| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Atraps.Gen., Atraps.Gen2, Constructor.A - sind diese entfernbar?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.09.2012, 10:14
| #1 |
 |  Atraps.Gen., Atraps.Gen2, Constructor.A - sind diese entfernbar? Hallo, am Mittwoch 29.8. habe ich beim kopieren einer alten Powerpoint-Datei (von einer externen Festplatte auf die andere) die Mitteilung bekommen, die Datei wäre mit Constructor.A infiziert. Ich habe sie in die Avira-Quarantäne verschoben und mir nichts weiter gedacht. Einen Tag später wurden mir beim Surfen im Internet die Trojaner Atraps.Gen und Atraps.Gen2 von Avira angezeigt. Ich habe sie sofort in Quarantäne gesteckt, aber sie tauchten immer wieder auf, auch nach einem Neustart! Inszwischen habe ich sie ca. 4x in Quarantäne gesteckt! Ich wollte dann einen Avira Suchlauf über C: durchführen: Beim ersten Mal erschien der Windows Installationsassistent zur Installation neuer Hardware. Das kam mir komisch vor (weil ich ja keine neue Hardware angeschlossen hatte) und ich habe ihn ignoriert, was dazu führte dass der Suchlauf nicht weiterlief. Beim zweiten Mal brachte Avira die Meldung, Explorer.exe und svchost.exe seien infiziert. Das kam mir ebenfalls komisch vor und ich habe diese Dateien nicht wie vorgeschlagen in Quarantäne gesteckt. Daraufhin wurde der Suchlauf abgebrochen mit dem Ergebnis "Keine Funde". Im Avira-Board wurde mir aufgrund dieser Beschreibung gesagt mein Rechner sei kompromittiert und da helfe nur neuaufsetzen...  Muss das wirklich sein?P.S. Die beiden externen Festplatten habe ich von einem sauberen Rechner aus mit Malwarebytes gescannt, ohne Befund. Die infizierte ppt ist auch nicht mehr drauf zu finden (ich nehme an das liegt daran, dass ich sie in Quarantäne gesteckt habe?). Als mir einen Tag später die Trojaner Atraps.Gen und Atraps.Gen2 angezeigt wurden, waren die externen Festplatten nicht angeschlossen. P.P.S. Ich bin Freiberuflerin, aber meine "Firma" besteht nur aus mir. Könnt ihr mir helfen? Hallo, ich habe wie in der Anleitung gefordert defogger laufen lassen und dann einen Scan mit OTL gemacht. Ich hoffe mit diesen Angaben nimmt sich jemand meines Problems an? OTL Logfile: Code:
ATTFilter OTL logfile created on: 02.09.2012 14:26:09 - Run 1 OTL by OldTimer - Version 3.2.59.1 Folder = C:\Dokumente und Einstellungen\Annika\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 73,92% Memory free 2,60 Gb Paging File | 2,12 Gb Available in Paging File | 81,55% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 39,06 Gb Total Space | 7,47 Gb Free Space | 19,13% Space Free | Partition Type: NTFS Drive F: | 16,81 Gb Total Space | 5,88 Gb Free Space | 34,98% Space Free | Partition Type: NTFS Computer Name: LOSANGELES | User Name: Annika | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.02 14:00:36 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Annika\Desktop\OTL.exe PRC - [2012.08.30 14:28:37 | 000,145,408 | -H-- | M] (Hauppauge Computer Works) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\WMPRWISE.EXE PRC - [2012.08.29 07:47:27 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2012.08.08 15:03:54 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.11 21:00:46 | 000,919,008 | R--- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe PRC - [2012.07.03 09:04:54 | 000,252,848 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2012.05.24 13:28:56 | 000,055,184 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.05.09 12:08:45 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.09 12:08:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.09 12:08:41 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.01.23 19:47:44 | 000,148,280 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\ezprint.exe PRC - [2011.01.23 19:47:42 | 000,770,728 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxecmon.exe PRC - [2010.04.14 22:08:12 | 000,598,696 | ---- | M] ( ) -- C:\WINDOWS\system32\lxeccoms.exe PRC - [2010.01.26 15:22:38 | 001,897,952 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\NasNavi.exe PRC - [2009.09.18 19:48:34 | 002,412,032 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe PRC - [2009.09.18 19:48:28 | 000,009,216 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe PRC - [2009.05.15 21:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe PRC - [2009.05.15 21:36:50 | 000,206,128 | R--- | M] (BUFFALO INC.) -- C:\Programme\BUFFALO\NASNAVI\nassche.exe PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2005.02.13 23:38:04 | 000,479,232 | ---- | M] (FinePrint Software, LLC) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\fpdisp5a.exe PRC - [2004.09.29 12:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\hpzipm12.exe PRC - [2003.08.14 14:19:14 | 000,049,152 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Programme\SAMSUNG\SENS Keyboard V4 Launcher\SensKbd.exe PRC - [2003.01.03 04:12:32 | 000,126,976 | R--- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe ========== Modules (No Company Name) ========== MOD - [2012.09.02 14:23:04 | 000,055,808 | -H-- | M] () -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\ntuser.dat MOD - [2012.09.02 14:23:03 | 000,009,728 | -H-- | M] () -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\desktop.ini MOD - [2012.06.16 12:10:04 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b84bb74d7724e147a642a1d5358feb7\System.ServiceProcess.ni.dll MOD - [2012.06.16 12:08:03 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01abbadafaf265d9f4ac9bbb247acb98\System.Windows.Forms.ni.dll MOD - [2012.06.16 12:07:46 | 001,592,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86f2038209a4cf0d0f5b30f6375c9b2\System.Drawing.ni.dll MOD - [2012.06.16 00:41:48 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2012.06.16 00:41:30 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll MOD - [2012.06.16 00:41:29 | 000,261,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll MOD - [2012.05.30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2012.05.30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2012.05.14 10:31:38 | 000,627,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\41f6f6dd0c8427d4a8e6fd3915505a6b\System.Transactions.ni.dll MOD - [2012.05.14 10:31:26 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\9080c8e8e7b6dfb502c1328673d636f8\System.Management.ni.dll MOD - [2012.05.14 10:29:49 | 000,679,936 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\129b15861e200613ff78ae15581f9093\System.Security.ni.dll MOD - [2012.05.14 10:29:43 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll MOD - [2012.05.13 21:54:39 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll MOD - [2012.05.13 21:51:36 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\12c6fe8d4dd78f9bddf847d3b2821c03\System.Data.ni.dll MOD - [2012.05.13 21:32:11 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll MOD - [2012.05.13 21:31:36 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll MOD - [2012.05.09 12:08:45 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2011.01.23 19:47:44 | 000,148,280 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\ezprint.exe MOD - [2011.01.23 19:47:42 | 000,770,728 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxecmon.exe MOD - [2010.04.05 12:56:07 | 000,716,954 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\epwizard.dll MOD - [2010.04.05 12:55:15 | 000,159,890 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\customui.dll MOD - [2010.04.05 12:55:04 | 000,061,604 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\epfunct.dll MOD - [2010.04.05 12:54:59 | 000,123,033 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\eputil.dll MOD - [2010.04.05 12:54:52 | 000,143,502 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\imagutil.dll MOD - [2010.04.01 19:24:28 | 001,159,168 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxecdrs.dll MOD - [2010.04.01 19:23:27 | 000,389,120 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxecscw.dll MOD - [2009.11.26 08:08:23 | 000,049,152 | ---- | M] () -- C:\WINDOWS\system32\LXECPMON.DLL MOD - [2009.11.05 09:39:40 | 000,087,552 | ---- | M] () -- C:\WINDOWS\system32\cpwmon2k.dll MOD - [2009.11.04 15:14:19 | 000,157,696 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxecdrpp.dll MOD - [2009.06.23 13:11:04 | 000,102,400 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\epoemdll.dll MOD - [2009.06.23 13:10:29 | 000,045,056 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\epstring.dll MOD - [2009.06.23 13:09:11 | 002,203,648 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\epwizres.dll MOD - [2009.05.27 14:16:50 | 000,192,512 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lxecdatr.dll MOD - [2009.04.28 09:56:29 | 000,024,064 | ---- | M] () -- C:\WINDOWS\system32\LXECsmr.dll MOD - [2009.04.07 21:25:27 | 000,409,600 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\iptk.dll MOD - [2009.03.10 07:43:49 | 000,155,648 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxeccaps.dll MOD - [2009.03.02 16:25:47 | 000,151,552 | ---- | M] () -- C:\Programme\Lexmark Pro800-Pro900 Series\lxecptp.dll MOD - [2009.02.20 10:48:03 | 000,299,008 | ---- | M] () -- C:\WINDOWS\system32\LXECsm.dll MOD - [2009.01.13 15:15:12 | 004,485,120 | ---- | M] () -- C:\WINDOWS\system32\LXECoem.dll MOD - [2007.04.02 19:19:22 | 000,355,112 | ---- | M] () -- C:\WINDOWS\system32\msjetoledb40.dll MOD - [2001.10.23 19:59:00 | 000,045,056 | ---- | M] () -- C:\Programme\SAMSUNG\SENS Keyboard V4 Launcher\KbdHook.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2012.08.29 07:47:27 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012.07.27 19:33:09 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.05.24 13:28:56 | 000,055,184 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.05.09 12:08:45 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.09 12:08:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2010.12.08 15:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2010.04.14 22:08:12 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\system32\lxeccoms.exe -- (lxec_device) SRV - [2010.04.14 22:08:05 | 000,193,192 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe -- (lxecCATSCustConnectService) SRV - [2009.09.18 19:48:28 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2009.05.15 21:36:50 | 000,251,184 | R--- | M] (BUFFALO INC.) [Auto | Running] -- C:\Programme\BUFFALO\NASNAVI\nassvc.exe -- (NasPmService) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2004.09.29 12:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | System | Stopped] -- C:\DOKUME~1\Annika\LOKALE~1\Temp\SAS_SelfExtract\SASKUTIL.sys -- (SASKUTIL) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Annika\LOKALE~1\Temp\SAS_SelfExtract\SASENUM.SYS -- (SASENUM) DRV - File not found [Kernel | System | Stopped] -- C:\DOKUME~1\Annika\LOKALE~1\Temp\SAS_SelfExtract\SASDIFSV.SYS -- (SASDIFSV) DRV - File not found [Kernel | Disabled | Stopped] -- system32\DRIVERS\s24trans.sys -- (s24trans) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\aexpamdrv.sys -- (AEXPAM) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\Annika\LOKALE~1\Temp\__Samsung_Update\ADDMEM.SYS -- (ADDMEM) DRV - [2012.05.09 12:08:46 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.09 12:08:46 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.11.11 14:26:02 | 002,216,064 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) DRV - [2009.08.18 13:06:56 | 000,114,688 | R--- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnet.sys -- (ZTEusbnet) DRV - [2009.08.18 13:06:56 | 000,105,088 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\zteusbvoice.sys -- (ZTEusbvoice) DRV - [2009.08.18 13:06:56 | 000,105,088 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k) DRV - [2009.08.18 13:06:56 | 000,105,088 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea) DRV - [2009.08.18 13:06:56 | 000,105,088 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k) DRV - [2009.06.30 18:46:24 | 000,009,728 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter) DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFILTER.sys -- (KMWDFILTER) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2004.09.29 12:10:18 | 000,016,800 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hppaufd0.sys -- (dot4ufd) DRV - [2004.07.22 15:50:16 | 001,268,234 | R--- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2004.03.16 06:40:00 | 001,657,344 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w22n51.sys -- (w22n51) DRV - [2003.08.25 07:42:18 | 000,111,808 | ---- | M] (Applied Drivers Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cwawdm.sys -- (cs429x) DRV - [2003.05.15 11:09:00 | 000,043,136 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp) DRV - [2002.11.20 07:52:14 | 000,033,664 | R--- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {00274FB1-2CEA-4713-B85E-13D6026CF14F} IE - HKCU\..\SearchScopes\{00274FB1-2CEA-4713-B85E-13D6026CF14F}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.08.12 17:35:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.08.15 13:37:43 | 000,000,000 | ---D | M] [2010.01.21 23:02:04 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Mozilla\Extensions [2012.05.02 21:01:20 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Mozilla\Firefox\Profiles\5tdizccg.default\extensions [2011.04.24 21:39:01 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Mozilla\Firefox\Profiles\5tdizccg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.05.07 10:12:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Mozilla\Firefox\Profiles\5tdizccg.default\extensions\nostmp [2012.03.27 08:10:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.07.27 19:33:12 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.02.19 22:48:55 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2012.03.27 08:10:42 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.27 08:10:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.03.27 08:10:42 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.03.27 08:10:42 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.27 08:10:42 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.27 08:10:42 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Programme\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: Google Update (Enabled) = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: Keyword Project Manager = C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\emjneogdbgaldgefibeojpbbckmgflkl\1.1.9_0\ O1 HOSTS File: ([2011.04.22 22:52:22 | 000,432,836 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 14895 more lines... O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EzPrint] C:\Programme\Lexmark Pro800-Pro900 Series\ezprint.exe () O4 - HKLM..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe (FinePrint Software, LLC) O4 - HKLM..\Run: [Lexmark Pro800-Pro900 Series Fax Server] C:\Programme\Lexmark Pro800-Pro900 Series\fm3032.exe () O4 - HKLM..\Run: [lxecmon.exe] C:\Programme\Lexmark Pro800-Pro900 Series\lxecmon.exe () O4 - HKLM..\Run: [MobileConnect] C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation) O4 - HKLM..\Run: [SENS Keyboard V4 Launcher] C:\Programme\SAMSUNG\SENS Keyboard V4 Launcher\SENSKBD.EXE (SAMSUNG Electronics Co., Ltd.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKCU..\Run: [Microsoft Firewall 2.9] C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\WMPRWISE.EXE (Hauppauge Computer Works) O4 - Startup: C:\Dokumente und Einstellungen\Annika\Startmenü\Programme\Autostart\BUFFALO NAS Navigator2.lnk = C:\Programme\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.) O4 - Startup: C:\Dokumente und Einstellungen\Annika\Startmenü\Programme\Autostart\NAS Scheduler.lnk = C:\Programme\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: vitalsana.eu ([www3] http in Vertrauenswürdige Sites) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1264113472451 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93985F03-39EE-4D7B-BD07-1E032AA4A4EF}: DhcpNameServer = 10.3.11.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C2F252F4-431B-4720-9F4E-B2AFDD660F1E}: NameServer = 139.7.30.125,139.7.30.126 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.01.21 18:35:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{61a54190-06ad-11df-b8a5-e6523032e9ba}\Shell - "" = AutoRun O33 - MountPoints2\{61a54190-06ad-11df-b8a5-e6523032e9ba}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{61a54190-06ad-11df-b8a5-e6523032e9ba}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.09.02 14:15:23 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Annika\Desktop\OTL.exe [2012.08.30 14:28:38 | 000,145,408 | -H-- | C] (Hauppauge Computer Works) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\WMPRWISE.EXE [2012.08.29 07:51:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Sun [2012.08.29 07:48:57 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2012.08.27 10:20:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Annika\Startmenü\Programme\Google Chrome [2012.08.17 11:16:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Nvu [2012.08.17 11:16:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nvu [2012.08.17 11:16:46 | 000,000,000 | ---D | C] -- C:\Programme\Nvu [2012.08.17 11:08:50 | 000,000,000 | ---D | C] -- C:\Programme\phase5 [2012.08.17 10:55:10 | 000,000,000 | ---D | C] -- C:\Programme\MozBackup [2012.08.12 17:50:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes [2012.08.12 17:48:35 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2012.08.12 17:48:21 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2012.08.12 17:43:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Apple Computer [2012.08.12 17:42:53 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2012.08.12 17:35:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime [2012.08.12 17:34:52 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.02 14:28:13 | 000,001,214 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-839522115-2102356035-1004UA.job [2012.09.02 14:24:32 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\defogger_reenable [2012.09.02 14:22:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.09.02 14:22:25 | 2146,488,320 | -HS- | M] () -- C:\hiberfil.sys [2012.09.02 14:16:44 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.09.02 14:07:10 | 001,110,476 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Desktop\7z920.exe [2012.09.02 14:01:28 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Desktop\g39ykoco.exe [2012.09.02 14:00:36 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Annika\Desktop\OTL.exe [2012.09.02 13:39:34 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Desktop\Defogger.exe [2012.08.30 14:28:37 | 000,145,408 | -H-- | M] (Hauppauge Computer Works) -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\WMPRWISE.EXE [2012.08.30 10:28:01 | 000,001,162 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-839522115-2102356035-1004Core.job [2012.08.28 14:25:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.08.27 10:20:21 | 000,002,365 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Desktop\Google Chrome.lnk [2012.08.22 19:00:39 | 000,007,680 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.17 10:56:11 | 001,354,161 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\Eigene Dateien\Firefox 14.0.1 (de) - 2012-08-17.pcv [2012.08.15 13:37:43 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk [2012.08.12 17:50:18 | 000,001,522 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2012.08.12 17:35:16 | 000,001,584 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2012.08.12 13:15:40 | 000,019,496 | ---- | M] () -- C:\Dokumente und Einstellungen\Annika\.recently-used.xbel [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.02 14:24:32 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\defogger_reenable [2012.09.02 14:20:05 | 001,110,476 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Desktop\7z920.exe [2012.09.02 14:19:58 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Desktop\g39ykoco.exe [2012.09.02 14:14:25 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Desktop\Defogger.exe [2012.08.27 10:20:21 | 000,002,365 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Desktop\Google Chrome.lnk [2012.08.27 10:17:05 | 000,001,214 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-839522115-2102356035-1004UA.job [2012.08.27 10:17:04 | 000,001,162 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-839522115-2102356035-1004Core.job [2012.08.17 10:56:09 | 001,354,161 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Eigene Dateien\Firefox 14.0.1 (de) - 2012-08-17.pcv [2012.08.12 17:50:18 | 000,001,522 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2012.08.12 17:35:16 | 000,001,584 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2012.08.12 17:25:22 | 000,000,276 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.08.12 13:15:40 | 000,019,496 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\.recently-used.xbel [2012.02.16 15:54:23 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011.05.28 16:30:07 | 000,081,080 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2011.04.24 18:29:19 | 000,707,639 | ---- | C] () -- C:\WINDOWS\Premium Wallpapers [from www.metacafe.com] #1.jpg [2011.04.01 13:27:15 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.11.29 00:26:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxecvs.dll [2010.11.29 00:26:35 | 000,442,368 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeccoin.dll [2010.11.29 00:26:24 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\lxecgcfg.dll [2010.11.29 00:26:22 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxeccui.dll [2010.11.29 00:26:22 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\lxeccuir.dll [2010.11.29 00:10:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\LXECPMON.DLL [2010.11.29 00:10:20 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXECFXPU.DLL [2010.11.29 00:10:00 | 004,485,120 | ---- | C] () -- C:\WINDOWS\System32\LXECoem.dll [2010.11.29 00:06:39 | 000,000,044 | -H-- | C] () -- C:\WINDOWS\System32\lxecrwrd.ini [2010.11.29 00:06:05 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\LXECinst.dll [2010.11.29 00:06:04 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\LXEChcp.dll [2010.11.29 00:06:03 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxecinpa.dll [2010.11.29 00:06:03 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeciesc.dll [2010.11.29 00:06:02 | 001,048,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxecserv.dll [2010.11.29 00:06:02 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\lxecusb1.dll [2010.11.29 00:05:56 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxecpmui.dll [2010.11.29 00:05:55 | 000,577,536 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeclmpm.dll [2010.11.29 00:05:54 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\lxecinsb.dll [2010.11.29 00:05:54 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\lxecinsr.dll [2010.11.29 00:05:54 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\lxecjswr.dll [2010.11.29 00:05:53 | 000,324,264 | ---- | C] ( ) -- C:\WINDOWS\System32\lxecih.exe [2010.11.29 00:05:53 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\lxecins.dll [2010.11.29 00:05:52 | 000,688,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxechbn3.dll [2010.11.29 00:05:52 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxecgrd.dll [2010.11.29 00:05:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\lxeccub.dll [2010.11.29 00:05:52 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxeccur.dll [2010.11.29 00:05:51 | 000,598,696 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeccoms.exe [2010.11.29 00:05:51 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\lxeccu.dll [2010.11.29 00:05:50 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeccomc.dll [2010.11.29 00:05:50 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeccomm.dll [2010.11.29 00:05:49 | 000,373,416 | ---- | C] ( ) -- C:\WINDOWS\System32\lxeccfg.exe [2010.11.15 19:22:05 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\LXECsmr.dll [2010.11.15 19:22:04 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\LXECsm.dll [2010.11.11 20:46:46 | 000,102,400 | ---- | C] () -- C:\WINDOWS\scrub2k.exe [2010.11.11 20:06:07 | 000,000,443 | ---- | C] () -- C:\WINDOWS\hpw0460k.ini [2010.11.11 20:04:12 | 000,000,478 | ---- | C] () -- C:\WINDOWS\hpdj460.ini [2010.10.25 21:18:23 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2010.01.21 21:33:10 | 000,007,680 | ---- | C] () -- C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.10.15 20:17:10 | 000,130,520 | R--- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DeviceManager.xml.rc4 ========== LOP Check ========== [2012.05.11 11:38:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CREALOGIX [2010.01.27 19:42:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverScanner [2010.01.24 21:29:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Innovative Solutions [2011.03.06 00:54:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2010.12.30 14:33:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexmark Pro800-Pro900 Series [2011.03.06 01:02:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2010.11.15 19:29:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pro800-Pro900 Series [2010.05.13 19:29:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2010.11.16 22:36:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone [2011.05.26 21:29:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010.01.22 01:13:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2012.08.12 13:15:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\gtk-2.0 [2011.04.25 20:45:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\NASNaviator2 [2011.03.06 01:02:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Nokia [2012.08.17 11:16:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Nvu [2011.03.06 01:02:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\PC Suite [2010.12.06 19:39:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Pro800-Pro900 Series [2010.10.17 17:55:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Vodafone [2011.04.24 18:19:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Windows Desktop Search [2011.05.28 16:07:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Annika\Anwendungsdaten\Windows Search ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 109 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8 @Alternate Data Stream - 103 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 02.09.2012 14:26:09 - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Dokumente und Einstellungen\Annika\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,48 Gb Available Physical Memory | 73,92% Memory free
2,60 Gb Paging File | 2,12 Gb Available in Paging File | 81,55% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 7,47 Gb Free Space | 19,13% Space Free | Partition Type: NTFS
Drive F: | 16,81 Gb Total Space | 5,88 Gb Free Space | 34,98% Space Free | Partition Type: NTFS
Computer Name: LOSANGELES | User Name: Annika | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML.BNFLE5NIMZKPZXGGM4RLHY6ZZI] -- C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe (Google Inc.)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{23430AE3-6FFF-47CF-B7E7-1552FC61DF39}" = Philips Flat Panel Adjust
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{27263813-8BDE-4CD2-84D3-02536743428A}_is1" = Attribute Changer 6.20
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6EECB283-E65F-40EF-86D3-D51BF02A8D43}" = Microsoft Office Converter Pack
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{96B51C0B-D3BE-4DF3-959C-28B22C10CFBB}" = Vodafone Mobile Connect Lite
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.2 - Deutsch
"{B557D1FB-631F-4D1A-9E86-5DC10CEBC03B}" = HP Color LaserJet 4700
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{E575CAA7-3ABC-417E-9352-30EF31611E13}" = SENS Keyboard V4 Launcher
"{EB44102C-759C-46B4-9B15-3C649A4A5D20}" = Documents Manager 3
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = SENS LT56ADW Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 2.8
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FinePrint" = FinePrint
"FLIQLO" = FLIQLO Screen Saver
"HP Color LaserJet 4700" = HP Color LaserJet 4700
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Lexmark Pro800-Pro900 Series" = Lexmark Pro800-Pro900 Series
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"Nvu_is1" = Nvu 1.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"UN060501" = BUFFALO NAS Navigator2
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 28.08.2012 04:40:17 | Computer Name = LOSANGELES | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung chrome.exe, Version 21.0.1180.83, fehlgeschlagenes
Modul chrome.dll, Version 21.0.1180.83, Fehleradresse 0x0008a2e7.
Error - 29.08.2012 04:36:50 | Computer Name = LOSANGELES | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
Error - 30.08.2012 04:23:45 | Computer Name = LOSANGELES | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
Error - 30.08.2012 08:28:42 | Computer Name = LOSANGELES | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung wmprwise.exe, Version 8.1.0.12387, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 30.08.2012 08:29:33 | Computer Name = LOSANGELES | Source = Application Error | ID = 1001
Description = Fehlerhafter Speicherbereich -1160947511.
Error - 30.08.2012 09:05:06 | Computer Name = LOSANGELES | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung POWERPNT.EXE, Version 12.0.6600.1000, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 30.08.2012 09:08:43 | Computer Name = LOSANGELES | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
Error - 30.08.2012 09:11:39 | Computer Name = LOSANGELES | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung wmprwise.exe, Version 8.1.0.12387, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 02.09.2012 08:12:34 | Computer Name = LOSANGELES | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
Error - 02.09.2012 08:22:33 | Computer Name = LOSANGELES | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
[ OSession Events ]
Error - 10.11.2011 03:44:45 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 89
seconds with 0 seconds of active time. This session ended with a crash.
Error - 24.11.2011 04:49:53 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 32
seconds with 0 seconds of active time. This session ended with a crash.
Error - 10.01.2012 13:28:16 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 11
seconds with 0 seconds of active time. This session ended with a crash.
Error - 18.01.2012 06:09:26 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 120
seconds with 0 seconds of active time. This session ended with a crash.
Error - 15.02.2012 04:53:06 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 86
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.04.2012 04:48:47 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 32
seconds with 0 seconds of active time. This session ended with a crash.
Error - 05.04.2012 05:43:41 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 101
seconds with 0 seconds of active time. This session ended with a crash.
Error - 06.04.2012 05:43:10 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 95
seconds with 0 seconds of active time. This session ended with a crash.
Error - 02.05.2012 05:26:49 | Computer Name = LOSANGELES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 02.09.2012 08:13:46 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060
Error - 02.09.2012 08:13:46 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
SASDIFSV SASKUTIL
Error - 02.09.2012 08:15:16 | Computer Name = LOSANGELES | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
Bibliothek LEXAR GEYSER JUMPDRIVE USB Device nicht laden.
Error - 02.09.2012 08:15:20 | Computer Name = LOSANGELES | Source = Wechselmediendienst | ID = 262255
Description = Der Wechselmediendienst konnte die Medien in Laufwerk Laufwerk 0 der
Bibliothek LEXAR GEYSER JUMPDRIVE USB Device nicht laden.
Error - 02.09.2012 08:16:55 | Computer Name = LOSANGELES | Source = VolSnap | ID = 393228
Description = Die Schattenkopie von Volume "C:" verfügte nicht über ausreichend
Vergleichsbereichsspeicherplatz, bevor es richtig installiert wurde.
Error - 02.09.2012 08:20:47 | Computer Name = LOSANGELES | Source = VolSnap | ID = 393241
Description = Die Schattenkopie von Volume "C:" wurde abgebrochen, weil die Bereichsvergleichsdatei
nicht rechtzeitig vergrößert wurde. Verringern Sie die E/A-Last auf diesem System,
um dieses Problem zukünftig zu verhindern.
Error - 02.09.2012 08:23:45 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst lxecCATSCustConnectService.
Error - 02.09.2012 08:23:45 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 02.09.2012 08:23:45 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060
Error - 02.09.2012 08:23:45 | Computer Name = LOSANGELES | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
SASDIFSV SASKUTIL
< End of report >
Hier noch der Gmer-Scan. Am Ende kam ein Hinweis: "Warnung! GMER has found system modification causes by rootkit activity". Das habe ich mit ok bestätigt. Dann mit save das Logfile gespeichert. GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-02 15:50:49
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHT2060AT rev.0022
Running: g39ykoco.exe; Driver: C:\DOKUME~1\Annika\LOKALE~1\Temp\awlyqfow.sys
---- System - GMER 1.0.15 ----
SSDT F7AA470C ZwClose
SSDT F7AA46C6 ZwCreateKey
SSDT F7AA4716 ZwCreateSection
SSDT F7AA46BC ZwCreateThread
SSDT F7AA46CB ZwDeleteKey
SSDT F7AA46D5 ZwDeleteValueKey
SSDT F7AA4707 ZwDuplicateObject
SSDT F7AA46DA ZwLoadKey
SSDT F7AA46A8 ZwOpenProcess
SSDT F7AA46AD ZwOpenThread
SSDT F7AA472F ZwQueryValueKey
SSDT F7AA46E4 ZwReplaceKey
SSDT F7AA4720 ZwRequestWaitReplyPort
SSDT F7AA46DF ZwRestoreKey
SSDT F7AA471B ZwSetContextThread
SSDT F7AA4725 ZwSetSecurityObject
SSDT F7AA46D0 ZwSetValueKey
SSDT F7AA472A ZwSystemDebugControl
SSDT F7AA46B7 ZwTerminateProcess
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\SearchIndexer.exe[2040] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 mouclass.sys (Mausklassentreiber/Microsoft Corporation)
---- Processes - GMER 1.0.15 ----
Library c:\windows\system32\z (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [556] 0x45670000
Library c:\windows\system32\z (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1148] 0x45670000
---- Files - GMER 1.0.15 ----
File C:\Dokumente und Einstellungen\Annika\Lokale Einstellungen\Temp\ArmUI.ini 170356 bytes
---- EOF - GMER 1.0.15 ----
|
| Themen zu Atraps.Gen., Atraps.Gen2, Constructor.A - sind diese entfernbar? |
| abgebrochen, atraps.gen, atraps.gen., atraps.gen2, constructor.a, dateien, ebenfalls, ergebnis, explorer.exe, festplatte, festplatten, geschlossen, infiziert., infizierte, internet, kopieren, malwarebytes, meldung, neuer, neustart, nicht mehr, nichts, office 2007, platte, plug-in, rechner, surfen, svchost.exe, trojaner, vodafone, wallpapers, windows, windows internet, wirklich |
Baum-Darstellung