| |  Redirect Virus > Rocketnews, Sicherheitscenter lässt sich nicht starten
 Hallo,
ich habe das gleiche Problem wie hier bereits von mehreren Usern beschrieben:
Google-Link-Umleitung über "Rocketnews" oder "Rcoknseetw" usw. auf meist US-Werbeseiten. Zusätzlich lässt sich das Windows-Sicherheitscenter nicht starten mit Fehlermeldung #1058.
Keine Funde bei Avira und tdsskiller. Browser Opera.
Ich habe wie in der Anleitung beschrieben defogger, OTL und GMER laufen lassen. Zusätzlich Malwarebytes.
Könnt Ihr Euch die Logfiles bitte mal ansehen und mir weiterhelfen?
Danke im Voraus und viele Grüße!!
J. Zitat:
OTL logfile created on: 6/8/2012 7:50:25 AM - Run 2
OTL by OldTimer - Version 3.2.46.0 Folder = C:\Users****\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1.96 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 62.05% Memory free
3.92 Gb Paging File | 2.85 Gb Available in Paging File | 72.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 50.00 Gb Total Space | 8.15 Gb Free Space | 16.30% Space Free | Partition Type: NTFS
Drive D: | 246.08 Gb Total Space | 35.02 Gb Free Space | 14.23% Space Free | Partition Type: NTFS
Computer Name: PHOENIX | User Name: ****| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users******\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Buhl finance\tax Steuersoftware 2011\taxaktuell.exe ()
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
PRC - C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - C:\Program Files\Opera\gstreamer\gstreamer.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - C:\Program Files\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wgui11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\rscorewinapi47.dll ()
MOD - C:\PROGRAM FILES\BUHL FINANCE\TAX STEUERSOFTWARE 2011\wstyle11.dll ()
MOD - C:\PROGRAM FILES\BUHL FINANCE\TAX STEUERSOFTWARE 2011\wstyle511.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wauff11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wfvie11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\taxaktuell.exe ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wreli11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\rsodbc47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\rsdcom47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wcore11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\wsteu11.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\rsguiwinapi47.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtSqlrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtXmlrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtWebKitrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtSvgrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtTestrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtScriptrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtNetworkrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtGuirs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\Qt3Supportrs47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\QtCorers47.dll ()
MOD - C:\Program Files\Buhl finance\tax Steuersoftware 2011\phononrs47.dll ()
========== Win32 Services (SafeList) ==========
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (Mcx2Svc) -- C:\Windows\System32\Mcx2Svc.dll (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (wscsvc) -- C:\Windows\System32\wscsvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (RemoteAccess) -- C:\Windows\System32\mprdim.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions)
========== Driver Services (SafeList) ==========
DRV - (ZTEusbser6k) -- system32\DRIVERS\ZTEusbser6k.sys File not found
DRV - (ZTEusbnmea) -- system32\DRIVERS\ZTEusbnmea.sys File not found
DRV - (ZTEusbmdm6k) -- system32\DRIVERS\ZTEusbmdm6k.sys File not found
DRV - (massfilter) -- system32\drivers\massfilter.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (udfs) -- C:\Windows\System32\drivers\udfs.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (crcdisk) -- C:\Windows\System32\drivers\crcdisk.sys (Microsoft Corporation)
DRV - (ws2ifsl) -- C:\Windows\System32\drivers\ws2ifsl.sys (Microsoft Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (cdfs) -- C:\Windows\System32\drivers\cdfs.sys (Microsoft Corporation)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/burn4free/{57CA7441-103A-495F-B327-99A6F505464F}
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {4783E907-3790-41F9-806E-BD1732B57A6C}
IE - HKLM\..\SearchScopes\{4783E907-3790-41F9-806E-BD1732B57A6C}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSA&bmod=EU01
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.ts.fujitsu.com/index2 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.ts.fujitsu.com/index2 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/burn4free/{57CA7441-103A-495F-B327-99A6F505464F}
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Burn4Free DB Toolbar\tbhelper.dll ()
IE - HKCU\..\SearchScopes,DefaultScope = {4783E907-3790-41F9-806E-BD1732B57A6C}
IE - HKCU\..\SearchScopes\{4783E907-3790-41F9-806E-BD1732B57A6C}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSA_deDE381
IE - HKCU\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://www.bigseekpro.com/search/browser/burn4free/{57CA7441-103A-495F-B327-99A6F505464F}?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files\Winload\tbWinl.dll (Conduit Ltd.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Burn4Free DB Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Burn4Free DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Burn4Free DB Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Burn4Free DB Toolbar\tbcore3.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Program Files\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe File not found
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe File not found
O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe File not found
O4 - HKLM..\Run: [YouCam Mirror Tray icon] C:\Program Files\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - Startup: C:\Users***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - c:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5C961D9-7B67-4619-AF6D-840EBBFA9FEE}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - c:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012/06/05 09:28:06 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012/06/04 10:26:56 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/06/04 10:16:10 | 002,127,960 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users*****\Desktop\tdsskiller.exe
[2012/06/04 09:57:42 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users*****\Desktop\OTL.exe
[2012/05/29 09:45:23 | 000,000,000 | ---D | C] -- C:\Users****\AppData\Roaming\Malwarebytes
[2012/05/29 09:41:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/05/29 09:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/05/29 09:41:46 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/05/29 09:41:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/05/23 10:18:28 | 000,000,000 | ---D | C] -- C:\Users********\AppData\Roaming\Avira
[2012/05/23 10:12:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/05/23 10:12:37 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2012/05/23 10:12:36 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012/05/23 10:12:36 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2012/05/23 10:12:36 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2012/05/23 10:12:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012/05/23 10:12:17 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012/05/13 10:20:25 | 000,000,000 | ---D | C] -- C:\Users****\Documents\Diagnostik2012
[2012/05/12 19:25:53 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/05/12 19:25:52 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/05/12 19:25:52 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/05/12 19:25:48 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
========== Files - Modified Within 30 Days ==========
[2012/06/08 07:25:22 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/08 07:25:22 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/08 07:18:04 | 000,000,316 | ---- | M] () -- C:\Windows\tasks\imnidqq.job
[2012/06/08 07:18:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/08 07:17:52 | 1579,847,680 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/06 08:08:18 | 000,643,866 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/06/06 08:08:18 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/06 08:08:18 | 000,126,394 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/06/06 08:08:18 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/05 09:59:47 | 000,020,520 | ---- | M] () -- C:\Users****\Documents\tabelle-kirschsorten.pdf
[2012/06/05 09:28:46 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012/06/05 09:14:54 | 000,050,477 | ---- | M] () -- C:\Users*****\Desktop\Defogger.exe
[2012/06/04 10:16:10 | 002,127,960 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users*****\Desktop\tdsskiller.exe
[2012/06/04 09:57:43 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users****\Desktop\OTL.exe
[2012/05/29 09:45:43 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/05/23 10:12:53 | 000,001,946 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/05/13 20:30:17 | 000,151,552 | RHS- | M] () -- C:\Windows\System32\tapi32N.dll
[2012/05/13 11:06:30 | 000,479,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/05/09 22:44:10 | 000,010,103 | ---- | M] () -- C:\Users*****\Documents\JAGO Abholschein DHL_15.pdf
========== Files Created - No Company Name ==========
[2012/06/05 09:59:47 | 000,020,520 | ---- | C] () -- C:\Users*****\Documents\tabelle-kirschsorten.pdf
[2012/06/05 09:14:54 | 000,050,477 | ---- | C] () -- C:\Users*****\Desktop\Defogger.exe
[2012/05/29 09:41:48 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/05/23 10:12:53 | 000,001,946 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/05/13 20:30:17 | 000,151,552 | RHS- | C] () -- C:\Windows\System32\tapi32N.dll
[2012/05/13 20:30:17 | 000,000,316 | ---- | C] () -- C:\Windows\tasks\imnidqq.job
[2012/05/09 22:44:10 | 000,010,103 | ---- | C] () -- C:\Users******\Documents\JAGO Abholschein DHL_15.pdf
[2011/02/23 14:14:16 | 000,044,544 | ---- | C] () -- C:\Windows\System32\mhproc.dll
[2010/11/12 22:11:33 | 000,008,192 | -HS- | C] () -- C:\Windows\o2cLicStore.bin
[2010/11/12 21:51:33 | 000,000,503 | ---- | C] () -- C:\Windows\System32\FeMakro.ini
[2010/11/12 21:51:33 | 000,000,497 | ---- | C] () -- C:\Windows\System32\FeAnim.ini
[2010/10/05 21:23:20 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe
[2010/08/29 19:12:33 | 000,007,597 | ---- | C] () -- C:\Users*****\AppData\Local\Resmon.ResmonCfg
[2010/08/25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010/08/25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010/08/25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010/08/17 20:48:05 | 000,054,781 | ---- | C] () -- C:\Users*****\AppData\Roaming\mdbu.bin
< End of report >
|
|
08.06.2012, 10:13
Baum-Darstellung