO~2.EXE - (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
MsConfig:64bit - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: CanoScan Toolbox 4.9 - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: Eraser - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: FlashPlayerUpdate - hkey= - key= - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe (Adobe Systems, Inc.)
MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: NapsterShell - hkey= - key= - C:\Program Files (x86)\Napster\napster.exe (Napster)
MsConfig:64bit - StartUpReg: PDF5 Registry Controller - hkey= - key= - C:\Program Files (x86)\Nuance\PDF Professional 5\RegistryController.exe (Nuance Communications, Inc.)
MsConfig:64bit - StartUpReg: PDFHook - hkey= - key= - C:\Program Files (x86)\Nuance\PDF Professional 5\pdfpro5hook.exe (Nuance Communications, Inc.)
MsConfig:64bit - StartUpReg: SpiderOak - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: VMware hqtray - hkey= - key= - C:\Program Files (x86)\VMware\VMware Player\hqtray.exe (VMware, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.23 21:53:18 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2011.06.23 20:23:10 | 000,000,000 | ---D | C] -- C:\Dropbox Backup_ohne VS
[2011.06.23 14:08:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\F-Secure Internet Security 2011
[2011.06.23 14:08:35 | 000,046,664 | ---- | C] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fses.sys
[2011.06.23 14:08:34 | 000,095,784 | ---- | C] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fsdfw.sys
[2011.06.23 14:08:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\F-Secure
[2011.06.23 13:50:40 | 000,000,000 | ---D | C] -- C:\ProgramData\fssg
[2011.06.23 13:35:11 | 000,000,000 | ---D | C] -- C:\Temp
[2011.06.23 12:59:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2011.06.23 12:59:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2011.06.23 12:38:40 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2011.06.23 12:38:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2011.06.23 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\SUPERAntiSpyware.com
[2011.06.23 11:26:03 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011.06.23 11:26:01 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011.06.23 11:26:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011.06.23 11:25:57 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2011.06.23 11:04:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\f-secure
[2011.06.23 11:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure
[2011.06.22 13:06:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon
[2011.06.22 13:06:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Canon
[2011.06.20 11:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Napster
[2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sonic Shared
[2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Roxio Shared
[2011.06.20 11:48:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Napster Shared
[2011.06.20 10:55:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Nuance
[2011.06.20 10:55:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PDF Professional 5
[2011.06.20 10:55:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ScanSoft Shared
[2011.06.20 10:55:09 | 000,000,000 | ---D | C] -- C:\ProgramData\zeon
[2011.06.20 10:54:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nuance
[2011.06.20 10:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Macrovision
[2011.06.20 10:31:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Internetmanager
[2011.06.16 17:02:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Microsoft Help
[2011.06.16 17:02:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011.06.15 23:24:06 | 000,049,752 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.06.15 23:24:06 | 000,045,904 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\sbbd.exe
[2011.06.14 12:09:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KeePass Password Safe
[2011.06.11 22:08:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Wireshark
[2011.06.11 22:06:01 | 000,000,000 | ---D | C] -- C:\Programme\Wireshark
[2011.06.08 10:19:37 | 001,377,856 | ---- | C] (VirusBuster Kft.) -- C:\Windows\SysNative\drivers\vbcorent-x64.sys
[2011.06.07 12:11:51 | 000,000,000 | ---D | C] -- C:\Programme\WinPcap
[2011.06.07 12:11:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nmap
[2011.06.04 13:30:33 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SupportAppZXH
[2011.06.03 15:55:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2011.06.03 12:45:43 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\TeamViewer
[2011.06.02 14:43:26 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Diagnostics
[2011.06.02 14:05:22 | 000,000,000 | -H-D | C] -- C:\$AVG
[2011.05.31 10:33:48 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Updater5
[2011.05.31 10:33:16 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2011.05.30 14:26:48 | 000,000,000 | ---D | C] -- C:\tmprdp
[2011.05.27 12:25:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG10
[2011.05.27 12:25:17 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011.05.27 12:24:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2011.05.27 12:24:11 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011.05.27 12:22:46 | 000,000,000 | ---D | C] -- C:\SMCLpav
[2011.05.26 23:07:59 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.05.26 21:52:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpiderOak
[2011.05.26 19:59:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\TrueCrypt
[2011.05.26 19:59:18 | 000,230,352 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.05.26 19:59:18 | 000,000,000 | ---D | C] -- C:\Programme\TrueCrypt
[2011.05.26 19:59:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
[2011.05.26 18:32:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\VMware
[2011.05.26 18:32:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\VMware
[2011.05.26 18:26:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\skypePM
[2011.05.26 18:26:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras
[2011.05.26 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Skype
[2011.05.26 18:25:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.05.26 17:49:15 | 000,000,000 | ---D | C] -- C:\Users\***\.edlohn
[2011.05.26 15:56:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.05.26 15:56:21 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011.05.26 15:55:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2011.05.26 15:53:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2011.05.26 15:51:23 | 000,127,488 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZSPOOL.DLL
[2011.05.26 15:51:23 | 000,115,200 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZLhp1020.DLL
[2011.05.26 15:51:23 | 000,061,952 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZIMF.DLL
[2011.05.26 15:51:23 | 000,049,664 | ---- | C] (Zenographics, Inc.) -- C:\Windows\SysNative\ZTAG.DLL
[2011.05.26 15:50:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eDocPrinter PDF Pro
[2011.05.26 15:50:11 | 000,000,000 | ---D | C] -- C:\Programme\ITEKSOFT
[2011.05.26 15:45:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Evernote
[2011.05.26 15:45:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2011.05.26 15:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Evernote
[2011.05.26 15:44:47 | 000,000,000 | ---D | C] -- C:\Programme\HP
[2011.05.26 15:39:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2011.05.26 15:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\theWord
[2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\The Word
[2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\ProgramData\The Word
[2011.05.26 15:17:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The Word
[2011.05.26 15:13:01 | 000,000,000 | ---D | C] -- C:\Programme\CrystalDiskMark
[2011.05.26 15:13:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskMark
[2011.05.26 13:33:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Canon
[2011.05.26 13:14:49 | 000,081,008 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmci.sys
[2011.05.26 13:14:48 | 000,068,720 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmx86.sys
[2011.05.26 13:14:48 | 000,030,832 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\VMparport.sys
[2011.05.26 13:14:28 | 000,334,448 | ---- | C] (VMware, Inc.) -- C:\Windows\SysWow64\vmnetdhcp.exe
[2011.05.26 13:14:25 | 000,404,080 | ---- | C] (VMware, Inc.) -- C:\Windows\SysWow64\vmnat.exe
[2011.05.26 13:14:24 | 000,030,320 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\vmnetuserif.sys
[2011.05.26 13:14:23 | 000,968,816 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\vnetlib64.dll
[2011.05.26 13:14:20 | 000,031,856 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\VMkbd.sys
[2011.05.26 13:14:19 | 000,038,512 | ---- | C] (VMware, Inc.) -- C:\Windows\SysNative\drivers\hcmon.sys
[2011.05.26 13:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
[2011.05.26 13:14:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\VMware
[2011.05.26 13:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\VMware
[2011.05.26 13:13:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VMware
[2011.05.26 13:08:55 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2011.05.26 13:08:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011.05.26 13:01:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2011.05.26 12:56:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011.05.26 12:56:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.05.26 12:55:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2011.05.26 12:53:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LibreOffice
[2011.05.26 12:52:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LibreOffice 3
[2011.05.26 12:43:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011.05.26 12:33:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Adobe
[2011.05.26 12:31:29 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2011.05.26 12:31:16 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2011.05.26 12:30:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2011.05.26 12:25:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\RDP6
[2011.05.26 12:22:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Macromedia
[2011.05.26 12:22:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Adobe
[2011.05.26 12:22:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2011.05.26 12:21:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.05.26 12:21:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2011.05.26 12:21:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2011.05.26 12:20:37 | 000,000,000 | R--D | C] -- C:\Users\***\Documents\Scanned Documents
[2011.05.26 12:20:37 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Fax
[2011.05.26 12:20:29 | 000,000,000 | -H-D | C] -- C:\CanoScan
[2011.05.26 12:19:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft-Maus
[2011.05.26 12:19:42 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft IntelliPoint
[2011.05.26 12:18:51 | 000,000,000 | ---D | C] -- C:\Programme\DisplayLink Core Software
[2011.05.26 12:05:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.05.26 12:05:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2011.05.26 12:05:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Google
[2011.05.26 12:04:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
[2011.05.26 12:04:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Roxio
[2011.05.26 12:04:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in
[2011.05.26 12:04:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect
[2011.05.26 12:04:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Winamp
[2011.05.26 12:04:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp
[2011.05.26 12:03:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2011.05.26 12:03:29 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.26 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.26 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.26 12:03:26 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.26 12:03:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.05.26 12:03:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.05.26 12:03:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.05.26 12:02:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.05.26 12:02:45 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.05.26 11:56:51 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2011.05.26 11:48:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2011.05.26 11:48:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2011.05.26 11:48:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Napster
[2011.05.26 11:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Napster
[2011.05.26 11:44:39 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\WISO Mein Geld
[2011.05.26 11:44:23 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2011.05.26 11:44:20 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Buhl Data Service GmbH
[2011.05.26 11:44:20 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Buhl Data Service
[2011.05.26 11:43:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Panda Security
[2011.05.26 11:42:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Panda Security
[2011.05.26 11:38:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Mein Geld 2011
[2011.05.26 11:38:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Buhl Data Service GmbH
[2011.05.26 11:37:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Buhl
[2011.05.26 11:30:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Thunderbird
[2011.05.26 11:30:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Thunderbird
[2011.05.26 11:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2011.05.26 11:29:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MozBackup
[2011.05.26 11:26:38 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Mozilla
[2011.05.26 11:26:38 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Mozilla
[2011.05.26 11:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011.05.26 11:24:29 | 000,000,000 | R--D | C] -- C:\Users\***\Dropbox
[2011.05.26 11:24:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird
[2011.05.26 11:24:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2011.05.26 11:23:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2011.05.26 11:23:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Intel Corporation
[2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\ATI
[2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ATI
[2011.05.26 11:20:29 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.05.26 11:18:39 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\InstallShield
[2011.05.26 11:17:47 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2011.05.26 11:17:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Etron Technology
[2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\ATI Technologies
[2011.05.26 11:17:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2011.05.26 11:17:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2011.05.26 11:17:10 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2011.05.26 11:17:10 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2011.05.26 11:16:38 | 000,000,000 | ---D | C] -- C:\Programme\ATI Technologies
[2011.05.26 11:16:16 | 000,000,000 | ---D | C] -- C:\ATI
[2011.05.26 11:15:05 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2011.05.26 11:15:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2011.05.26 11:15:01 | 000,000,000 | ---D | C] -- C:\Intel
[2011.05.26 11:06:30 | 000,000,000 | ---D | C] -- C:\ProgramData\TP-LINK
[2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\Searches
[2011.05.26 11:02:06 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.05.26 11:02:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Identities
[2011.05.26 11:01:58 | 000,000,000 | R--D | C] -- C:\Users\***\Contacts
[2011.05.26 11:01:58 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\VirtualStore
[2011.05.26 11:01:55 | 000,000,000 | --SD | C] -- C:\Users\***\AppData\Roaming\Microsoft
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Videos
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Saved Games
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Pictures
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Music
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Links
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Favorites
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Downloads
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Documents
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\Desktop
[2011.05.26 11:01:55 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Vorlagen
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Verlauf
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Temporary Internet Files
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Startmenü
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\SendTo
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Recent
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Netzwerkumgebung
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Lokale Einstellungen
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Videos
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Musik
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Eigene Dateien
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Documents\Eigene Bilder
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Druckumgebung
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Cookies
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Anwendungsdaten
[2011.05.26 11:01:55 | 000,000,000 | -HSD | C] -- C:\Users\***\Anwendungsdaten
[2011.05.26 11:01:55 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData
[2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Temp
[2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Microsoft
[2011.05.26 11:01:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Recovery
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Programme
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2011.05.26 11:01:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2011.05.26 11:01:51 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.05.26 10:58:10 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2011.05.26 10:58:02 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.23 22:10:08 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.23 22:10:08 | 000,015,152 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.23 22:10:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.23 22:08:38 | 001,528,372 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.06.23 22:08:38 | 000,663,740 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.06.23 22:08:38 | 000,625,622 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.06.23 22:08:38 | 000,134,254 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.06.23 22:08:38 | 000,110,644 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.06.23 22:06:08 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.23 22:03:06 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Scheduled scanning task.job
[2011.06.23 22:03:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.23 22:03:03 | 3207,610,368 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.23 21:53:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2011.06.23 21:51:59 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2011.06.23 20:19:01 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2011.06.23 14:12:53 | 000,042,664 | ---- | M] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2011.06.23 14:08:52 | 000,001,158 | ---- | M] () -- C:\Users\Public\Desktop\F-Secure Internet Security 2011.lnk
[2011.06.23 14:08:35 | 001,550,624 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.23 14:08:26 | 000,046,664 | ---- | M] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fses.sys
[2011.06.23 14:08:24 | 000,095,784 | ---- | M] (F-Secure Corporation) -- C:\Windows\SysNative\drivers\fsdfw.sys
[2011.06.23 12:40:16 | 000,049,752 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.06.23 12:40:14 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2011.06.23 12:38:40 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.06.23 11:54:31 | 000,000,036 | ---- | M] () -- C:\Users\***\AppData\Local\housecall.guid.cache
[2011.06.23 11:26:00 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.06.22 23:21:02 | 000,441,240 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.06.20 10:55:57 | 000,000,406 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011.06.10 11:50:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.06.03 18:33:30 | 000,002,288 | ---- | M] () -- C:\Users\***\ClientEditor.properties
[2011.06.03 15:54:40 | 000,000,907 | ---- | M] () -- C:\Users\***\Desktop\Downloads.lnk
[2011.06.02 13:44:02 | 000,290,954 | ---- | M] () -- C:\Users\***\Desktop\TCPView.zip
[2011.05.30 10:24:33 | 000,011,849 | ---- | M] () -- C:\Users\***\Desktop\EDLohn.jnlp
[2011.05.30 07:16:44 | 001,377,856 | ---- | M] (VirusBuster Kft.) -- C:\Windows\SysNative\drivers\vbcorent-x64.sys
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011.05.29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.05.27 16:10:19 | 000,000,498 | ---- | M] () -- C:\Users\***\Desktop\Dropbox Crypt.lnk
[2011.05.27 12:35:54 | 000,001,193 | ---- | M] () -- C:\Users\***\Desktop\Dropbox.lnk
[2011.05.27 11:38:45 | 000,000,999 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011.05.26 19:59:18 | 000,230,352 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.05.26 18:26:37 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2011.05.26 15:58:09 | 000,001,235 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2011.05.26 15:33:35 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2011.05.26 15:33:35 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2011.05.26 15:15:20 | 000,000,079 | ---- | M] () -- C:\Users\***\AppData\Local\CrystalDiskMark30.ini
[2011.05.26 13:14:18 | 000,001,024 | ---- | M] () -- C:\.rnd
[2011.05.26 12:19:56 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2011.05.26 11:19:30 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2011.05.26 11:08:22 | 000,769,024 | ---- | M] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\arusb_win7x.sys
[2011.05.26 11:00:01 | 000,054,699 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011.05.26 11:00:01 | 000,054,699 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011.05.26 10:58:33 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.23 21:51:59 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2011.06.23 21:51:10 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2011.06.23 16:12:20 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2011.06.23 14:22:06 | 000,000,530 | ---- | C] () -- C:\Windows\tasks\Scheduled scanning task.job
[2011.06.23 14:08:52 | 000,001,158 | ---- | C] () -- C:\Users\Public\Desktop\F-Secure Internet Security 2011.lnk
[2011.06.23 14:08:42 | 000,042,664 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2011.06.23 12:38:40 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.06.23 11:54:31 | 000,000,036 | ---- | C] () -- C:\Users\***\AppData\Local\housecall.guid.cache
[2011.06.23 11:26:00 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.06.20 10:55:48 | 000,000,406 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.06.15 11:56:35 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.06.14 12:09:16 | 000,001,110 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
[2011.06.11 22:06:08 | 000,001,565 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2011.06.10 11:50:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011.06.03 15:55:31 | 000,001,181 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.06.03 15:54:40 | 000,000,907 | ---- | C] () -- C:\Users\***\Desktop\Downloads.lnk
[2011.06.02 13:44:09 | 000,290,954 | ---- | C] () -- C:\Users\***\Desktop\TCPView.zip
[2011.05.30 10:24:33 | 000,011,849 | ---- | C] () -- C:\Users\***\Desktop\EDLohn.jnlp
[2011.05.27 16:10:05 | 000,000,498 | ---- | C] () -- C:\Users\***\Desktop\Dropbox Crypt.lnk
[2011.05.27 12:35:54 | 000,001,193 | ---- | C] () -- C:\Users\***\Desktop\Dropbox.lnk
[2011.05.27 11:38:45 | 000,000,999 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011.05.26 18:58:28 | 000,002,288 | ---- | C] () -- C:\Users\***\ClientEditor.properties
[2011.05.26 18:26:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.05.26 15:58:09 | 000,001,235 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2011.05.26 15:51:23 | 000,574,100 | ---- | C] () -- C:\Windows\SysNative\hp1022n.img
[2011.05.26 15:51:23 | 000,569,344 | ---- | C] () -- C:\Windows\SysNative\ZSHP1020.EXE
[2011.05.26 15:51:23 | 000,206,768 | ---- | C] () -- C:\Windows\SysNative\hp1022.img
[2011.05.26 15:51:23 | 000,128,380 | ---- | C] () -- C:\Windows\SysNative\hp1020.img
[2011.05.26 15:51:23 | 000,010,698 | ---- | C] () -- C:\Windows\SysNative\ZSHP1020.CHM
[2011.05.26 15:33:35 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2011.05.26 15:33:35 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2011.05.26 15:13:03 | 000,000,079 | ---- | C] () -- C:\Users\***\AppData\Local\CrystalDiskMark30.ini
[2011.05.26 13:14:18 | 000,001,024 | ---- | C] () -- C:\.rnd
[2011.05.26 13:14:15 | 001,550,624 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.26 12:31:37 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2011.05.26 12:31:29 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2011.05.26 12:31:18 | 000,146,389 | ---- | C] () -- C:\Windows\SysWow64\printmanagement.msc
[2011.05.26 12:31:18 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2011.05.26 12:31:18 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2011.05.26 12:31:18 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2011.05.26 12:19:56 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01009.Wdf
[2011.05.26 12:05:04 | 000,001,128 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.26 12:05:04 | 000,001,124 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.26 11:26:36 | 000,001,153 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.05.26 11:19:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.05.26 11:02:09 | 000,001,405 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011.05.26 11:02:06 | 000,001,439 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.05.26 10:59:55 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2011.05.26 10:59:54 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2011.05.26 10:58:33 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011.05.26 10:58:02 | 3207,610,368 | -HS- | C] () -- C:\hiberfil.sys
[2011.03.17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.02.11 23:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2011.01.04 16:52:46 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\epdf0407.dll
[2011.01.04 16:41:52 | 000,139,264 | ---- | C] () -- C:\Windows\SysWow64\epdf0406.dll
[2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011.05.27 12:25:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG10
[2011.05.26 11:44:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2011.05.26 11:44:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service GmbH
[2011.05.26 13:33:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon
[2011.06.23 22:09:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.06.23 11:04:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\f-secure
[2011.06.20 10:31:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Internetmanager
[2011.05.26 12:53:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice
[2011.05.26 15:56:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.05.26 11:43:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Panda Security
[2011.06.23 16:09:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RDP6
[2011.06.03 16:15:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2011.06.23 21:50:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\The Word
[2011.05.26 11:30:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2011.05.27 09:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TrueCrypt
[2011.06.11 22:08:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Wireshark
[2009.07.14 07:08:49 | 000,016,758 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.06.23 22:03:06 | 000,000,530 | ---- | M] () -- C:\Windows\Tasks\Scheduled scanning task.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.06.02 14:05:22 | 000,000,000 | -H-D | M] -- C:\$AVG
[2011.06.04 13:40:25 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.05.26 11:16:16 | 000,000,000 | ---D | M] -- C:\ATI
[2011.05.26 12:20:29 | 000,000,000 | -H-D | M] -- C:\CanoScan
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.06.23 20:23:23 | 000,000,000 | ---D | M] -- C:\Dropbox Backup_ohne VS
[2011.05.26 11:15:01 | 000,000,000 | ---D | M] -- C:\Intel
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.06.23 19:47:36 | 000,000,000 | R--D | M] -- C:\Programme
[2011.06.23 20:05:17 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.06.23 13:57:08 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.05.26 11:01:52 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.05.27 12:23:31 | 000,000,000 | ---D | M] -- C:\SMCLpav
[2011.06.23 22:10:51 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.23 13:40:19 | 000,000,000 | ---D | M] -- C:\Temp
[2011.06.23 16:09:57 | 000,000,000 | ---D | M] -- C:\tmprdp
[2011.06.04 13:40:23 | 000,000,000 | R--D | M] -- C:\Users
[2011.06.23 14:49:54 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE >
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 04:17:10 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.20 05:24:46 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
 
< MD5 for: REGEDIT.EXE >
[2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
 
< MD5 for: USERINIT.EXE >
[2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 04:17:50 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 05:25:26 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE >
[2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 05:25:32 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
< >
 
[I]< End of report >
         
--- --- ---

Alt 24.06.2011, 09:55   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei - Standard

Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei



Zitat:
„Tracking Cookies“ „infiziert“. Ist das überhaupt vermeidbar bei normalem Surfverhalten?
Nicht wirklich. Browser sind so eingestellt, dass Cookies automatisch angenommen werden und eigentlich jede Seite setzt Cookies ein. Man kann aber den Browser so einstellen, dass immer nachgefragt wird. So könnte man zB nur dann Cookies selbst nach Nachfrage akzeptieren, wenn man auf Seiten ist, wo das erwünscht, zB Cookies ja bei Trojaner-Board für den automatischen Login, sodass man sich nicht immer neu einloggen muss durch eingabe von user+pass
__________________

__________________

Antwort

Themen zu Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei
64-bit, 7-zip, ad-aware, adware, antivirus, avg, bho, c:\hiberfil.sys, c:\windows\system32\rundll32.exe, cache.dat, diagnostics, druck, drvstore, eigene bilder, eraser, error, ezsidmv.dat, firefox, firefox laggt, format, google, google earth, hiberfil.sys, hkcu\~\run values retrieved., infizierte dateien, installation, langs, laufzeit, logfile, malwarebytes trojan.agent, mozilla, mozilla thunderbird, netzwerkumgebung, object, performance, prefetch, problem, recycle.bin, registry, rundll, scan, searchplugins, security, shell32.dll, software, spyware, start menu, system, syswow64, trojan.agent, usb, webcheck, windows xp, wiso



Ähnliche Themen: Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei


  1. Malwarebytes meldet "Trojan.Agent.Ed"
    Plagegeister aller Art und deren Bekämpfung - 18.04.2015 (17)
  2. Windows 7 findet "einige" Viren (MBAM)
    Mülltonne - 08.01.2014 (2)
  3. WIN 7: Malwarebytes Anti-Malware meldet "PUM.UserWLoad" & "Trojan.Ransom"
    Log-Analyse und Auswertung - 04.09.2013 (21)
  4. Nach Windows Updates "Frisches" Benutzerkonto, keine Dokumente mehr. MBAM findet PUP.LoadTube
    Plagegeister aller Art und deren Bekämpfung - 06.05.2013 (22)
  5. Malwarebytes findet "Trojan.Agent" - dieser ist aber nach löschen jedesmal wieder da
    Plagegeister aller Art und deren Bekämpfung - 01.01.2013 (14)
  6. Malwarebytes "blockt" immer einer chinesische IP ... Ausgehend .. findet aber nix ..
    Plagegeister aller Art und deren Bekämpfung - 27.10.2012 (10)
  7. Avira und MBAM melden "Trojan Banker und Trojan BHO"
    Plagegeister aller Art und deren Bekämpfung - 23.07.2012 (2)
  8. malwarebytes findet 42 "PUP.Blabblers" Viren beim Vollscan
    Plagegeister aller Art und deren Bekämpfung - 19.07.2012 (1)
  9. Search completion automatisches redirect, malwarebytes findet "PUP.VShareRedir"
    Log-Analyse und Auswertung - 27.02.2012 (25)
  10. Malwarebytes findet " PUP.VShareRedir "Registry bitte Logfile auswerten!
    Log-Analyse und Auswertung - 09.01.2012 (17)
  11. Trojan Hunt findet die Trojaner sinowal.727 und agent.28. Malwarebytes findet nichts?
    Plagegeister aller Art und deren Bekämpfung - 15.11.2011 (1)
  12. MBAM findet "Adware.RelevantKnowledge"
    Log-Analyse und Auswertung - 01.10.2011 (5)
  13. MBAM findet Trojaner in der "XPBurner"-CD-Brennsoftware - Fehlalarm?
    Plagegeister aller Art und deren Bekämpfung - 21.04.2011 (2)
  14. Malwarebytes findet "tyrdwirh.sys" und kann diese nicht löschen
    Plagegeister aller Art und deren Bekämpfung - 25.01.2010 (1)
  15. AVG findet "Trojan horse Generic15.EAM", Antimalware "Trojan.Agent" + "Rootkit.Agent"
    Plagegeister aller Art und deren Bekämpfung - 03.11.2009 (13)
  16. MBAM findet Trojan.Agent in C:\Windows\System32\WinSys2.exe
    Log-Analyse und Auswertung - 04.05.2009 (7)
  17. Hilfe! "Trojan.Agent" und "Rogue.Residue" auf dem Rechner.
    Plagegeister aller Art und deren Bekämpfung - 02.05.2009 (13)

Zum Thema Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei - Guten Tag, vorab schon einmal vielen Dank für alle Hilfe. Ich habe folgendes Problem: Ich habe mit Malwarebytes Antimalware gestern Abend (22.06.2011) einen Scan gemacht und er hat 3 infizierte - Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei...
Archiv
Du betrachtest: Malwarebytes Antimalware findet "Trojan.Agent", MBAM/OTL Logs mit dabei auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.