| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.10.2011, 22:32
| #1 |
| |  www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok? Hallo, habe mir über facebook (über den o.g. Link) wohl auch etwas eingefangen. Das System startete zunächst nicht mehr. Habe meine nicht ausführbaren Daten bereits per "Ubuntu" gesichert und das System per Recovery Partition in den Auslieferzustand zurück gesetzt. Dachte alles wäre ok, aber das System ist sehr träge und Seiten werden über google nicht korrekt aufgerufen. Habe das System gerade erneut neu aufgesetzt und bisher keine W-Lan Verbindung aufgebaut und lediglich mit einem zuvor formartierten Stick Avira, Defogger und OTL übertragen (keine weiteren oder zuvor gesicherten Dateien) Ein Scan mit Avira ergab keine Ergebnisse. Als Anlage der Berichte von Avira, Defogger und unten der Bericht von OTL. Hat der Schädling die Neuinstallation überlebt? OTL logfile created on: 13.10.2011 23:09:38 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Stefan\Desktop 64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,97 Gb Total Physical Memory | 1,22 Gb Available Physical Memory | 62,16% Memory free 3,93 Gb Paging File | 2,92 Gb Available in Paging File | 74,21% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 135,95 Gb Total Space | 116,59 Gb Free Space | 85,76% Space Free | Partition Type: NTFS Drive D: | 136,04 Gb Total Space | 135,30 Gb Free Space | 99,45% Space Free | Partition Type: NTFS Drive F: | 983,73 Mb Total Space | 902,27 Mb Free Space | 91,72% Space Free | Partition Type: FAT Computer Name: STEFAN-PC | User Name: Stefan | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.10.13 22:43:28 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Stefan\Desktop\OTL.exe PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe PRC - [2009.11.18 00:18:20 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2009.11.18 00:18:10 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe PRC - [2009.07.14 03:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\PING.EXE ========== Modules (No Company Name) ========== MOD - [2009.11.18 00:16:40 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.03.30 16:12:10 | 001,558,016 | ---- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.06.03 23:53:52 | 000,030,016 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Programme\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService) SRV - [2010.06.02 00:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU) SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2010.01.15 23:08:38 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2009.11.18 00:18:20 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.05.15 17:33:20 | 002,682,616 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Programme\Fingerprint Sensor\ATService.exe -- (ATService) SRV - [2009.05.13 04:06:54 | 000,502,784 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer SmartBoot\ASLSvc.exe -- (ASLSvc) SRV - [2009.02.18 02:01:04 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe -- (ETService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.10.11 15:00:01 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.10.11 15:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2009.12.31 12:04:57 | 000,360,712 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2009.11.06 09:52:52 | 007,773,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.09.23 03:46:18 | 000,066,304 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2009.09.23 03:32:39 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2009.09.23 03:32:33 | 000,187,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2008.03.12 01:31:54 | 000,025,120 | ---- | M] (Acer, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\eLock2burnerlockdriver.sys -- (eLock2BurnerLockDriver) DRV:64bit: - [2008.03.12 00:03:00 | 000,100,384 | ---- | M] (Acer, Inc.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eLock2FSCTLDriver.sys -- (eLock2FSCTLDriver) DRV:64bit: - [2007.11.15 18:00:00 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011.10.13 21:38:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.10.13 21:38:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.10.13 21:38:11 | 000,000,000 | ---D | M] O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [Acer PowerSaver] C:\Programme\Acer\Acer PowerSaver\PowerSaverTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [Acer SmartBoot] C:\Programme\Acer\Acer SmartBoot\ASLTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [AutoLockProcess] C:\Programme\Acer\Empowering Technology\eLock\autolockprocess\AutoLockProcess.exe (Acer Inc.) O4:64bit: - HKLM..\Run: [EmbassySecurityCheck] C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe (Wave Systems Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [WavXMgr] "C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" File not found O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O30:64bit: - LSA: Authentication Packages - (wvauth) - C:\Windows\SysNative\wvauth.dll (Wave Systems Corp.) O30 - LSA: Authentication Packages - (wvauth) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.10.14 07:22:17 | 000,000,000 | ---D | C] -- C:\Windows\de-DE [2011.10.14 07:22:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer [2011.10.14 07:22:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE [2011.10.14 07:22:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de [2011.10.14 07:22:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407 [2011.10.14 07:22:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de [2011.10.14 07:22:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407 [2011.10.14 07:16:39 | 000,000,000 | ---D | C] -- C:\Windows\NAPP_Dism_Log [2011.10.13 23:03:21 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\Stefan\Desktop\OTL.exe [2011.10.13 22:37:26 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Roaming\Avira [2011.10.13 22:37:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.10.13 22:36:45 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.10.13 22:36:45 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.10.13 22:36:45 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.10.13 22:36:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.10.13 22:36:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2011.10.13 22:10:51 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Roaming\Macromedia [2011.10.13 22:10:27 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Virtual Machines [2011.10.13 22:10:27 | 000,000,000 | R--D | C] -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.10.13 22:10:27 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Searches [2011.10.13 22:10:27 | 000,000,000 | R--D | C] -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.10.13 22:10:17 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Roaming\Identities [2011.10.13 22:10:14 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Contacts [2011.10.13 22:10:12 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Local\VirtualStore [2011.10.13 22:09:54 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Local\Acer PowerSaver [2011.10.13 22:09:29 | 000,000,000 | ---D | C] -- C:\Program Files\Acer Accessory Store [2011.10.13 22:08:07 | 000,000,000 | --SD | C] -- C:\Users\Stefan\AppData\Roaming\Microsoft [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Videos [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Saved Games [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Pictures [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Music [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Links [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Favorites [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Downloads [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Documents [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\Desktop [2011.10.13 22:08:07 | 000,000,000 | R--D | C] -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Vorlagen [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\AppData\Local\Verlauf [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\AppData\Local\Temporary Internet Files [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Startmenü [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\SendTo [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Recent [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Netzwerkumgebung [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Lokale Einstellungen [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Documents\Eigene Videos [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Documents\Eigene Musik [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Eigene Dateien [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Documents\Eigene Bilder [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Druckumgebung [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Cookies [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\AppData\Local\Anwendungsdaten [2011.10.13 22:08:07 | 000,000,000 | -HSD | C] -- C:\Users\Stefan\Anwendungsdaten [2011.10.13 22:08:07 | 000,000,000 | -H-D | C] -- C:\Users\Stefan\AppData [2011.10.13 22:08:07 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Local\Temp [2011.10.13 22:08:07 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Local\Microsoft [2011.10.13 22:08:07 | 000,000,000 | ---D | C] -- C:\Users\Stefan\AppData\Roaming\Media Center Programs [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Programme [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.10.13 22:07:52 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.10.13 21:46:34 | 000,000,000 | ---D | C] -- C:\Program Files\newfolder10 [2011.10.13 21:46:19 | 000,000,000 | ---D | C] -- C:\Program Files\newfolder8 [2011.10.13 21:45:30 | 000,000,000 | ---D | C] -- C:\Program Files\Fingerprint Sensor [2011.10.13 21:44:52 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\BioAPIFFDB [2011.10.13 21:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sicherheit durch Wave Systems [2011.10.13 21:44:44 | 000,000,000 | ---D | C] -- C:\Program Files\Wave Systems Corp [2011.10.13 21:44:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Test [2011.10.13 21:44:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Wave Systems Corp [2011.10.13 21:43:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2011.10.13 21:42:13 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2011.10.13 21:42:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live SkyDrive [2011.10.13 21:42:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2011.10.13 21:41:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2011.10.13 21:41:35 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2011.10.13 21:40:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live [2011.10.13 21:40:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2011.10.13 21:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\Windows XP Mode [2011.10.13 21:38:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft [2011.10.13 21:38:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSN Toolbar [2011.10.13 21:37:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bing Bar Installer [2011.10.13 21:37:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcerSystem [2011.10.13 21:37:09 | 000,000,000 | ---D | C] -- C:\book [2011.10.13 21:32:09 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2011.10.13 21:32:09 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2011.10.13 21:32:02 | 002,714,112 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll [2011.10.13 21:32:02 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2011.10.13 21:32:02 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2011.10.13 21:32:02 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2011.10.13 21:32:02 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2011.10.13 21:32:02 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2011.10.13 21:32:02 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2011.10.13 21:32:02 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2011.10.13 21:32:02 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2011.10.13 21:32:02 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2011.10.13 21:32:02 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2011.10.13 21:32:01 | 002,191,872 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll [2011.10.13 21:32:01 | 000,321,536 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2011.10.13 21:32:01 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2011.10.13 21:32:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2011.10.13 21:32:00 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2011.10.13 21:31:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2011.10.13 21:29:31 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.10.13 21:29:07 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel [2011.10.13 21:29:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel [2011.10.13 21:29:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel [2011.10.13 21:27:06 | 000,000,000 | ---D | C] -- C:\Windows\CSC [2011.10.13 21:26:19 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2011.10.14 07:22:02 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat [2011.10.14 07:22:02 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat [2011.10.14 07:21:23 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2011.10.14 07:21:21 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2011.10.14 07:21:21 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2011.10.14 07:21:21 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2011.10.14 07:16:39 | 000,011,453 | ---- | M] () -- C:\Windows\ChangeLang_Done.tag [2011.10.13 23:04:08 | 000,000,000 | ---- | M] () -- C:\Users\Stefan\defogger_reenable [2011.10.13 23:01:17 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.10.13 23:01:17 | 000,645,502 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.10.13 23:01:17 | 000,607,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.10.13 23:01:17 | 000,126,822 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.10.13 23:01:17 | 000,103,908 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.10.13 22:49:47 | 000,009,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.10.13 22:49:47 | 000,009,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.10.13 22:43:28 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Stefan\Desktop\OTL.exe [2011.10.13 22:42:56 | 000,050,477 | ---- | M] () -- C:\Users\Stefan\Desktop\Defogger.exe [2011.10.13 22:41:13 | 000,001,024 | ---- | M] () -- C:\.rnd [2011.10.13 22:41:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.10.13 22:40:57 | 1583,276,032 | -HS- | M] () -- C:\hiberfil.sys [2011.10.13 22:37:06 | 000,002,074 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.10.13 22:35:18 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.10.13 22:09:31 | 000,001,970 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.10.13 22:07:35 | 000,054,699 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.10.13 22:07:35 | 000,054,699 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2011.10.13 21:36:37 | 000,014,682 | ---- | M] () -- C:\Windows\SysNative\results.xml [2011.10.13 21:35:42 | 000,283,104 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.10.13 21:34:30 | 000,000,003 | ---- | M] () -- C:\Windows\SysNative\PLD_Framework.cmd [2011.10.11 15:00:01 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.10.11 15:00:01 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys ========== Files Created - No Company Name ========== [2011.10.14 07:25:36 | 000,011,453 | ---- | C] () -- C:\Windows\ChangeLang_Done.tag [2011.10.14 07:22:44 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat [2011.10.14 07:22:43 | 000,645,502 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat [2011.10.14 07:22:43 | 000,126,822 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat [2011.10.14 07:22:43 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat [2011.10.13 23:04:08 | 000,000,000 | ---- | C] () -- C:\Users\Stefan\defogger_reenable [2011.10.13 23:03:16 | 000,050,477 | ---- | C] () -- C:\Users\Stefan\Desktop\Defogger.exe [2011.10.13 22:41:13 | 000,001,024 | ---- | C] () -- C:\.rnd [2011.10.13 22:37:06 | 000,002,074 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2011.10.13 22:35:18 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.10.13 22:10:35 | 000,001,413 | ---- | C] () -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.10.13 22:10:29 | 000,001,447 | ---- | C] () -- C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.10.13 22:09:31 | 000,001,970 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.10.13 21:45:59 | 000,041,984 | ---- | C] () -- C:\Windows\SysNative\TSP1_x64.dll [2011.10.13 21:40:40 | 000,002,435 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk [2011.10.13 21:38:12 | 000,001,384 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Default Manager.lnk [2011.10.13 21:36:37 | 000,014,682 | ---- | C] () -- C:\Windows\SysNative\results.xml [2011.10.13 21:34:30 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\PLD_Framework.cmd [2011.10.13 21:26:20 | 1583,276,032 | -HS- | C] () -- C:\hiberfil.sys [2010.09.10 06:17:39 | 000,982,224 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2010.09.10 06:17:39 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll [2010.09.10 06:17:39 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll [2010.09.10 06:17:39 | 000,092,284 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2010.09.10 06:17:38 | 000,439,336 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2010.04.12 15:17:04 | 001,019,904 | ---- | C] () -- C:\Windows\SysWow64\DemoLicense.dll [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2009.07.14 07:08:49 | 000,004,118 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.10.13 22:10:13 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.10.13 21:37:25 | 000,000,000 | ---D | M] -- C:\book [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.10.13 22:07:52 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.10.13 21:28:45 | 000,000,000 | ---D | M] -- C:\Intel [2011.10.13 22:10:03 | 000,000,000 | -H-D | M] -- C:\OEM [2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.10.13 22:41:48 | 000,000,000 | R--D | M] -- C:\Program Files [2011.10.13 22:41:48 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.10.13 22:36:43 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.10.13 22:07:52 | 000,000,000 | -HSD | M] -- C:\Programme [2011.10.13 22:07:52 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.10.13 23:10:30 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.10.13 22:08:06 | 000,000,000 | R--D | M] -- C:\Users [2011.10.13 21:57:28 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2010.07.17 22:42:27 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2010.07.17 22:42:27 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2010.02.04 13:00:46 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2010.07.17 22:42:27 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe [2010.07.17 22:42:27 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2010.02.04 13:00:46 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.07.17 22:42:27 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2010.02.04 13:00:46 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2010.07.17 22:42:27 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2010.02.04 13:00:46 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2010.07.17 22:42:28 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2010.07.17 22:42:28 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe [2010.07.17 22:42:28 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > < End of report > Vielen Dank Stefan |
|
20.10.2011, 19:22
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok? Hier => http://www.trojaner-board.de/104121-...partition.html
__________________willst du eine Neuinstallation des Betriebssystems. Kannst du dich mal entscheiden ob Neuinstallation oder Bereinigung? Dazu musst du auch nicht immer in den Erinnerungsstrang posten. Der ist nur dafür da, wenn jemand übersehen wurde und nicht wirklich für die, die unentschlossen sind. 
__________________ |
|
20.10.2011, 20:56
| #3 |
| | www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok? Hallo Arne,
__________________ich verstehe deinen "Einwand" nicht, versuche mich aber mal anders auszudrücken: Ich habe mein System über die Recovery Funktion bereits neu installiert. Ich möchte nun wissen, ob mein System seuchenfrei ist. Wenn ja, alles super und ich kann wieder online gehen. Wenn nein, dann ist klar, daß ich das System komplett neu aufsetzen muß, also inkl. der Recovery Partition. Ich denke es ist nachvolziehbar, dass sich eine Laie wie ich diese 2. Möglichkeit ersparen möchte. 1. Weil es vielleicht keine Notwendigkeit gibt und 2. auch weil eure Anleitung zur Neuinstallation keinen Bezug auf die "versteckte" Partition nimmt. Das es sinnvoll ist, sich die DVD zu brennen steht außer Frage, ändert aber meine o.g. Situation nicht. Vielen Dank Stefan |
|
20.10.2011, 20:59
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok?Zitat:
Wenn du recoverst ist das System idR wieder völlig frei von Schädlingen, es sei denn der MBR wurde nicht neu gemacht wenn er auch schädlich war oder du hast die alten infizierten Programme auf dem recoverten System erneut ausgeführt. Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu www.allezax.com img Windows 7 (64-bit / Recoery Partition) neu installiert System nun ok? |
| 64-bit, anlage, antivir, autorun, avg, avira, bho, bootsektor, c:\windows\system32\rundll32.exe, explorer, facebook, firefox, format, google, logfile, neu aufgesetzt, neuinstallation, realtek, registry, rundll, scan, schädling, seiten, server, sicherheit, software, stick, symantec, system, version=1.0, webcheck, windows, windows 7, windows xp, winlogon.exe |
