| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Weißer Bildschirm, auch abgesicherter Modus funktioniert nichtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.03.2012, 21:07
| #16 |
 |  Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht okay. nun steht hier folgendes: select user profile: LocalService NetworkService X systemprofile Und dadrunter: Automaically Local All Remaining User? Den haken habe ich weggemacht. aber welches user profile soll ich auswählen? |
|
18.03.2012, 21:21
| #17 |
| /// Malware-holic   | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht müsste system profile sein
__________________
__________________ |
|
18.03.2012, 21:38
| #18 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht okay. bin in otl drin. aber wie krieg ich die diese textbox da eingefügt?
__________________internetverbindung krieg ich nicht hin und einen usb-stick erkennt er nicht.. |
|
18.03.2012, 22:07
| #19 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht das wurde mir jetyt angezeigt. ich hoffe, dass sit alles richtig so und hilft dir weiter. ich danke dir fuer deine hilfe! Code:
ATTFilter OTL logfile created on: 3/18/2012 10:43:40 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.34 Mb Free Space | 74.35% Space Free | Partition Type: NTFS
Drive D: | 195.31 Gb Total Space | 66.96 Gb Free Space | 34.28% Space Free | Partition Type: NTFS
Drive E: | 260.80 Gb Total Space | 91.42 Gb Free Space | 35.05% Space Free | Partition Type: NTFS
Drive F: | 3.72 Gb Total Space | 1.71 Gb Free Space | 45.87% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2010/09/22 13:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/08/12 17:11:54 | 000,522,240 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV:64bit: - [2009/07/27 16:27:07 | 000,203,264 | ---- | M] (AMD) [Auto] -- E:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/24 00:34:31 | 000,189,984 | ---- | M] (Realtek Semiconductor) [Auto] -- E:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe -- (RtkAudioService)
SRV:64bit: - [2009/07/16 03:36:56 | 000,411,496 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/01 12:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto] -- E:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/06/26 08:56:10 | 000,357,672 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr)
SRV:64bit: - [2009/06/26 08:35:04 | 000,468,264 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)
SRV:64bit: - [2009/06/17 12:50:30 | 000,110,888 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper)
SRV - [2012/02/28 12:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto] -- E:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011/11/30 18:23:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- E:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/07/21 06:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/06 07:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/04/01 06:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand] -- E:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 06:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 05:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand] -- E:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/07/27 10:58:40 | 000,091,432 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe -- (SOHPlMgr)
SRV - [2009/07/27 10:58:38 | 000,427,304 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe -- (SOHDms)
SRV - [2009/07/27 10:58:38 | 000,075,048 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs)
SRV - [2009/07/27 10:58:38 | 000,070,952 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe -- (SOHDBSvr)
SRV - [2009/07/27 10:58:36 | 000,120,104 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp)
SRV - [2009/07/23 04:39:38 | 000,313,264 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw)
SRV - [2009/07/23 04:39:38 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service)
SRV - [2009/07/23 04:39:36 | 000,206,336 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc)
SRV - [2009/07/22 09:03:04 | 000,642,920 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)
SRV - [2009/07/01 05:49:34 | 000,204,648 | ---- | M] (Sony Corporation) [Auto] -- E:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2009/06/26 05:25:36 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto] -- E:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)
SRV - [2009/06/26 05:25:24 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand] -- E:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 13:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/09/18 04:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto] -- E:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
SRV - [2008/08/07 06:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand] -- E:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2007/01/10 23:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto] -- E:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)
SRV - [2007/01/04 13:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto] -- E:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2011/08/02 12:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/21 06:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/21 06:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/05/13 10:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 05:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/09/14 08:03:11 | 000,314,016 | ---- | M] () [Kernel | Auto] -- E:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2010/09/14 08:03:11 | 000,043,680 | ---- | M] () [Kernel | Auto] -- E:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010/09/14 07:43:22 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- E:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/04/19 14:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2010/02/03 09:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009/10/20 14:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto] -- E:\Windows\System32\drivers\npf.sys -- (NPF)
DRV:64bit: - [2009/08/04 21:22:40 | 000,139,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV:64bit: - [2009/08/04 21:20:51 | 007,345,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/08/03 16:06:34 | 000,250,928 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2009/07/31 16:29:11 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/07/31 16:14:14 | 000,076,288 | ---- | M] (REDC) [Kernel | Auto] -- E:\Windows\system32\DRIVERS\risdsn64.sys -- (risdptsk)
DRV:64bit: - [2009/07/31 16:13:51 | 000,086,528 | ---- | M] (REDC) [Kernel | Auto] -- E:\Windows\system32\DRIVERS\rimssn64.sys -- (rimsptsk)
DRV:64bit: - [2009/07/31 16:02:03 | 000,393,216 | ---- | M] (Marvell) [Kernel | On_Demand] -- E:\Windows\System32\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009/07/27 16:27:10 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/07/24 01:24:03 | 000,201,472 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
DRV:64bit: - [2009/06/11 16:19:09 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\SFEP.sys -- (SFEP)
DRV:64bit: - [2009/06/10 17:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 17:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 17:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/05 16:04:10 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NETw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009/05/26 08:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV:64bit: - [2009/05/20 06:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- E:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007/04/16 14:51:50 | 000,014,112 | R--- | M] (InterVideo) [Kernel | Auto] -- E:\Windows\System32\drivers\regi.sys -- (regi)
DRV:64bit: - [2007/04/11 10:35:30 | 000,056,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2007/04/11 10:35:22 | 000,053,520 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/07/28 20:55:42 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto] -- E:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 80 DE E2 36 FC CB 01 [binary data]
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\Sebastian_Rosner_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: E:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@gamersfirst.com/LiveLauncher: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: E:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/03/11 14:37:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/14 07:05:02 | 000,000,000 | ---D | M]
[2010/05/31 12:17:25 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
[2009/12/02 04:31:53 | 000,001,392 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009/12/02 04:31:53 | 000,002,344 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2009/12/02 04:31:53 | 000,006,805 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2009/12/02 04:31:53 | 000,001,178 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2009/12/02 04:31:53 | 000,000,801 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {09628AAA-66AD-4FA2-82E2-698185B66463} - No CLSID value found.
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - E:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - E:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4:64bit: - HKLM..\Run: [Apoint] E:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [IAAnotif] E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] E:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [APSDaemon] E:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ISBMgr.exe] E:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [iTunesHelper] File not found
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] E:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [MarketingTools] E:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe (Sony Corporation)
O4 - HKLM..\Run: [PC Auto Shutdown] File not found
O4 - HKLM..\Run: [Samsung PanelMgr] E:\Windows\Samsung\PanelMgr\ssmmgr.exe ()
O4 - HKLM..\Run: [StartCCC] E:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrayServer] File not found
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Sebastian_Rosner_ON_E..\Run: [DAEMON Tools Lite] E:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\Sebastian_Rosner_ON_E..\Run: [EPSON Stylus DX4400 Series] File not found
O4 - HKU\Sebastian_Rosner_ON_E..\Run: [ICQ] File not found
O4 - HKU\Sebastian_Rosner_ON_E..\Run: [K3aRyluP6SiCkoR] E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Sebastian_Rosner_ON_E Winlogon: Shell - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O20 - HKU\Sebastian_Rosner_ON_E Winlogon: UserInit - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - E:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX:64bit: >{E180241B-EB76-4C34-83A1-489F6DEE2BB7} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX: >{E180241B-EB76-4C34-83A1-489F6DEE2BB7} - RunDLL32 IEDKCS32.DLL,BrandIE4 CUSTOM
========== Files/Folders - Created Within 30 Days ==========
[2012/03/13 19:15:27 | 000,308,224 | ---- | C] (All Alex,Inc) -- E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
[2012/03/13 13:57:10 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{D93FF6C6-6F29-4831-BD9A-F17A0FBF1675}
[2012/03/13 13:56:37 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F28A3E22-78BC-409D-9CFC-335A3B438473}
[2012/03/12 13:22:44 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{55A03D60-06C4-44A5-8367-0083CD5EA881}
[2012/03/12 13:22:11 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F191252B-6C7F-43EC-A97E-E2AC176BE4EA}
[2012/03/08 13:43:55 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{E7DEF6AF-882F-4AC4-AD03-AD44DB8A479E}
[2012/03/08 13:43:22 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{DA94EA3F-AED4-44AA-83F0-3CC53BCE4DDA}
[2012/03/07 17:52:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{B67D7E93-20BB-4243-83F6-F36D65068203}
[2012/03/07 17:51:42 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9B979ED0-E1EF-45AE-BAA5-319F7329E720}
[2012/03/07 05:51:28 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C6639BAC-5CCE-451F-B9D0-B8B5A0C8E1A1}
[2012/03/07 05:50:54 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{4C034C90-A2B2-40E3-9743-EF83195CA2A6}
[2012/03/06 07:51:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- E:\Users\Sebastian Rosner\Desktop\OTL.exe
[2012/03/06 07:19:39 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9DB697E4-666C-4A6E-AB16-AF0F03BD38FB}
[2012/03/06 07:19:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{0B6C1ADD-2AE7-4299-A6C8-87FB689860A0}
[2012/03/06 05:40:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Roaming\Malwarebytes
[2012/03/06 05:40:35 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/03/06 05:40:34 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- E:\Windows\System32\drivers\mbam.sys
[2012/03/06 05:40:34 | 000,000,000 | ---D | C] -- E:\ProgramData\Malwarebytes
[2012/03/06 05:39:54 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\Viren
[2012/03/05 10:02:52 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C87D57AD-62C3-4F4D-99D9-9B38AEA61C3D}
[2012/03/05 10:02:20 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{FD492D71-14E2-4AC4-A165-CBAF84233B87}
[2012/03/04 06:28:32 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{29E72FC0-57B2-4AC7-845A-9B5C3AEAF8E2}
[2012/03/04 06:28:02 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{C0034C6B-713A-4039-B313-CADEDFBA083B}
[2012/03/03 09:06:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{71DE17F7-BEDD-4F00-8039-7BB039CCE67F}
[2012/03/03 09:05:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{5E748FBA-7EB2-4B60-B7BC-EF8FDE7B5F86}
[2012/03/02 10:31:50 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Roaming\EPSON
[2012/03/02 06:14:38 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9072EE92-AB14-4941-9390-521C2A7E93BD}
[2012/03/02 06:14:08 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{3C1E01C8-2AA5-466E-9DF1-A5DF5F2A94E2}
[2012/03/01 15:36:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\Risen
[2012/03/01 15:14:11 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012/03/01 15:14:08 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\AGEIA Technologies
[2012/03/01 15:14:08 | 000,000,000 | ---D | C] -- E:\Windows\SysWow64\AGEIA
[2012/03/01 15:13:43 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012/03/01 15:13:23 | 000,518,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_3.dll
[2012/03/01 15:13:23 | 000,514,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_3.dll
[2012/03/01 15:13:23 | 000,074,576 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAPOFX1_2.dll
[2012/03/01 15:13:23 | 000,070,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAPOFX1_2.dll
[2012/03/01 15:13:22 | 000,235,856 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_3.dll
[2012/03/01 15:13:22 | 000,175,440 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_3.dll
[2012/03/01 15:13:22 | 000,025,936 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_5.dll
[2012/03/01 15:13:22 | 000,023,376 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_5.dll
[2012/03/01 15:13:20 | 001,942,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_39.dll
[2012/03/01 15:13:20 | 000,540,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_39.dll
[2012/03/01 15:13:19 | 004,992,520 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_39.dll
[2012/03/01 15:13:18 | 000,511,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_1.dll
[2012/03/01 15:13:18 | 000,507,400 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_1.dll
[2012/03/01 15:13:18 | 000,238,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_1.dll
[2012/03/01 15:13:18 | 000,177,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_1.dll
[2012/03/01 15:13:18 | 000,068,104 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAPOFX1_0.dll
[2012/03/01 15:13:18 | 000,065,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAPOFX1_0.dll
[2012/03/01 15:13:18 | 000,028,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_4.dll
[2012/03/01 15:13:18 | 000,025,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_4.dll
[2012/03/01 15:13:17 | 001,941,528 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_38.dll
[2012/03/01 15:13:17 | 001,491,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_38.dll
[2012/03/01 15:13:17 | 000,540,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_38.dll
[2012/03/01 15:13:17 | 000,467,984 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_38.dll
[2012/03/01 15:13:15 | 004,991,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_38.dll
[2012/03/01 15:13:15 | 003,850,760 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DX9_38.dll
[2012/03/01 15:13:15 | 000,489,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\XAudio2_0.dll
[2012/03/01 15:13:15 | 000,479,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\XAudio2_0.dll
[2012/03/01 15:13:15 | 000,238,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine3_0.dll
[2012/03/01 15:13:15 | 000,177,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine3_0.dll
[2012/03/01 15:13:14 | 000,028,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_3.dll
[2012/03/01 15:13:14 | 000,025,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_3.dll
[2012/03/01 15:13:13 | 001,860,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_37.dll
[2012/03/01 15:13:13 | 001,420,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_37.dll
[2012/03/01 15:13:13 | 000,529,424 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_37.dll
[2012/03/01 15:13:13 | 000,462,864 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_37.dll
[2012/03/01 15:13:12 | 004,910,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DX9_37.dll
[2012/03/01 15:13:12 | 003,786,760 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DX9_37.dll
[2012/03/01 15:13:12 | 000,411,656 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_10.dll
[2012/03/01 15:13:12 | 000,267,272 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_10.dll
[2012/03/01 15:13:10 | 002,006,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_36.dll
[2012/03/01 15:13:10 | 001,374,232 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_36.dll
[2012/03/01 15:13:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_36.dll
[2012/03/01 15:13:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_36.dll
[2012/03/01 15:13:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_36.dll
[2012/03/01 15:13:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_36.dll
[2012/03/01 15:13:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_9.dll
[2012/03/01 15:13:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_9.dll
[2012/03/01 15:13:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_35.dll
[2012/03/01 15:13:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_35.dll
[2012/03/01 15:13:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_35.dll
[2012/03/01 15:13:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_35.dll
[2012/03/01 15:13:05 | 005,073,256 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_35.dll
[2012/03/01 15:13:05 | 003,727,720 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_35.dll
[2012/03/01 15:13:05 | 000,409,960 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_8.dll
[2012/03/01 15:13:05 | 000,266,088 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_8.dll
[2012/03/01 15:13:05 | 000,021,000 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\X3DAudio1_2.dll
[2012/03/01 15:13:05 | 000,017,928 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\X3DAudio1_2.dll
[2012/03/01 15:13:04 | 001,401,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_34.dll
[2012/03/01 15:13:04 | 001,124,720 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_34.dll
[2012/03/01 15:13:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_34.dll
[2012/03/01 15:13:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_34.dll
[2012/03/01 15:13:03 | 004,496,232 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_34.dll
[2012/03/01 15:13:03 | 003,497,832 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_34.dll
[2012/03/01 15:13:02 | 000,403,304 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_7.dll
[2012/03/01 15:13:02 | 000,261,480 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_7.dll
[2012/03/01 15:13:02 | 000,107,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_3.dll
[2012/03/01 15:13:02 | 000,081,768 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_3.dll
[2012/03/01 15:13:01 | 001,400,176 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\D3DCompiler_33.dll
[2012/03/01 15:13:01 | 001,123,696 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\D3DCompiler_33.dll
[2012/03/01 15:13:01 | 000,506,728 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10_33.dll
[2012/03/01 15:13:01 | 000,443,752 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10_33.dll
[2012/03/01 15:13:00 | 004,494,184 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_33.dll
[2012/03/01 15:13:00 | 003,495,784 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_33.dll
[2012/03/01 15:12:59 | 000,393,576 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_6.dll
[2012/03/01 15:12:59 | 000,255,848 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_6.dll
[2012/03/01 15:12:58 | 000,469,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx10.dll
[2012/03/01 15:12:58 | 000,440,080 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx10.dll
[2012/03/01 15:12:58 | 000,390,424 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_5.dll
[2012/03/01 15:12:58 | 000,251,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_5.dll
[2012/03/01 15:12:56 | 000,364,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_4.dll
[2012/03/01 15:12:56 | 000,237,848 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_4.dll
[2012/03/01 15:12:56 | 000,017,688 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\x3daudio1_1.dll
[2012/03/01 15:12:56 | 000,015,128 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\x3daudio1_1.dll
[2012/03/01 15:12:55 | 003,977,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_31.dll
[2012/03/01 15:12:55 | 002,414,360 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_31.dll
[2012/03/01 15:12:54 | 000,363,288 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_3.dll
[2012/03/01 15:12:54 | 000,236,824 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_3.dll
[2012/03/01 15:12:54 | 000,083,736 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_2.dll
[2012/03/01 15:12:54 | 000,062,744 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_2.dll
[2012/03/01 15:12:53 | 000,354,072 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_2.dll
[2012/03/01 15:12:53 | 000,230,168 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_2.dll
[2012/03/01 15:12:53 | 000,083,664 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xinput1_1.dll
[2012/03/01 15:12:53 | 000,062,672 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xinput1_1.dll
[2012/03/01 15:12:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_1.dll
[2012/03/01 15:12:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_1.dll
[2012/03/01 15:12:47 | 003,927,248 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_30.dll
[2012/03/01 15:12:47 | 002,388,176 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_30.dll
[2012/03/01 15:12:46 | 000,355,536 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\xactengine2_0.dll
[2012/03/01 15:12:46 | 000,230,096 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\xactengine2_0.dll
[2012/03/01 15:12:46 | 000,016,592 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\x3daudio1_0.dll
[2012/03/01 15:12:46 | 000,014,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\x3daudio1_0.dll
[2012/03/01 15:12:44 | 003,830,992 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_29.dll
[2012/03/01 15:12:44 | 002,332,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_29.dll
[2012/03/01 15:12:43 | 003,815,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_28.dll
[2012/03/01 15:12:43 | 002,323,664 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_28.dll
[2012/03/01 15:12:42 | 003,807,440 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_27.dll
[2012/03/01 15:12:42 | 002,319,568 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_27.dll
[2012/03/01 15:12:40 | 003,767,504 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_26.dll
[2012/03/01 15:12:40 | 002,297,552 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_26.dll
[2012/03/01 15:12:39 | 003,823,312 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_25.dll
[2012/03/01 15:12:39 | 002,337,488 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_25.dll
[2012/03/01 15:12:37 | 003,544,272 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\d3dx9_24.dll
[2012/03/01 15:12:37 | 002,222,800 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\d3dx9_24.dll
[2012/03/01 14:55:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{501BDB27-3108-44F5-A018-0F7EB9D07AFA}
[2012/03/01 14:54:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{4112FD1D-DD25-4F6C-B872-E9F804C290D7}
[2012/03/01 03:20:21 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\Fotos Mama
[2012/03/01 03:15:08 | 000,000,000 | ---D | C] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/03/01 03:15:03 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\LogMeIn Hamachi
[2012/02/29 19:44:01 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\Desktop\StonerockAlbumFotos
[2012/02/29 07:36:10 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{EF930F8C-8841-45FA-9BC7-B7C53A06B54A}
[2012/02/29 07:35:39 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{94006AB0-8C7E-487E-96EA-FE9FB471B2E7}
[2012/02/28 19:35:18 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{7814422E-90E3-4628-8C0A-D4CD50789E61}
[2012/02/28 19:34:49 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{52DDC274-298A-4351-B08E-8CA55F3644A2}
[2012/02/28 07:34:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{20EE24DA-8E03-4431-936D-5524FBA3F2A6}
[2012/02/28 07:33:56 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{16D07746-A325-4C5E-B73E-DA22B08D3AFD}
[2012/02/27 18:48:38 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{68F031A6-BBDC-4E74-B9A8-0029A2479D04}
[2012/02/27 18:48:08 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{137E188E-2B09-489F-998F-874AF7D7D596}
[2012/02/27 06:47:45 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{37FAD16E-1BE4-4BFD-BD99-1C3AC351005A}
[2012/02/27 06:47:15 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{A35111E5-D02A-46BD-A68B-1D9F829F1FFD}
[2012/02/26 16:35:34 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{15FBAA72-264E-453D-9E28-19AAB587795B}
[2012/02/26 16:35:05 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{1E3C63CE-49A1-4DF8-AFD1-F3E7E3229EAA}
[2012/02/26 15:59:41 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F8C6E89C-4CAA-45AE-91F6-0410F4C6825A}
[2012/02/25 08:21:06 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9DF0A60C-5C3F-43A6-8BD0-393B9CA8A5E8}
[2012/02/25 08:20:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{F5208DFE-9CCB-4B2D-99A6-CC4CA687831A}
[2012/02/24 07:25:47 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{76952553-17AC-4C55-BD93-E4BED1CD79C9}
[2012/02/24 07:25:17 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{9C990647-40B6-4138-9DB2-46DF625E6F0E}
[2012/02/23 08:51:09 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{21EAA541-6AAD-406D-A731-9BD94E910EC2}
[2012/02/23 08:50:51 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{83573AFC-90C7-463D-96BC-EE3584EAF2BB}
[2012/02/22 08:02:57 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{43C93030-F838-48B8-96E5-251BACA11A63}
[2012/02/22 08:02:27 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{7A759E95-74F1-47B2-9EBA-8974F0168EA1}
[2012/02/21 09:30:41 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{50584D68-E714-49E5-BF54-D9C5A02863D1}
[2012/02/21 09:30:23 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{02F2F4D5-81AA-47B6-8D5D-8E6331F43870}
[2012/02/20 06:41:56 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{22950753-6FB9-42C3-8438-F68C39D54E2C}
[2012/02/20 06:41:26 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{0957B350-4EA7-42E6-B655-89F1ED3B1714}
[2012/02/19 18:41:04 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{526A1907-2808-4B81-992F-2ECB30888DBC}
[2012/02/19 18:40:35 | 000,000,000 | ---D | C] -- E:\Users\Sebastian Rosner\AppData\Local\{5631D1CD-C674-4FE1-8543-64A81BAC727E}
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
[1 E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/03/18 14:36:50 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2012/03/18 14:35:48 | 3195,293,696 | -HS- | M] () -- E:\hiberfil.sys
[2012/03/13 19:15:25 | 000,308,224 | ---- | M] (All Alex,Inc) -- E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
[2012/03/13 13:50:17 | 000,038,910 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\MM2.pdf
[2012/03/13 12:53:53 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/03/13 12:53:53 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/03/06 07:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- E:\Users\Sebastian Rosner\Desktop\OTL.exe
[2012/03/06 05:40:35 | 000,001,005 | ---- | M] () -- E:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/03/06 05:40:35 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/03/04 14:15:17 | 000,654,400 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2012/03/04 14:15:17 | 000,616,242 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2012/03/04 14:15:17 | 000,130,240 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2012/03/04 14:15:17 | 000,106,622 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2012/03/01 15:14:11 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012/03/01 15:11:38 | 000,000,000 | R--D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/03/01 11:15:34 | 000,387,586 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG
[2012/03/01 03:15:13 | 000,000,886 | ---- | M] () -- E:\Users\Public\Desktop\LogMeIn Hamachi.lnk
[2012/03/01 03:15:12 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/02/28 08:40:02 | 000,009,346 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png
[2012/02/24 07:25:30 | 000,347,846 | ---- | M] () -- E:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
[1 E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> E:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/03/13 13:50:16 | 000,038,910 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\MM2.pdf
[2012/03/06 05:40:35 | 000,001,005 | ---- | C] () -- E:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/03/02 08:49:37 | 000,387,586 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG
[2012/02/28 08:40:01 | 000,009,346 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png
[2012/02/24 07:25:30 | 000,347,846 | ---- | C] () -- E:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg
[2011/12/21 10:57:55 | 000,004,608 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/23 08:13:28 | 000,000,034 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\blckdom.res
[2011/11/07 18:48:57 | 000,004,096 | ---- | C] () -- E:\Windows\d3dx.dat
[2011/09/13 09:04:44 | 000,482,408 | ---- | C] () -- E:\Windows\ssndii.exe
[2011/06/01 19:11:11 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2011/03/12 17:07:03 | 000,019,414 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\UserTile.png
[2011/03/11 04:35:39 | 000,000,047 | ---- | C] () -- E:\Windows\NeroDigital.ini
[2011/03/05 10:45:12 | 000,000,760 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\setup_ldm.iss
[2011/02/26 09:50:45 | 000,004,824 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\DF20.D6A
[2011/01/07 12:05:06 | 000,000,216 | ---- | C] () -- E:\Users\Sebastian Rosner\AppData\Roaming\wklnhst.dat
[2010/09/30 15:40:28 | 000,027,648 | ---- | C] () -- E:\Windows\SysWow64\AVSredirect.dll
[2010/06/15 04:51:10 | 000,120,200 | ---- | C] () -- E:\Windows\SysWow64\DLLDEV32i.dll
[2010/06/15 04:49:59 | 000,007,119 | ---- | C] () -- E:\Windows\mgxoschk.ini
[2010/05/23 09:09:43 | 000,000,132 | ---- | C] () -- E:\Program Files (x86)\loadbar4.dat
[2010/05/23 08:53:00 | 000,002,262 | ---- | C] () -- E:\Program Files (x86)\CaesarIV.ini
[2010/05/23 08:51:50 | 000,000,190 | ---- | C] () -- E:\Windows\ODBCINST.INI
[2010/01/11 11:18:48 | 000,000,056 | -H-- | C] () -- E:\Windows\SysWow64\ezsidmv.dat
[2009/12/25 14:14:35 | 000,089,044 | ---- | C] () -- E:\Windows\War3Unin.dat
[2009/10/20 14:19:30 | 000,053,299 | ---- | C] () -- E:\Windows\SysWow64\pthreadVC.dll
[2009/09/07 01:02:38 | 000,000,000 | ---- | C] () -- E:\Windows\VAIOUpdt.INI
[2009/09/07 00:36:51 | 000,002,835 | ---- | C] () -- E:\Windows\SysWow64\McOEMAppRules.dat
[2009/08/17 16:11:49 | 000,982,220 | ---- | C] () -- E:\Windows\SysWow64\igkrng500.bin
[2009/08/17 16:11:46 | 000,134,592 | ---- | C] () -- E:\Windows\SysWow64\igfcg500.bin
[2009/08/17 16:11:46 | 000,092,216 | ---- | C] () -- E:\Windows\SysWow64\igfcg500m.bin
[2009/08/17 16:11:44 | 000,439,300 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng500.bin
[2009/08/17 08:27:21 | 000,000,000 | ---- | C] () -- E:\Windows\ativpsrm.bin
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2005/10/15 08:25:20 | 000,028,672 | ---- | C] () -- E:\Windows\SysWow64\myodbc3i.exe
[2005/10/15 08:25:20 | 000,011,776 | ---- | C] () -- E:\Windows\SysWow64\myodbc3m.exe
[1997/06/14 04:56:08 | 000,056,832 | ---- | C] () -- E:\Windows\SysWow64\iyvu9_32.dll
========== LOP Check ==========
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2010/09/14 07:42:33 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2010/01/22 14:42:58 | 000,000,000 | ---D | M] -- E:\ProgramData\EPSON
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/09/28 11:10:19 | 000,000,000 | ---D | M] -- E:\ProgramData\Hunter
[2011/08/03 17:59:28 | 000,000,000 | ---D | M] -- E:\ProgramData\MAGIX
[2009/09/07 00:54:37 | 000,000,000 | ---D | M] -- E:\ProgramData\MusicStation
[2010/01/24 08:59:30 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2011/06/13 20:47:01 | 000,000,000 | ---D | M] -- E:\ProgramData\PC Auto Shutdown
[2011/07/24 12:11:27 | 000,000,000 | ---D | M] -- E:\ProgramData\PMB Files
[2010/11/30 17:55:53 | 000,000,000 | ---D | M] -- E:\ProgramData\RapidSolution
[2011/12/14 19:20:15 | 000,000,000 | ---D | M] -- E:\ProgramData\Samsung
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2012/01/16 15:21:37 | 000,000,000 | ---D | M] -- E:\ProgramData\TrackMania
[2009/09/07 00:56:09 | 000,000,000 | ---D | M] -- E:\ProgramData\Uninstall
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2010/06/05 16:17:29 | 000,000,000 | ---D | M] -- E:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/03/06 05:20:59 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2011/08/28 16:51:44 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin
[2009/09/07 01:07:08 | 000,000,000 | ---D | M] -- E:\Benutzerhandbuch
[2012/03/08 17:53:30 | 000,000,000 | -HSD | M] -- E:\Config.Msi
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\Documents and Settings
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\Dokumente und Einstellungen
[2010/10/14 05:03:57 | 000,000,000 | ---D | M] -- E:\hochzeit
[2009/08/17 07:49:10 | 000,000,000 | ---D | M] -- E:\Intel
[2010/11/30 18:04:46 | 000,000,000 | ---D | M] -- E:\lang
[2009/09/07 00:48:19 | 000,000,000 | RH-D | M] -- E:\MSOCache
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- E:\PerfLogs
[2011/12/30 09:23:53 | 000,000,000 | ---D | M] -- E:\Program Files
[2012/03/01 15:14:08 | 000,000,000 | ---D | M] -- E:\Program Files (x86)
[2012/03/06 05:40:34 | 000,000,000 | ---D | M] -- E:\ProgramData
[2009/12/23 12:28:15 | 000,000,000 | -HSD | M] -- E:\Programme
[2010/08/11 08:13:28 | 000,000,000 | -H-D | M] -- E:\SPLASH.000
[2009/09/07 00:35:34 | 000,000,000 | -H-D | M] -- E:\SPLASH.SYS
[2012/03/11 14:47:14 | 000,000,000 | -HSD | M] -- E:\System Volume Information
[2012/03/06 07:04:22 | 000,000,000 | R--D | M] -- E:\Users
[2012/03/01 15:14:14 | 000,000,000 | ---D | M] -- E:\Windows
[2009/09/07 01:07:08 | 000,000,000 | ---D | M] -- E:\_FS_SWRINFO
< %PROGRAMFILES%\*.exe >
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
< %systemroot%\*. /mp /s >
< MD5 for: AGP440.SYS >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- E:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
< MD5 for: ATAPI.SYS >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- E:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- E:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
< MD5 for: EXPLORER.EXE >
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009/08/03 02:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009/10/31 02:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/10/31 02:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- E:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009/08/03 02:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- E:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
< MD5 for: IASTOR.SYS >
[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Windows\System32\drivers\iaStor.sys
[2009/06/04 12:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- E:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009/06/04 12:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
< MD5 for: IASTORV.SYS >
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- E:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\System32\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- E:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\SysWOW64\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- E:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\drivers\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- E:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
< MD5 for: SCECLI.DLL >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\SysWOW64\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\System32\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- E:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
< MD5 for: USER32.DLL >
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- E:\Windows\SysWOW64\user32.dll
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- E:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- E:\Windows\System32\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- E:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\SysWOW64\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\System32\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- E:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\System32\winlogon.exe
[2010/11/20 09:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 21:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012/01/13 09:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- E:\Users\Sebastian Rosner\Desktop\Viren\MBAM\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/10/28 03:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009/10/28 02:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- E:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- E:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\system32\*.dll /lockedfiles >
Invalid Environment Variable: %USERPROFILE%\*.*
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
|
|
19.03.2012, 12:35
| #20 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code:
ATTFilter :OTL
O4 - HKU\Sebastian_Rosner_ON_E..\Run: [K3aRyluP6SiCkoR] E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (All Alex,Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Sebastian_Rosner_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKU\Sebastian_Rosner_ON_E Winlogon: Shell - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
(All Alex,Inc)
O20 - HKU\Sebastian_Rosner_ON_E Winlogon: UserInit - (C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe) - E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
(All Alex,Inc)
:Files
E:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
 bei dir evtl. e:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
20.03.2012, 10:16
| #21 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht moin. habe ein problem und zwar an folgender stelle: ich klicke auf das OTLPE icon,wähle den windows Ordner aus, klicke yes bei der frage, ob ich die remote user profiles for Scanning laden möchte, wähle systemprofile aus und mache den haken bei automatically load all reamining users weg. dann öffnet sich otlpe. ich klicke auf run fix, wähle die fix.txt Datei aus und der Inhalt erscheint im Custom Scan/Fix-Fenster. bis hierhin alles richtig, oder? Wenn ich jetzt jedoch auf Run Fix klicke, passiert nichts. Also der startet nicht. (der Button wird sozusagen nicht heruntergedrückt) Was mach ich nun? EDIT: habs doch irgendwie hingekriegt. der pc startet gerade neu. ich werde dann weiter nach deiner Anleitung verfahren. was ich allerdings noch nicht ganz verstehe. was meinst du hiermit:Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! das versteh ich gerade noch gar nicht... Edit2: und wenn ich windows normal starte, wird mir keine otl.txt-datei angezeigt. soll ich einfach OTL durchlaufen lassen und die txt-datei hier posten? Geändert von JahBastian (20.03.2012 um 10:50 Uhr) |
|
20.03.2012, 14:12
| #22 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht per hand eintragen, steht ja eig auch in der anleitung, dass du das bei problemen versuchen sollst
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
20.03.2012, 17:21
| #23 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht okay. also ich bin jetzt bei folgendem Punkt: der laptop hat neu gestartet und vorher die cd ausgeworfen. dann habe ich die desktop Symbole eingeblendet. allerdings erschein dann keine otl.txt-datei. also habe ich OTL manuell gestartet und nen scan gemacht, mit folgendem Resultat: Code:
ATTFilter OTL logfile created on: 20.03.2012 19:59:10 - Run 2 OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\Sebastian Rosner\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,85% Memory free 7,93 Gb Paging File | 6,39 Gb Available in Paging File | 80,53% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 260,80 Gb Total Space | 91,87 Gb Free Space | 35,23% Space Free | Partition Type: NTFS Drive S: | 195,31 Gb Total Space | 66,95 Gb Free Space | 34,28% Space Free | Partition Type: NTFS Computer Name: SEBASTIANROSNER | User Name: Sebastian Rosner | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.03.06 12:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe PRC - [2012.02.28 17:38:56 | 001,987,976 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe PRC - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe PRC - [2010.04.19 13:20:40 | 000,441,624 | ---- | M] (GoldSolution Software, Inc.) -- S:\Teamspeak\PC Auto Shutdown\ShutdownService.exe PRC - [2010.04.01 10:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe PRC - [2010.02.02 00:15:48 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin PRC - [2010.02.02 00:15:46 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe PRC - [2009.09.07 05:55:25 | 000,026,624 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe PRC - [2009.07.23 09:39:38 | 000,313,264 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe PRC - [2009.07.23 09:39:36 | 000,206,336 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe PRC - [2009.07.22 14:03:04 | 000,642,920 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe PRC - [2009.07.01 10:49:34 | 000,204,648 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe PRC - [2009.07.01 10:49:34 | 000,112,488 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe PRC - [2009.06.04 18:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.06.04 18:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2009.05.26 08:23:14 | 000,317,288 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe PRC - [2008.09.18 09:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe PRC - [2007.01.04 18:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe ========== Modules (No Company Name) ========== MOD - [2012.02.16 14:29:52 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\075d9c27aa02085fef8983b5f5f85834\System.ServiceProcess.ni.dll MOD - [2012.02.16 14:29:06 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll MOD - [2012.02.16 14:28:58 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll MOD - [2012.02.16 14:28:35 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll MOD - [2012.02.16 14:28:31 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll MOD - [2012.02.16 14:28:28 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.10.13 10:19:23 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.06.07 11:35:35 | 000,618,496 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe MOD - [2010.03.01 15:20:42 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009.08.12 22:11:54 | 000,522,240 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService) SRV:64bit: - [2009.07.27 21:27:07 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.24 05:34:31 | 000,189,984 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe -- (RtkAudioService) SRV:64bit: - [2009.07.16 08:36:56 | 000,411,496 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management) SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009.07.01 17:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins) SRV:64bit: - [2009.06.26 13:56:10 | 000,357,672 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr) SRV:64bit: - [2009.06.26 13:35:04 | 000,468,264 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr) SRV:64bit: - [2009.06.17 17:50:30 | 000,110,888 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper) SRV - [2012.02.28 17:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2011.11.30 23:23:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.04.19 13:20:40 | 000,441,624 | ---- | M] (GoldSolution Software, Inc.) [Auto | Running] -- S:\Teamspeak\PC Auto Shutdown\ShutdownService.exe -- (PCAutoShutdown_Service) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2009.10.20 19:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental) SRV - [2009.07.27 15:58:40 | 000,091,432 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe -- (SOHPlMgr) SRV - [2009.07.27 15:58:38 | 000,427,304 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe -- (SOHDms) SRV - [2009.07.27 15:58:38 | 000,075,048 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs) SRV - [2009.07.27 15:58:38 | 000,070,952 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe -- (SOHDBSvr) SRV - [2009.07.27 15:58:36 | 000,120,104 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp) SRV - [2009.07.23 09:39:38 | 000,313,264 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw) SRV - [2009.07.23 09:39:38 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service) SRV - [2009.07.23 09:39:36 | 000,206,336 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc) SRV - [2009.07.22 14:03:04 | 000,642,920 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw) SRV - [2009.07.01 10:49:34 | 000,204,648 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service) SRV - [2009.06.26 10:25:36 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10) SRV - [2009.06.26 10:25:24 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.04 18:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2008.09.18 09:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor) SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2007.01.11 04:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) SRV - [2007.01.04 18:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.05.13 15:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.09.14 13:03:11 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2010.09.14 13:03:11 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2010.09.14 12:43:22 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.04.19 19:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl) DRV:64bit: - [2010.02.03 14:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009.10.20 19:19:54 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) DRV:64bit: - [2009.08.05 02:22:40 | 000,139,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) DRV:64bit: - [2009.08.05 02:20:51 | 007,345,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.08.03 21:06:34 | 000,250,928 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:64bit: - [2009.07.31 21:29:11 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009.07.31 21:14:14 | 000,076,288 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsn64.sys -- (risdptsk) DRV:64bit: - [2009.07.31 21:13:51 | 000,086,528 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssn64.sys -- (rimsptsk) DRV:64bit: - [2009.07.31 21:02:03 | 000,393,216 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009.07.30 21:41:17 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2009.07.30 21:41:16 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2009.07.30 21:41:16 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2009.07.30 21:40:45 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2009.07.27 21:27:10 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.24 06:24:03 | 000,201,472 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.11 21:19:09 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP) DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92) DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac) DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.05 21:04:10 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5v64.sys -- (netw5v64) Intel(R) DRV:64bit: - [2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.05.26 13:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter) DRV:64bit: - [2009.05.20 11:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2007.04.16 19:51:50 | 000,014,112 | R--- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (regi) DRV:64bit: - [2007.04.11 15:35:30 | 000,056,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2007.04.11 15:35:22 | 000,053,520 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2009.07.29 01:55:42 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 80 DE E2 36 FC CB 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: mail@gutscheinrausch.de:2.6 FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0 FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.3.0.0 FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 60323 FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 4 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: S:\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@gamersfirst.com/LiveLauncher: C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll File not found FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: S:\Program Files (x86)\Picasa 3\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.03.11 19:37:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.14 12:05:02 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Sebastian Rosner\AppData\Roaming\5048 [2011.11.23 13:13:37 | 000,000,000 | ---D | M] [2009.12.28 21:20:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Extensions [2012.03.13 20:13:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions [2012.01.23 01:21:47 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2010.11.30 23:12:52 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.06.28 22:36:47 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Sebastian Rosner\AppData\Roaming\mozilla\Firefox\Profiles\2unxji1j.default\extensions\yem5g0fm.ki0 [2010.05.31 17:17:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.11.23 13:13:37 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\SEBASTIAN ROSNER\APPDATA\ROAMING\5048 [2009.12.02 09:31:53 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2009.12.02 09:31:53 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2009.12.02 09:31:53 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2009.12.02 09:31:53 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2009.12.02 09:31:53 | 000,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (no name) - {09628AAA-66AD-4FA2-82E2-698185B66463} - No CLSID value found. O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [MarketingTools] C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe (Sony Corporation) O4 - HKLM..\Run: [PC Auto Shutdown] S:\Teamspeak\PC Auto Shutdown\AutoShutdown.exe (GoldSolution Software, Inc.) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [TrayServer] S:\chaostag\Trayserver.exe (MAGIX AG) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICAE.EXE /FU "C:\Windows\TEMP\E_S7092.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [ICQ] "C:\Program Files (x86)\ICQ6.5\ICQ.exe" silent File not found O4 - HKCU..\Run: [K3aRyluP6SiCkoR] C:\Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe File not found O4 - Startup: C:\Users\Sebastian Rosner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B9B565C-06D3-446B-9A57-80B91D0C36EB}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59F4ACDD-B2C9-4F4E-969D-FD30745D2CD0}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8342F6D1-A61B-4ABD-8936-1F3EBEBF7D0F}: DhcpNameServer = 193.189.244.225 193.189.244.206 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (c:\users\sebastian rosner\appdata\roaming\flint4ytw.exe) - File not found O20 - HKCU Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{83b6dc45-bff5-11df-8ebd-0024be84fabd}\Shell - "" = AutoRun O33 - MountPoints2\{83b6dc45-bff5-11df-8ebd-0024be84fabd}\Shell\AutoRun\command - "" = I:\Autorun.exe O33 - MountPoints2\{9d1260d9-bf34-11df-bddd-0024be84fabd}\Shell - "" = AutoRun O33 - MountPoints2\{9d1260d9-bf34-11df-bddd-0024be84fabd}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{fff2edee-efd6-11de-94f5-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{fff2edee-efd6-11de-94f5-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AUTOSTARTER.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.03.20 18:30:07 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe [2012.03.20 18:29:37 | 000,000,000 | ---D | C] -- C:\_OTL [2012.03.20 16:10:51 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2012.03.13 18:57:10 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{D93FF6C6-6F29-4831-BD9A-F17A0FBF1675} [2012.03.13 18:56:37 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F28A3E22-78BC-409D-9CFC-335A3B438473} [2012.03.12 18:22:44 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{55A03D60-06C4-44A5-8367-0083CD5EA881} [2012.03.12 18:22:11 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F191252B-6C7F-43EC-A97E-E2AC176BE4EA} [2012.03.08 18:43:55 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{E7DEF6AF-882F-4AC4-AD03-AD44DB8A479E} [2012.03.08 18:43:22 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{DA94EA3F-AED4-44AA-83F0-3CC53BCE4DDA} [2012.03.07 22:52:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{B67D7E93-20BB-4243-83F6-F36D65068203} [2012.03.07 22:51:42 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9B979ED0-E1EF-45AE-BAA5-319F7329E720} [2012.03.07 10:51:28 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C6639BAC-5CCE-451F-B9D0-B8B5A0C8E1A1} [2012.03.07 10:50:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{4C034C90-A2B2-40E3-9743-EF83195CA2A6} [2012.03.06 12:51:52 | 000,584,704 | ---- | C] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe [2012.03.06 12:19:39 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9DB697E4-666C-4A6E-AB16-AF0F03BD38FB} [2012.03.06 12:19:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{0B6C1ADD-2AE7-4299-A6C8-87FB689860A0} [2012.03.06 10:40:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Roaming\Malwarebytes [2012.03.06 10:40:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.03.06 10:40:34 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.03.06 10:40:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.03.06 10:39:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\Viren [2012.03.05 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C87D57AD-62C3-4F4D-99D9-9B38AEA61C3D} [2012.03.05 15:02:20 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{FD492D71-14E2-4AC4-A165-CBAF84233B87} [2012.03.04 11:28:32 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{29E72FC0-57B2-4AC7-845A-9B5C3AEAF8E2} [2012.03.04 11:28:02 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{C0034C6B-713A-4039-B313-CADEDFBA083B} [2012.03.03 14:06:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{71DE17F7-BEDD-4F00-8039-7BB039CCE67F} [2012.03.03 14:05:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{5E748FBA-7EB2-4B60-B7BC-EF8FDE7B5F86} [2012.03.02 15:31:50 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Roaming\EPSON [2012.03.02 11:14:38 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9072EE92-AB14-4941-9390-521C2A7E93BD} [2012.03.02 11:14:08 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{3C1E01C8-2AA5-466E-9DF1-A5DF5F2A94E2} [2012.03.01 20:36:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\Risen [2012.03.01 20:14:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.03.01 20:14:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies [2012.03.01 20:14:08 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\AGEIA [2012.03.01 20:13:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2012.03.01 20:13:23 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll [2012.03.01 20:13:23 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll [2012.03.01 20:13:23 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll [2012.03.01 20:13:23 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll [2012.03.01 20:13:22 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll [2012.03.01 20:13:22 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll [2012.03.01 20:13:22 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll [2012.03.01 20:13:22 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll [2012.03.01 20:13:20 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll [2012.03.01 20:13:20 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll [2012.03.01 20:13:19 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll [2012.03.01 20:13:18 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll [2012.03.01 20:13:18 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll [2012.03.01 20:13:18 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll [2012.03.01 20:13:18 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll [2012.03.01 20:13:18 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll [2012.03.01 20:13:18 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll [2012.03.01 20:13:18 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll [2012.03.01 20:13:18 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll [2012.03.01 20:13:17 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll [2012.03.01 20:13:17 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll [2012.03.01 20:13:17 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll [2012.03.01 20:13:17 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll [2012.03.01 20:13:15 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll [2012.03.01 20:13:15 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll [2012.03.01 20:13:15 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll [2012.03.01 20:13:15 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll [2012.03.01 20:13:15 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll [2012.03.01 20:13:15 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll [2012.03.01 20:13:14 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll [2012.03.01 20:13:14 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll [2012.03.01 20:13:13 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll [2012.03.01 20:13:13 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll [2012.03.01 20:13:13 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll [2012.03.01 20:13:13 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll [2012.03.01 20:13:12 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll [2012.03.01 20:13:12 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll [2012.03.01 20:13:12 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll [2012.03.01 20:13:12 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll [2012.03.01 20:13:10 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll [2012.03.01 20:13:10 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll [2012.03.01 20:13:10 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll [2012.03.01 20:13:10 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll [2012.03.01 20:13:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll [2012.03.01 20:13:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll [2012.03.01 20:13:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll [2012.03.01 20:13:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll [2012.03.01 20:13:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll [2012.03.01 20:13:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll [2012.03.01 20:13:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll [2012.03.01 20:13:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll [2012.03.01 20:13:05 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll [2012.03.01 20:13:05 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll [2012.03.01 20:13:05 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll [2012.03.01 20:13:05 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll [2012.03.01 20:13:05 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll [2012.03.01 20:13:05 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll [2012.03.01 20:13:04 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll [2012.03.01 20:13:04 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll [2012.03.01 20:13:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll [2012.03.01 20:13:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll [2012.03.01 20:13:03 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll [2012.03.01 20:13:03 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll [2012.03.01 20:13:02 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll [2012.03.01 20:13:02 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll [2012.03.01 20:13:02 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll [2012.03.01 20:13:02 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll [2012.03.01 20:13:01 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll [2012.03.01 20:13:01 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll [2012.03.01 20:13:01 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll [2012.03.01 20:13:01 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll [2012.03.01 20:13:00 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll [2012.03.01 20:13:00 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll [2012.03.01 20:12:59 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll [2012.03.01 20:12:59 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll [2012.03.01 20:12:58 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll [2012.03.01 20:12:58 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll [2012.03.01 20:12:58 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll [2012.03.01 20:12:58 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll [2012.03.01 20:12:56 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll [2012.03.01 20:12:56 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll [2012.03.01 20:12:56 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll [2012.03.01 20:12:56 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll [2012.03.01 20:12:55 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll [2012.03.01 20:12:55 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll [2012.03.01 20:12:54 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll [2012.03.01 20:12:54 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll [2012.03.01 20:12:54 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll [2012.03.01 20:12:54 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll [2012.03.01 20:12:53 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll [2012.03.01 20:12:53 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll [2012.03.01 20:12:53 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll [2012.03.01 20:12:53 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll [2012.03.01 20:12:52 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll [2012.03.01 20:12:52 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll [2012.03.01 20:12:47 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll [2012.03.01 20:12:47 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll [2012.03.01 20:12:46 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll [2012.03.01 20:12:46 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll [2012.03.01 20:12:46 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll [2012.03.01 20:12:46 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll [2012.03.01 20:12:44 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll [2012.03.01 20:12:44 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll [2012.03.01 20:12:43 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll [2012.03.01 20:12:43 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll [2012.03.01 20:12:42 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll [2012.03.01 20:12:42 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll [2012.03.01 20:12:40 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll [2012.03.01 20:12:40 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll [2012.03.01 20:12:39 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll [2012.03.01 20:12:39 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll [2012.03.01 20:12:37 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll [2012.03.01 20:12:37 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll [2012.03.01 19:55:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{501BDB27-3108-44F5-A018-0F7EB9D07AFA} [2012.03.01 19:54:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{4112FD1D-DD25-4F6C-B872-E9F804C290D7} [2012.03.01 08:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\Fotos Mama [2012.03.01 08:15:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012.03.01 08:15:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi [2012.03.01 00:44:01 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\Desktop\StonerockAlbumFotos [2012.02.29 12:36:10 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{EF930F8C-8841-45FA-9BC7-B7C53A06B54A} [2012.02.29 12:35:39 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{94006AB0-8C7E-487E-96EA-FE9FB471B2E7} [2012.02.29 00:35:18 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{7814422E-90E3-4628-8C0A-D4CD50789E61} [2012.02.29 00:34:49 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{52DDC274-298A-4351-B08E-8CA55F3644A2} [2012.02.28 12:34:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{20EE24DA-8E03-4431-936D-5524FBA3F2A6} [2012.02.28 12:33:56 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{16D07746-A325-4C5E-B73E-DA22B08D3AFD} [2012.02.27 23:48:38 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{68F031A6-BBDC-4E74-B9A8-0029A2479D04} [2012.02.27 23:48:08 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{137E188E-2B09-489F-998F-874AF7D7D596} [2012.02.27 11:47:45 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{37FAD16E-1BE4-4BFD-BD99-1C3AC351005A} [2012.02.27 11:47:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{A35111E5-D02A-46BD-A68B-1D9F829F1FFD} [2012.02.26 21:35:34 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{15FBAA72-264E-453D-9E28-19AAB587795B} [2012.02.26 21:35:05 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{1E3C63CE-49A1-4DF8-AFD1-F3E7E3229EAA} [2012.02.26 20:59:41 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F8C6E89C-4CAA-45AE-91F6-0410F4C6825A} [2012.02.25 13:21:06 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9DF0A60C-5C3F-43A6-8BD0-393B9CA8A5E8} [2012.02.25 13:20:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{F5208DFE-9CCB-4B2D-99A6-CC4CA687831A} [2012.02.24 12:25:47 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{76952553-17AC-4C55-BD93-E4BED1CD79C9} [2012.02.24 12:25:17 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{9C990647-40B6-4138-9DB2-46DF625E6F0E} [2012.02.23 13:51:09 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{21EAA541-6AAD-406D-A731-9BD94E910EC2} [2012.02.23 13:50:51 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{83573AFC-90C7-463D-96BC-EE3584EAF2BB} [2012.02.22 13:02:57 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{43C93030-F838-48B8-96E5-251BACA11A63} [2012.02.22 13:02:27 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{7A759E95-74F1-47B2-9EBA-8974F0168EA1} [2012.02.21 14:30:41 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{50584D68-E714-49E5-BF54-D9C5A02863D1} [2012.02.21 14:30:23 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{02F2F4D5-81AA-47B6-8D5D-8E6331F43870} [2012.02.20 11:41:56 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{22950753-6FB9-42C3-8438-F68C39D54E2C} [2012.02.20 11:41:26 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{0957B350-4EA7-42E6-B655-89F1ED3B1714} [2012.02.19 23:41:04 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{526A1907-2808-4B81-992F-2ECB30888DBC} [2012.02.19 23:40:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian Rosner\AppData\Local\{5631D1CD-C674-4FE1-8543-64A81BAC727E} [1 C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.20 20:05:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.20 20:05:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.20 19:56:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.20 19:55:56 | 3195,293,696 | -HS- | M] () -- C:\hiberfil.sys [2012.03.13 18:50:17 | 000,038,910 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\MM2.pdf [2012.03.06 12:51:54 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Rosner\Desktop\OTL.exe [2012.03.06 10:40:35 | 000,001,005 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.04 19:15:17 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.03.04 19:15:17 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.03.04 19:15:17 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.03.04 19:15:17 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.03.04 19:15:17 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.03.01 16:15:34 | 000,387,586 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG [2012.03.01 08:15:13 | 000,000,886 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk [2012.02.28 13:40:02 | 000,009,346 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png [2012.02.24 12:25:30 | 000,347,846 | ---- | M] () -- C:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg [1 C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp files -> C:\Users\Sebastian Rosner\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.13 18:50:16 | 000,038,910 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\MM2.pdf [2012.03.06 10:40:35 | 000,001,005 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.03.02 13:49:37 | 000,387,586 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\IMG_0953.JPG [2012.02.28 13:40:01 | 000,009,346 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\Plakat_StoneRock_quer.png [2012.02.24 12:25:30 | 000,347,846 | ---- | C] () -- C:\Users\Sebastian Rosner\Desktop\Bandcontest2.jpg [2011.12.21 15:57:55 | 000,004,608 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.11.23 13:13:28 | 000,000,034 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\blckdom.res [2011.11.07 23:48:57 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat [2011.09.13 14:04:44 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe [2011.03.12 22:07:03 | 000,019,414 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\UserTile.png [2011.03.11 09:35:39 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini [2011.03.05 15:45:12 | 000,000,760 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\setup_ldm.iss [2011.02.26 14:50:45 | 000,004,824 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\DF20.D6A [2011.01.07 17:05:06 | 000,000,216 | ---- | C] () -- C:\Users\Sebastian Rosner\AppData\Roaming\wklnhst.dat [2010.09.30 20:40:28 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2010.06.15 09:51:10 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2010.06.15 09:49:59 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini [2010.05.23 14:09:43 | 000,000,132 | ---- | C] () -- C:\Program Files (x86)\loadbar4.dat [2010.05.23 13:53:00 | 000,002,262 | ---- | C] () -- C:\Program Files (x86)\CaesarIV.ini [2010.05.23 13:51:50 | 000,000,190 | ---- | C] () -- C:\Windows\ODBCINST.INI < End of report > jetzt versuch ich mich mal an den zweiten teil deiner Anleitung zu machen. ich Hoffe, das klappt. könntest du mir aber vielleicht sagen, was der upload bringen soll/wird? an dieser stelle, aber bereits einen großen dank an deine Hilfsbereitschaft und Geduld |
|
20.03.2012, 19:50
| #24 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht was ist mit dem upload. welchen punkt verstehst du da nicht, ist ja eig nicht so schwer, moved files packen und im upload channel hochladen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
20.03.2012, 20:19
| #25 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht okay. hab die zip-datei nun hochgeladen. und jetzt? |
|
20.03.2012, 20:24
| #26 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nichtCombofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
21.03.2012, 11:47
| #27 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht hier die C:\ComboFix.txt-Datei: An dieser Stelle vorweg noch einmal ein Dankeschön. Und noch eine kurze Frage: An welchem Punkt der Trojanerentfernung befinden wir uns gerade? Ich versteh von dem ganzen hier gerade nichts mehr und weiß nicht so recht, ob der schon weg ist und das nun noch Sicherheitsmaßnahmen sind oder was auch immer. Vielleicht könntest du dazu ja noch kurz was sagen. Danke. Hier nun die Datei. Code:
ATTFilter ComboFix 12-03-20.02 - Sebastian Rosner 21.03.2012 10:52:50.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4063.2701 [GMT 1:00]
ausgeführt von:: c:\users\Sebastian Rosner\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\OfferBox
c:\program files (x86)\OfferBox\help.url
c:\program files (x86)\OfferBox\home.url
c:\program files (x86)\OfferBox\res\about_bk.bmp
c:\program files (x86)\OfferBox\res\Language.xml
c:\program files (x86)\OfferBox\res\loader.gif
c:\program files (x86)\OfferBox\search.url
c:\users\Sebastian Rosner\AppData\Roaming\AcroIEHelpe.txt
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\config.dat
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\config.xml
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\chrome\OfferBoxffx.jar
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\components\DataXPCOM_TypeLib.xpt
c:\users\Sebastian Rosner\AppData\Roaming\OfferBox\offerboxffx@offerbox.com\install.rdf
c:\users\Sebastian Rosner\AppData\Roaming\srvblck2.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-02-21 bis 2012-03-21 ))))))))))))))))))))))))))))))
.
.
2012-03-21 10:07 . 2012-03-21 10:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-21 10:07 . 2012-03-21 10:07 -------- d-----w- c:\users\Walter\AppData\Local\temp
2012-03-21 10:00 . 2012-03-21 10:00 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5486ED5A-6DEB-4136-AC81-041D8BB45EF5}\offreg.dll
2012-03-21 00:20 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-21 00:20 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-21 00:20 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-21 00:04 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-21 00:04 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-21 00:04 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-21 00:03 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5486ED5A-6DEB-4136-AC81-041D8BB45EF5}\mpengine.dll
2012-03-21 00:03 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-21 00:03 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-21 00:03 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-21 00:03 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-21 00:03 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-21 00:03 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-21 00:03 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-20 17:30 . 2011-07-13 02:55 2237440 ----a-r- C:\OTLPE.exe
2012-03-20 17:29 . 2012-03-20 22:12 -------- d-----w- C:\_OTL
2012-03-06 09:40 . 2012-03-06 09:40 -------- d-----w- c:\users\Sebastian Rosner\AppData\Roaming\Malwarebytes
2012-03-06 09:40 . 2012-03-06 09:40 -------- d-----w- c:\programdata\Malwarebytes
2012-03-06 09:40 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-02 14:31 . 2012-03-02 14:31 -------- d-----w- c:\users\Sebastian Rosner\AppData\Roaming\EPSON
2012-03-01 19:36 . 2012-03-01 19:36 -------- d-----w- c:\users\Sebastian Rosner\AppData\Local\Risen
2012-03-01 19:14 . 2012-03-01 19:14 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2012-03-01 19:14 . 2012-03-01 19:14 -------- d-----w- c:\windows\SysWow64\AGEIA
2012-03-01 19:12 . 2007-01-24 14:27 393576 ----a-w- c:\windows\system32\xactengine2_6.dll
2012-03-01 07:15 . 2012-03-01 07:15 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2009-12-28 20:08 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-01-04 10:44 . 2012-02-15 23:41 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 23:41 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2011-12-30 06:26 . 2012-02-15 23:41 515584 ----a-w- c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 23:41 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 23:41 498688 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2009-09-07 26624]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"TrayServer"="s:\chaostag\TrayServer.exe" [2008-08-07 90112]
"PC Auto Shutdown"="s:\teamspeak\PC Auto Shutdown\AutoShutdown.exe" [2010-12-01 1387520]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2010-06-07 618496]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="s:\itunes\iTunesHelper.exe" [2011-12-08 421736]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-28 1987976]
.
c:\users\Sebastian Rosner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]
GamersFirst LIVE!.lnk - c:\program files (x86)\GamersFirst\LIVE!\Live.exe [2011-3-3 2845552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-07-01 09:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 iehiknbe;iehiknbe;c:\windows\system32\drivers\iehiknbe.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-07-27 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-07-27 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-07-27 427304]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-07-27 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-07-27 91432]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-06-26 357672]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-06-17 110888]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-02-28 2343816]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 PCAutoShutdown_Service;PCAutoShutdown_Service;s:\teamspeak\PC Auto Shutdown\ShutdownService.exe [2010-04-19 441624]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-07-24 189984]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-07-16 411496]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2009-08-12 522240]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-24 7938080]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520]
"MRT"="c:\windows\system32\MRT.exe" [2012-03-21 56297240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
FF - ProfilePath - c:\users\Sebastian Rosner\AppData\Roaming\Mozilla\Firefox\Profiles\2unxji1j.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 60323
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Gutscheinrausch.de: mail@gutscheinrausch.de - %profile%\extensions\yem5g0fm.ki0
FF - Ext: iMacros for Firefox: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} - %profile%\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\Sebastian Rosner\AppData\Roaming\5048
FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\Sebastian Rosner\AppData\Roaming\5048
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ6.5\ICQ.exe
Wow6432Node-HKCU-Run-K3aRyluP6SiCkoR - c:\users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-3643894325-2442357728-1046350489-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-03-21 11:31:24
ComboFix-quarantined-files.txt 2012-03-21 10:31
.
Vor Suchlauf: 13 Verzeichnis(se), 101.270.581.248 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 107.196.825.600 Bytes frei
.
- - End Of File - - 35CF8D50533D8EEF9B5C88F4BE8B5400
|
|
21.03.2012, 14:08
| #28 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht öffne malwarebytes, logdateien, poste alle berichte
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
21.03.2012, 23:17
| #29 |
| | Weißer Bildschirm, auch abgesicherter Modus funktioniert nichtCode:
ATTFilter Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.03.21.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Sebastian Rosner :: SEBASTIANROSNER [Administrator] 21.03.2012 22:18:16 mbam-log-2012-03-21 (23-16-10).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 443562 Laufzeit: 54 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\_OTL\MovedFiles\03202012_132937\E_Users\Sebastian Rosner\AppData\Roaming\flint4ytw.exe (Spyware.Passwords) -> Keine Aktion durchgeführt. (Ende) |
|
22.03.2012, 13:03
| #30 |
| /// Malware-holic | Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht lade den CCleaner standard: CCleaner Download - CCleaner 3.16.1666 falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Weißer Bildschirm, auch abgesicherter Modus funktioniert nicht |
| abgesicherte, abgesicherten, abgesicherter, abgesicherter modus funktioniert nicht, bildschirm, bitte warten, direkt, erscheint, funktionier, funktioniert, funktioniert nicht, interne, internet, modus, netzwerk, netzwerktreiber, nichts, starte, starten, stelle, troja, trojaner, verbindung, verbunden, weißer, windows |
Linear-Darstellung
