Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 24.02.2013, 15:56   #1
Grasland
 
Trojaner Sirefef.Ag.9/Pidief.hck  auf 2 PCs + externer Festplatte - Standard

Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte



Guten Tag zusammen,

seit vergangenen Mittwoch hat mich ein Trojanerangriff in Beschlag. Zunächst war Computer A betroffen.

Computer A:

Auf Computer A wurde Antivir beschädigt und unbrauchbar gemacht. Es wurde der Trojaner Sirefef.AG.9 gemeldet, der nicht mehr entfernbar war. Auch ein Suchlauf mit mbam war nicht mehr möglich, weil es keinen Zugriff auf Dateien mehr gab. Angeschlossen am PC waren USB-Stick und externe Festplatte. Daraufhin wurden die allerwichtigsten Daten auf der externen Festplatte gesichert und der Computer neu aufgesetzt. Nach Neuinstallation von windows wurden die geretteten Daten wieder von einem zweiten installierten Betriebssystem (Linux) aus wieder auf windows verschoben. In diesem Datenrettungsordner liegen sensible geschäftliche Daten (Onlineshop) sowie meine Diplomarbeit, die kurz vor der Abgabe steht. Die Daten der externen Festplatte müssten unbedingt gerettet werden, weil dort auch meine Backups (Shop) liegen. (Die Diplomarbeit wäre zur Not auch auf dem USB-Stick)


Bei einem ersten Suchlauf mit antivier wurde

TR/Fakesys def. A.709 und EXP CVE-2013-0422

von Antivir in die Quarantäne geschoben. Diese lagen in dem Ordner App Data/Local/Temp Ein Suchlauf mit mban ergab keine Ergebnisse.

Die externe Festplatte wurde seit dem Neuaufsetzen des PC nicht mehr erkannt, so dass ein Befall zunächst nicht festgestellt wurde.


Computer B:

Die Funktion der externen Festplatte wurde an einem anderen PC überprüft. Am PC B wurde die externe Festplatte ebenfalls nicht erkannt und kurz darauf kam eine Virenmeldung von Antivir. Ein Suchlauf ergab 4 Funde und 2 davon wurden in die Quarantäne verschoben, zweimal Pidief.hck. Ein anschließender Suchlauf mit mban ergab drei Funde:

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.24.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19088
.... :: .... [Administrator]

24.02.2013 15:17:17
mbam-log-2013-02-24 (15-17-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 221077
Laufzeit: 5 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\.....\AppData\Local\Temp\{AA3246D6-AE1E-44B6-97E7-1F4E78E38A3B} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\.....\AppData\Local\Temp\{6349F12E-E1E3-43F2-9CBC-5248416ADB89} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\.....\AppData\Local\Temp\{6EAEA310-381B-469C-B966-B1AEFCE21F2D} (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


Externe Festplatte:

Mittlerweile wurde der Temp Ordner in AppData\Local der externen Festplatte komplett per Hand gelöscht, weil alle bisherigen Virenfunde sich auf diesen Temp-Ordner bezogen, der sowohl auf der externen Festplatte und dem Computer A liegt zur Datenreorganisation.

Vom USB-Stick wurde bisher kein Befall gemeldet.

Welche nächsten Schritte wären zu unternehmen um wieder stabile Systeme herzustellen?

Für Rückfragen bin ich jederzeit erreichbar.

Wäre für Unterstützung sehr sehr sehr dankbar.

Bis dann

Hier kommen noch die Logfiles

Computer A:

OTL
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 24.02.2013 17:58:39 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ursula\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 65,47% Memory free
3,98 Gb Paging File | 3,29 Gb Available in Paging File | 82,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,66 Gb Total Space | 62,14 Gb Free Space | 63,63% Space Free | Partition Type: NTFS
Drive D: | 115,38 Gb Total Space | 115,05 Gb Free Space | 99,71% Space Free | Partition Type: NTFS
 
Computer Name: BÜRO-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.24 17:20:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ursula\Downloads\OTL.exe
PRC - [2013.02.22 14:48:12 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2013.02.22 14:43:03 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2013.02.22 14:42:32 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.02.22 14:42:28 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2009.04.10 23:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.23 12:22:47 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f042f66c2ad8fd5b8c34fa22cd22079e\System.Management.ni.dll
MOD - [2013.02.23 12:21:07 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\e64304962098e90f0d3f4c33c1b080a6\System.Windows.Forms.ni.dll
MOD - [2013.02.23 12:20:43 | 001,593,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\78157a494dc9a7e52be8840decfcd9cc\System.Drawing.ni.dll
MOD - [2013.02.23 12:20:41 | 011,820,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\421cb77e6a4c21f94e3c5ddf766de23b\System.Web.ni.dll
MOD - [2013.02.23 12:20:32 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b5df40c22ab563a816103629e2ca99d4\System.Runtime.Remoting.ni.dll
MOD - [2013.02.23 12:20:19 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\b757806657fa5db2b1ed1a89b026b463\System.Xml.ni.dll
MOD - [2013.02.23 12:20:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\004bc6615f9c06df5c98859d35149fe6\System.Configuration.ni.dll
MOD - [2013.02.23 12:18:38 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cc149d08e75f8c53cd28ac926b38c370\System.ni.dll
MOD - [2013.02.23 12:18:32 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2227d1559f87943255069398608d5c56\mscorlib.ni.dll
MOD - [2013.02.23 11:22:38 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2758.36900__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 001,675,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2758.36908__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 000,684,032 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2758.37112__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2758.37171__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 000,360,448 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2758.37142__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 000,237,568 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2758.36865__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:37 | 000,184,320 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2758.36922__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:37 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2758.37134__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:37 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2758.37090__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2758.36922__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2758.37024__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:37 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2758.36886__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:34 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2758.37178__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:34 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2758.37104__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:34 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2758.36879__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:33 | 000,331,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2758.37098__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:33 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2758.37097__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:33 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2758.37163__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:32 | 000,790,528 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2758.37034__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:32 | 000,589,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2758.36936__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:32 | 000,438,272 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2758.36887__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:32 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2758.37119__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2013.02.23 11:22:32 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2758.36929__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:32 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2758.37056__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:32 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2758.37033__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:32 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2758.37055__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:31 | 000,897,024 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2758.37135__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:31 | 000,659,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2758.37091__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:31 | 000,475,136 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2758.37026__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:31 | 000,327,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2758.37019__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2013.02.23 11:22:31 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2758.37025__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:31 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2758.36942__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:31 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2758.37032__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:31 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2758.37076__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2013.02.23 11:22:31 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2729.30202__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2013.02.23 11:22:31 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2729.30197__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2729.30224__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2729.30212__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2013.02.23 11:22:31 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2729.30222__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2729.30178__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2013.02.23 11:22:30 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2013.02.23 11:22:30 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2729.30174__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2013.02.23 11:22:30 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2729.30313__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2013.02.23 11:22:30 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2729.30184__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2729.30259__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2729.30211__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2729.30185__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2729.30207__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2729.30242__90ba9c70f846762e\DEM.OS.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2729.30256__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2729.30203__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2729.30241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2013.02.23 11:22:30 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2013.02.23 11:22:29 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2013.02.23 11:22:29 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2729.30264__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2013.02.23 11:22:29 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2729.30262__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2729.30226__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2729.30227__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2729.30225__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2729.30230__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2729.30213__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2729.30259__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2729.30228__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2729.30212__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2729.30176__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2013.02.23 11:22:28 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2013.02.23 11:22:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2729.30208__90ba9c70f846762e\APM.Foundation.dll
MOD - [2013.02.23 11:22:28 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2729.30201__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2013.02.23 11:22:27 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2758.37156__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2013.02.23 11:22:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2758.37155__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2013.02.23 11:22:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2729.30193__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2013.02.23 11:22:27 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2758.37201__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2013.02.23 11:22:27 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2729.30188__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2013.02.23 11:22:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2729.30258__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2013.02.23 11:22:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2758.37148_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll
MOD - [2013.02.23 11:22:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2729.30211__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2013.02.23 11:22:27 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2758.36855__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2013.02.23 11:22:26 | 001,507,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2758.36873__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2013.02.23 11:22:26 | 000,471,040 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2758.36895__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2013.02.23 11:22:26 | 000,446,464 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2758.37148__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2013.02.23 11:22:26 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2758.36857__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2013.02.23 11:22:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2729.30209__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2013.02.23 11:22:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2729.30205__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2013.02.23 11:22:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2729.30214__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2013.02.23 11:22:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2729.30243__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2013.02.23 11:22:25 | 001,175,552 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.VividDesktop.Dashboard\1.2.2784.25450__90ba9c70f846762e\CLI.AIB.VividDesktop.Dashboard.dll
MOD - [2013.02.23 11:22:25 | 000,786,432 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.TutorialOverDrive3.Tutorial.Dashboard\1.2.2784.25451__90ba9c70f846762e\CLI.AIB.TutorialOverDrive3.Tutorial.Dashboard.dll
MOD - [2013.02.23 11:22:25 | 000,417,792 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.VividVideoPlayback.Dashboard\1.2.2784.25452__90ba9c70f846762e\CLI.AIB.VividVideoPlayback.Dashboard.dll
MOD - [2013.02.23 11:22:25 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard\1.2.2784.25452__90ba9c70f846762e\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.dll
MOD - [2013.02.23 11:22:25 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2758.36857__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2013.02.23 11:22:25 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2758.36856__90ba9c70f846762e\APM.Server.dll
MOD - [2013.02.23 11:22:25 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2758.36855__90ba9c70f846762e\AEM.Server.dll
MOD - [2013.02.23 11:22:25 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2758.37156__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2013.02.23 11:22:25 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2012.11.29 22:59:32 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2009.03.29 21:42:14 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.29 21:42:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.29 21:42:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2007.08.16 15:24:54 | 001,888,256 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2007.07.22 02:55:20 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2007.01.31 20:55:30 | 000,102,400 | ---- | M] () -- C:\Programme\Common Files\ATI Technologies\Multimedia\atixcode.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.22 14:48:12 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.02.22 14:42:32 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.02.16 01:34:06 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTGLM7X.sys -- (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTACCESS.sys -- (NTACCESS)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - [2013.02.23 20:37:52 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2013.02.22 14:52:13 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2013.02.22 14:52:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2013.02.22 14:52:08 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2013.02.22 14:52:03 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2007.07.22 03:05:34 | 002,920,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.10.30 16:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.geschenke-spiele.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8a8e2065-4e0e-44ed-8710-3ca076ccf19a&apn_sauid=21C76243-122C-4572-A05B-E8657904FB9B
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.02.23 18:27:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.21 20:34:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013.02.21 20:34:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2013.02.22 14:56:36 | 000,002,344 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\2tskom1z.default\searchplugins\askcom.xml
[2013.02.21 20:34:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.02.16 01:34:54 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.02.16 05:15:47 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.02.16 05:15:47 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.02.16 05:15:47 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2013.02.16 05:15:47 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.02.16 05:15:47 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.02.16 05:15:47 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F5DB648-A1FA-499C-806F-3254BDFCD5BC}: NameServer = 217.0.43.145,217.0.43.129
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{90537d4c-7c4d-11e2-a139-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{90537d4c-7c4d-11e2-a139-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.24 14:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Gibraltar
[2013.02.24 10:57:46 | 000,000,000 | ---D | C] -- C:\Users\Admin\Application Data
[2013.02.23 20:26:59 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2013.02.23 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2013.02.23 20:26:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.23 18:28:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe
[2013.02.23 18:28:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Adobe
[2013.02.23 16:13:15 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\assembly
[2013.02.23 15:12:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013.02.23 15:12:24 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013.02.23 14:20:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Canon
[2013.02.23 14:20:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
[2013.02.23 14:20:40 | 000,000,000 | ---D | C] -- C:\Program Files\Canon
[2013.02.23 14:14:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Swiss Academic Software
[2013.02.23 14:14:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Citavi 3
[2013.02.23 14:14:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 3
[2013.02.23 14:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\Citavi 3
[2013.02.23 13:57:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Swiss Academic Software
[2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\ATI
[2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ATI
[2013.02.23 11:25:49 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.02.23 11:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2013.02.23 11:19:09 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2013.02.23 11:17:58 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.02.23 11:16:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst-Installationsmanager
[2013.02.23 11:15:18 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.02.22 20:11:09 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2013.02.22 18:27:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ
[2013.02.22 17:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client
[2013.02.22 17:22:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.02.22 15:52:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.02.22 15:03:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2013.02.22 15:02:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Avira
[2013.02.22 14:54:12 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.02.22 14:54:11 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013.02.22 14:54:11 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013.02.22 14:54:11 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013.02.22 14:54:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.02.22 14:54:09 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2013.02.22 11:31:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mondo Media
[2013.02.22 11:31:12 | 000,000,000 | ---D | C] -- C:\Program Files\Borland
[2013.02.22 11:30:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mondo Media
[2013.02.22 11:30:28 | 003,355,096 | ---- | C] (Two Pilots) -- C:\Windows\System32\PDFCreatorPilot3.dll
[2013.02.22 11:30:25 | 000,552,960 | ---- | C] (netnorm GmbH) -- C:\Windows\System32\WebTRADESSL.dll
[2013.02.22 11:30:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mondo Media
[2013.02.22 10:26:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2013.02.22 10:04:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2013.02.22 10:02:25 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2013.02.22 09:51:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2013.02.21 22:07:11 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Drucker
[2013.02.21 22:00:48 | 000,000,000 | ---D | C] -- C:\20_02_2013
[2013.02.21 20:34:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mozilla
[2013.02.21 20:34:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Mozilla
[2013.02.21 20:34:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.02.21 20:34:27 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.02.21 20:34:27 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.21 19:56:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.02.21 19:56:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2013.02.21 19:56:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013.02.21 19:52:16 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.02.21 18:51:42 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\MigWiz
[2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches
[2013.02.21 18:50:03 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.02.21 18:49:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities
[2013.02.21 18:49:55 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts
[2013.02.21 18:49:54 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\VirtualStore
[2013.02.21 18:49:52 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop
[2013.02.21 18:49:52 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten
[2013.02.21 18:49:52 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten
[2013.02.21 18:49:52 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData
[2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Temp
[2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft
[2013.02.21 18:49:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.02.21 18:47:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.02.21 18:46:41 | 000,000,000 | ---D | C] -- C:\Windows\Debug
[2013.02.21 18:41:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.02.21 18:39:00 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.02.21 18:38:59 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013.02.21 18:38:07 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.02.21 18:37:53 | 000,000,000 | -HSD | C] -- C:\Boot
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.24 17:56:59 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 17:56:59 | 000,004,112 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 17:56:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.24 17:56:45 | 2010,619,904 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 14:38:25 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.24 14:38:25 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.24 14:38:25 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.24 14:38:25 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.24 14:28:30 | 000,318,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.02.23 20:37:52 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2013.02.23 15:12:46 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2013.02.23 14:20:48 | 000,001,876 | ---- | M] () -- C:\Users\Public\Desktop\MP Navigator EX 1.1.lnk
[2013.02.23 14:14:11 | 000,001,836 | ---- | M] () -- C:\Users\Public\Desktop\Citavi 3.lnk
[2013.02.23 11:03:17 | 000,000,680 | ---- | M] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat
[2013.02.22 20:09:01 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.02.22 19:40:22 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2013.02.22 19:40:22 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2013.02.22 19:40:13 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013.02.22 15:52:03 | 000,001,847 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.02.22 14:52:13 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013.02.22 14:52:12 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013.02.22 14:52:08 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013.02.22 14:52:03 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013.02.22 11:30:35 | 000,000,877 | ---- | M] () -- C:\Users\Admin\Desktop\Mondo Shop 4.lnk
[2013.02.22 10:05:29 | 000,131,072 | ---- | M] () -- C:\Windows\SPInstall.etl
[2013.02.22 08:31:40 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2013.02.21 20:34:29 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.02.21 18:43:14 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
[2013.02.21 18:42:32 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2013.02.21 18:37:54 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
 
========== Files Created - No Company Name ==========
 
[2013.02.23 15:12:46 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2013.02.23 15:12:46 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2013.02.23 14:20:48 | 000,001,876 | ---- | C] () -- C:\Users\Public\Desktop\MP Navigator EX 1.1.lnk
[2013.02.23 14:14:11 | 000,001,836 | ---- | C] () -- C:\Users\Public\Desktop\Citavi 3.lnk
[2013.02.23 11:24:37 | 2010,619,904 | -HS- | C] () -- C:\hiberfil.sys
[2013.02.23 11:17:03 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2013.02.23 11:17:03 | 000,328,162 | ---- | C] () -- C:\Windows\System32\drivers\ativcaxx.cpa
[2013.02.23 11:17:03 | 000,048,736 | ---- | C] () -- C:\Windows\System32\drivers\ativvpxx.vp
[2013.02.23 11:17:03 | 000,011,557 | ---- | C] () -- C:\Windows\atiogl.xml
[2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativpkxx.vp
[2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativokxx.vp
[2013.02.23 11:17:03 | 000,002,096 | ---- | C] () -- C:\Windows\System32\drivers\ativdkxx.vp
[2013.02.23 11:17:03 | 000,000,929 | ---- | C] () -- C:\Windows\System32\drivers\ativcaxx.vp
[2013.02.22 20:09:01 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2013.02.22 19:40:13 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013.02.22 19:04:38 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.02.22 19:04:38 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.02.22 14:56:45 | 000,001,847 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.02.22 13:59:38 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2013.02.22 13:59:38 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2013.02.22 13:59:38 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2013.02.22 12:02:10 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2013.02.22 11:31:12 | 000,184,832 | ---- | C] () -- C:\Windows\System32\BDEADMIN.CPL
[2013.02.22 11:30:35 | 000,000,877 | ---- | C] () -- C:\Users\Admin\Desktop\Mondo Shop 4.lnk
[2013.02.22 11:30:28 | 000,221,184 | ---- | C] () -- C:\Windows\System32\TidyATL.dll
[2013.02.22 09:56:03 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2013.02.22 09:56:03 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2013.02.22 09:56:03 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
[2013.02.22 09:56:00 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2013.02.22 09:55:58 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2013.02.22 09:55:57 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2013.02.22 09:55:45 | 011,967,524 | ---- | C] () -- C:\Windows\System32\korwbrkr.lex
[2013.02.22 09:55:45 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2013.02.22 09:55:41 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2013.02.22 09:55:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2013.02.22 09:55:40 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2013.02.22 09:55:40 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2013.02.22 09:55:39 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2013.02.22 06:48:21 | 000,131,072 | ---- | C] () -- C:\Windows\SPInstall.etl
[2013.02.21 22:00:33 | 000,088,025 | ---- | C] () -- C:\Aktivierungscode AviraAntiVirPremium.eml
[2013.02.21 20:34:29 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013.02.21 20:34:29 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.02.21 19:57:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2013.02.21 18:50:04 | 000,000,949 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.02.21 18:50:03 | 000,000,944 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2013.02.21 18:49:55 | 000,000,915 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2013.02.21 18:49:53 | 000,000,680 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat
[2013.02.21 18:42:59 | 000,000,604 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live.lnk
[2013.02.21 18:42:32 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2013.02.21 18:37:54 | 000,008,192 | R-S- | C] () -- C:\BOOTSECT.BAK
[2013.02.21 18:37:53 | 000,333,257 | RHS- | C] () -- C:\bootmgr
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 23:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 23:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.02.23 14:21:36 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Canon
[2013.02.22 11:31:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Mondo Media
[2013.02.23 14:16:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Swiss Academic Software
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 3 bytes -> C:\Aktivierungscode AviraAntiVirPremium.eml:OECustomProperty

< End of report >
         
--- --- ---


OTL ExtrasOTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 24.02.2013 17:34:53 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Ursula\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 66,76% Memory free
3,99 Gb Paging File | 3,17 Gb Available in Paging File | 79,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,66 Gb Total Space | 62,13 Gb Free Space | 63,62% Space Free | Partition Type: NTFS
Drive D: | 115,38 Gb Total Space | 115,05 Gb Free Space | 99,71% Space Free | Partition Type: NTFS
 
Computer Name: BÜRO-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{057424B3-1AE5-91BF-E9EF-ED506244D448}" = ATI Catalyst Install Manager
"{0C5D411E-37E3-3618-DF2A-4A7E06C4858D}" = ccc-core-static
"{1E98D1B6-4988-EBF6-8028-6BE44FB06381}" = Skins
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{7433F2C1-F40C-DAF1-58A7-717E39058AF8}" = ccc-utility
"{87C6CEBB-7A5A-3FC6-983E-57509F1A76CB}" = Catalyst Control Center Graphics Light
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9F6ED110-AF1C-5166-F4A6-893D7024C8A5}" = CCC Help German
"{A2DA1DBB-C9F6-6404-6D9C-D4F4523ED78B}" = Catalyst Control Center Graphics Previews Vista
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A7EBE707-EF21-3F23-8280-FB67C0FB8893}" = Catalyst Control Center Graphics Full Existing
"{AA632347-755A-032D-DD4A-9F100D3E70FF}" = Catalyst Control Center Graphics Full New
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{C936CE22-9E2E-65D5-949B-0ACD9E76BC16}" = Catalyst Control Center Core Implementation
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFA20EDB-ACEF-409C-9230-2D5AD7D51882}" = Catalyst Control Center - Branding
"{DC248B14-466D-10D3-1F63-606923AF9687}" = Catalyst Control Center Localization German
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Avira AntiVir Desktop" = Avira Free Antivirus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MONDOSHOP4_is1" = MONDO SHOP 4 deinstallieren
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.1" = Canon MP Navigator EX 1.1
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.6.0.2
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.02.2013 09:11:43 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 24.02.2013 09:11:44 | Computer Name = Büro-PC | Source = Perflib | ID = 1010
Description = 
 
Error - 24.02.2013 09:11:45 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 24.02.2013 09:11:45 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1008
Description = 
 
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1005
Description = 
 
Error - 24.02.2013 09:11:46 | Computer Name = Büro-PC | Source = Perflib | ID = 1018
Description = 
 
Error - 24.02.2013 09:29:40 | Computer Name = Büro-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.02.2013 09:31:53 | Computer Name = Büro-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 24.02.2013 09:34:32 | Computer Name = Büro-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 24.02.2013 12:10:46 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:10:50 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:10:54 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:10:58 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:11:02 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:11:06 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:21:44 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:22:59 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:33:49 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 24.02.2013 12:34:53 | Computer Name = Büro-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
 
< End of report >
         
--- --- ---

GMER Logfile:
Code:
ATTFilter
GMER 2.1.19081 - hxxp://www.gmer.net
Rootkit scan 2013-02-24 18:45:51
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD321KJ rev.CP100-12 298,09GB
Running: gmer_2.1.19081.exe; Driver: C:\Users\Admin\AppData\Local\Temp\kxldqpog.sys


---- System - GMER 2.1 ----

SSDT   8981F3CE                       ZwCreateSection
SSDT   8981F3D8                       ZwRequestWaitReplyPort
SSDT   8981F3D3                       ZwSetContextThread
SSDT   8981F3DD                       ZwSetSecurityObject
SSDT   8981F3E2                       ZwSystemDebugControl
SSDT   8981F36F                       ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!KeSetEvent + 215  81CF78D8 4 Bytes  [CE, F3, 81, 89]
.text  ntkrnlpa.exe!KeSetEvent + 539  81CF7BFC 4 Bytes  [D8, F3, 81, 89]
.text  ntkrnlpa.exe!KeSetEvent + 56D  81CF7C30 4 Bytes  [D3, F3, 81, 89]
.text  ntkrnlpa.exe!KeSetEvent + 5D1  81CF7C94 4 Bytes  [DD, F3, 81, 89]
.text  ntkrnlpa.exe!KeSetEvent + 619  81CF7CDC 4 Bytes  [E2, F3, 81, 89]
.text  ...                            

---- Disk sectors - GMER 2.1 ----

Disk   \Device\Harddisk0\DR0          unknown MBR code

---- EOF - GMER 2.1 ----
         
--- --- ---

Otl für Computer B:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 24.02.2013 17:31:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Klauso\Downloads
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 50,56% Memory free
3,99 Gb Paging File | 2,82 Gb Available in Paging File | 70,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 93,13 Gb Total Space | 48,63 Gb Free Space | 52,22% Space Free | Partition Type: NTFS
 
Computer Name: ARWED | User Name: Klaus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.24 17:30:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Klauso\Downloads\OTL.exe
PRC - [2012.08.28 19:39:37 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.26 18:32:12 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.26 18:32:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.26 18:32:10 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.05.08 09:35:50 | 002,780,432 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009.05.08 09:34:08 | 000,559,888 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009.04.30 15:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2009.04.30 13:39:30 | 005,472,016 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Logitech Vid\Vid.exe
PRC - [2009.04.20 14:34:18 | 000,816,904 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\Logitech WebCam Software\LU\LogitechUpdate.exe
PRC - [2009.04.20 14:34:00 | 000,300,296 | ---- | M] (Logitech, Inc.) -- c:\Programme\Logitech\Logitech WebCam Software\LU\LULnchr.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.05.29 21:30:18 | 002,580,480 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.bin
PRC - [2008.05.29 21:28:18 | 002,363,392 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.4\program\soffice.exe
PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.19 08:33:30 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.19 08:33:04 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2006.12.23 18:05:20 | 000,143,360 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006.12.23 18:04:42 | 000,905,216 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2006.11.14 14:47:54 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Programme\Common Files\aol\1173082611\ee\aolsoftware.exe
PRC - [2006.10.23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Programme\Common Files\aol\acs\AOLacsd.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.05.08 09:35:50 | 002,780,432 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009.05.08 09:35:28 | 000,181,520 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LvApi11\LvApi11.dll
MOD - [2009.04.30 13:39:56 | 000,138,000 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
MOD - [2009.04.30 13:39:56 | 000,035,088 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
MOD - [2009.04.30 13:39:52 | 000,028,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
MOD - [2009.04.30 13:39:08 | 000,027,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\SDL.dll
MOD - [2009.04.30 13:38:56 | 000,363,792 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtxml4.dll
MOD - [2009.04.30 13:38:44 | 011,311,888 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtWebKit4.dll
MOD - [2009.04.30 13:38:34 | 000,199,952 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\qtsql4.dll
MOD - [2009.04.30 13:38:22 | 000,968,976 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtNetwork4.dll
MOD - [2009.04.30 13:38:22 | 000,475,408 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtOpenGL4.dll
MOD - [2009.04.30 13:38:10 | 007,704,336 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtGui4.dll
MOD - [2009.04.30 13:37:58 | 002,140,944 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\QtCore4.dll
MOD - [2009.04.30 13:37:48 | 000,291,600 | ---- | M] () -- C:\Programme\Logitech\Logitech Vid\phonon4.dll
MOD - [2007.12.19 14:04:24 | 000,828,416 | ---- | M] () -- C:\Programme\OpenOffice.org 2.4\program\libxml2.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2012.05.26 18:32:12 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.26 18:32:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.04.30 15:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2006.10.23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Programme\Common Files\aol\acs\AOLacsd.exe -- (AOL ACS)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.05.26 18:32:12 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.26 18:32:12 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.05.01 00:03:08 | 006,754,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
DRV - [2009.05.01 00:01:36 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2009.05.01 00:00:00 | 000,114,712 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2009.04.30 15:00:12 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007.02.27 15:46:12 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2007.01.15 17:35:18 | 001,032,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2006.12.22 20:28:56 | 000,100,648 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2006.12.19 13:38:00 | 004,447,808 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.11.01 21:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw)
DRV - [2000.07.24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\BRPAR.SYS -- (BrPar)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2008.09.13 16:52:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.02 10:56:13 | 000,000,000 | ---D | M]
 
[2008.09.13 16:52:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Extensions
[2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions
[2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013.02.24 11:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\Firefox\Profiles\veyedxb5.default\extensions\staged-xpis
[2009.03.18 13:40:42 | 000,019,153 | ---- | M] () (No name found) -- C:\Users\Klaus\AppData\Roaming\mozilla\firefox\profiles\veyedxb5.default\extensions\staged-xpis\{20a82645-c095-46ed-80e3-08825760534b}\MicrosoftDotNetFrameworkAssistant.xpi
[2010.06.30 16:23:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.30 16:23:24 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.30 16:23:24 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2008.12.29 14:45:18 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009.05.27 17:32:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2008.03.15 14:56:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2008.03.15 14:56:14 | 000,002,642 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2008.02.19 15:40:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2006.12.03 16:59:22 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2006.11.17 12:19:24 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [AuditVista]   File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HostManager] C:\Programme\Common Files\aol\1173082611\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b File not found
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{27D05CA5-8F22-4C21-BC26-A9C0C568B630}: NameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35E37816-A589-468D-B729-C310A1F90A5A}: DhcpNameServer = 192.168.15.155 192.168.5.57 192.168.5.56
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img11.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\configure\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{525ff198-c8d8-11db-ad7f-806e6f6e6963}\Shell\install\command - "" = D:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.24 15:09:57 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Roaming\Malwarebytes
[2013.02.24 15:09:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.02.24 15:09:39 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.02.24 15:09:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.02.24 11:34:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.02.24 11:33:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2013.02.24 11:33:14 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.02.24 11:30:50 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Roaming\Avira
[2013.02.24 11:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services
[2013.02.24 11:30:24 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW
[2013.02.24 11:29:17 | 000,000,000 | ---D | C] -- C:\Users\Klaus\AppData\Local\Microsoft Help
[2013.02.24 11:29:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2013.02.24 11:28:41 | 000,000,000 | RH-D | C] -- C:\MSOCache
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.24 17:24:22 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BD8977C5-8EC2-45CD-B800-AF3258EB1DA6}.job
[2013.02.24 16:56:39 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 16:56:39 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 15:54:52 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.02.24 15:54:52 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.02.24 15:54:52 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.02.24 15:54:52 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.02.24 15:50:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.24 15:50:13 | 2012,553,216 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 15:50:12 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2013.02.24 15:09:41 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.02.24 12:03:54 | 000,348,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2013.02.24 15:09:41 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2009.05.27 16:56:55 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.09.13 22:51:00 | 000,004,608 | ---- | C] () -- C:\Users\Klaus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.08.20 14:49:07 | 000,000,350 | ---- | C] () -- C:\Users\Klaus\AppData\Roaming\wklnhst.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 16:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.03.03 05:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.19 08:36:49 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.08.04 11:44:15 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\Leadertech
[2008.08.20 14:49:08 | 000,000,000 | ---D | M] -- C:\Users\Klaus\AppData\Roaming\Template
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---



OTL Extras Computer BOTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 24.02.2013 17:31:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Klauso\Downloads
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 50,56% Memory free
3,99 Gb Paging File | 2,82 Gb Available in Paging File | 70,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 93,13 Gb Total Space | 48,63 Gb Free Space | 52,22% Space Free | Partition Type: NTFS
 
Computer Name: ARWED | User Name: Klaus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1485476C-2E20-4C40-8F25-88CE2B215957}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{15000049-5F4F-4AA7-A6AE-D33CBF47BC75}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{35D1DA28-3BC7-4415-A8AF-55B1AEE957C8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{423FAA31-4868-4DDA-AC2A-AC20503407E6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{5AE140AE-FBF4-4183-B434-3FB2823C146A}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{5BEB8857-96FA-4C6C-9BC0-62E47C340884}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{74DF1202-B3E2-418F-9DD4-4F644D8609D7}" = protocol=6 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe | 
"{9012CFB7-5370-483C-8892-E21A79DCC4F3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{9A11F177-A375-449C-B6FC-2A999E8477EE}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{B76C1215-DCC9-4A2C-B3F9-C3EF1FA7A637}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{C58D4E5D-F944-4614-A1A1-923B4AA2ED1A}" = protocol=17 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe | 
"{C893E4EC-B4E9-40AD-B4E2-3F4AEEBFFF31}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{CE5747C2-8808-4DEE-BD9A-A69462842539}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{E027ED56-32DA-4DE8-929F-5CD341E51A5F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{E9D589B0-5D0D-48CB-9B05-60DFA5D240F5}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{EAAD0F8E-2D82-448E-8D76-DFF0F381EF08}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{F7C4F9A9-D852-4317-8A09-EDE291633015}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"TCP Query User{239C429E-3701-456B-AD5A-0F7542913D27}C:\users\klauso\temp\teamviewer\version4\teamviewer.exe" = protocol=6 | dir=in | app=c:\users\klauso\temp\teamviewer\version4\teamviewer.exe | 
"TCP Query User{66AA1513-66A2-4BA8-8FEE-8AEC0715CE28}C:\program files\logitech\logitech vid\vid.exe" = protocol=6 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe | 
"UDP Query User{7B92BC18-D752-4851-A173-CD156719ABBD}C:\program files\logitech\logitech vid\vid.exe" = protocol=17 | dir=in | app=c:\program files\logitech\logitech vid\vid.exe | 
"UDP Query User{7F6884C4-2582-46B8-ABBF-0D1C94F11DC2}C:\users\klauso\temp\teamviewer\version4\teamviewer.exe" = protocol=17 | dir=in | app=c:\users\klauso\temp\teamviewer\version4\teamviewer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 13
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch
"{AC96671C-2001-432C-9826-5266D84EF1DC}" = Logitech Webcam Software
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E5488A81-631F-47FC-AAB8-03A0F87D1031}" = Nero 7 Essentials
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1PLUS_2007.a_is1" = 1PLUS_2007.a
"1PLUS_2007.d_is1" = 1PLUS_2007.d  (Portable Version, unabhängig von der BDE)
"1PLUS_2007.e_is1" = 1PLUS_2007.e  (Portable Version, unabhängig von der BDE)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Deinstallation" = AOL Deinstallation
"Avira AntiVir Desktop" = Avira Free Antivirus
"Brother HL-1430" = Brother HL-1430
"DivX Codec" = DivX Codec
"lvdrivers_12.0" = Logitech Webcam Software-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.0.1)" = Mozilla Firefox (3.0.1)
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Schroedel Arbeitsblätter" = Schroedel Arbeitsblätter
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 02.02.2012 05:56:17 | Computer Name = Arwed | Source = Windows Search Service | ID = 3026
Description = 
 
Error - 02.02.2012 05:56:55 | Computer Name = Arwed | Source = Application Hang | ID = 1002
Description = Programm avcenter.exe, Version 12.1.0.18 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: e00  Anfangszeit: 01cce190c34465db  Zeitpunkt der Beendigung:
 23
 
Error - 26.05.2012 13:33:17 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 26.05.2012 13:33:17 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 20.07.2012 12:32:33 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Vid.exe, Version 6.0.6902.0, Zeitstempel 0x49fa0c46,
 fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
 0xc0000094, Fehleroffset 0x00009520,  Prozess-ID 0x18c, Anwendungsstartzeit 01cd66952ce2374b.
 
Error - 28.08.2012 14:41:46 | Computer Name = Arwed | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 16.09.2012 16:00:26 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Vid.exe, Version 6.0.6902.0, Zeitstempel 0x49fa0c46,
 fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
 0xc0000094, Fehleroffset 0x00009520,  Prozess-ID 0x1d4, Anwendungsstartzeit 01cd9445d4671b49.
 
Error - 23.02.2013 11:58:06 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Skype.exe, Version 4.2.0.169, Zeitstempel 0x4bebfa84,
 fehlerhaftes Modul LvApi11.dll, Version 12.0.1280.0, Zeitstempel 0x4a046cae, Ausnahmecode
 0xc0000094, Fehleroffset 0x00009520,  Prozess-ID 0x130, Anwendungsstartzeit 01ce11de5bb79f2b.
 
Error - 23.02.2013 13:13:38 | Computer Name = Arwed | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung brsvc01a.exe, Version 1.0.0.3, Zeitstempel 0x3cb65dc7,
 fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode
 0xc0000005, Fehleroffset 0x00000000,  Prozess-ID 0x5b4, Anwendungsstartzeit 01ce11de599b6e1b.
 
Error - 24.02.2013 06:28:24 | Computer Name = Arwed | Source = VSS | ID = 8194
Description = 
 
[ System Events ]
Error - 24.02.2013 08:52:49 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:52:53 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:52:56 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:52:59 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:53:01 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:53:29 | Computer Name = Arwed | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 24.02.2013 08:53:52 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 08:53:55 | Computer Name = Arwed | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "E:" aus.
 
Error - 24.02.2013 10:50:26 | Computer Name = Arwed | Source = HTTP | ID = 15016
Description = 
 
Error - 24.02.2013 10:51:12 | Computer Name = Arwed | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         
--- --- ---

Gmer Computer B:

GMER Logfile:
Code:
ATTFilter
GMER 2.1.19081 - hxxp://www.gmer.net
Rootkit scan 2013-02-24 19:09:43
Windows 6.0.6001 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000052 ST332082 rev.3.AA 298,09GB
Running: gmer_2.1.19081.exe; Driver: C:\Users\.....\AppData\Local\Temp\pxldrpow.sys


---- System - GMER 2.1 ----

SSDT            8B509FC6                                                        ZwCreateSection
SSDT            8B509FD0                                                        ZwRequestWaitReplyPort
SSDT            8B509FCB                                                        ZwSetContextThread
SSDT            8B509FD5                                                        ZwSetSecurityObject
SSDT            8B509FDA                                                        ZwSystemDebugControl
SSDT            8B509F67                                                        ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetTimerEx + 448                                 820EBA6C 4 Bytes  [C6, 9F, 50, 8B]
.text           ntkrnlpa.exe!KeSetTimerEx + 76C                                 820EBD90 4 Bytes  [D0, 9F, 50, 8B]
.text           ntkrnlpa.exe!KeSetTimerEx + 7A0                                 820EBDC4 4 Bytes  [CB, 9F, 50, 8B]
.text           ntkrnlpa.exe!KeSetTimerEx + 804                                 820EBE28 4 Bytes  [D5, 9F, 50, 8B]
.text           ntkrnlpa.exe!KeSetTimerEx + 84C                                 820EBE70 4 Bytes  [DA, 9F, 50, 8B]
.text           ...                                                             
.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                        section is writeable [0x8B60F340, 0x293157, 0xE8000020]

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                        fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Processes - GMER 2.1 ----

Process          (*** hidden *** )                                              [4] 84173BD8                                                             

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS@StateIndex  0

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                           unknown MBR code

---- EOF - GMER 2.1 ----
         
--- --- ---

Ich werde heute Computer A neu aufsetzen, weil sich die ersten Programme schon wieder verabschieden.

Alt 25.02.2013, 08:38   #2
Psychotic
/// Malwareteam
 
Trojaner Sirefef.Ag.9/Pidief.hck  auf 2 PCs + externer Festplatte - Standard

Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte





Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellste und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein Rechner clean ist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
  1. Bitte arbeite alle Schritte der Reihe nach ab.
  2. Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
  3. Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
  4. Bitte kein Crossposting (posten in mehreren Foren) - wenn du die Anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
  5. Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
  6. Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!

    ...und ganz wichtig:

  7. Poste die Logfiles mit code-tags (das #-Symbol oben im Antwortfenster) in deinen Thread! Nicht anhängen, außer, ich fordere dich dazu auf. (Erschwert mir nämlich das Auswerten).


Vista und Win7 User
Alle Tools mit Rechtsklick --> "als Administrator ausführen" starten.


Wir kümmern uns hier ausschließlich um Computer B - wenn du die Festplatte von Computer A bei der Neuinstallation komplett formatiert hast, besteht dort ohnehin keine Gefahr mehr. Wenn dem nicht so ist, gib Bescheid.


Scan mit TDSS-Killer



Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile. TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ ) Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.
__________________

__________________

Alt 26.02.2013, 12:30   #3
Grasland
 
Trojaner Sirefef.Ag.9/Pidief.hck  auf 2 PCs + externer Festplatte - Standard

Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte



Hallo

und vielen Dank für die Unterstützung. Seit dem Neuaufsetzen scheint Computer A stabil zu laufen, so dass ich weiterarbeiten kann.

Da mir im Moment die zeitlichen Ressourcen fehlen, kann ich mich nicht zeitnah um Computer B kümmern und würde das auf später verschieben. Er wird im Moment nicht gebraucht.

Wäre es möglich diesen Threat zu löschen, weil einige persönliche Daten in der Eile in den logfiles nicht gelöscht wurden. Das wäre mir sehr recht!!!

Vielen Dank nochmals für das Angebot Trojanerboard, es ist sehr hilfreich.
__________________

Alt 26.02.2013, 12:35   #4
Psychotic
/// Malwareteam
 
Trojaner Sirefef.Ag.9/Pidief.hck  auf 2 PCs + externer Festplatte - Standard

Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte



Zitat:
Zitat von Grasland Beitrag anzeigen

Wäre es möglich diesen Threat zu löschen, weil einige persönliche Daten in der Eile in den logfiles nicht gelöscht wurden. Das wäre mir sehr recht!!!
Grundsätzlich nein - beachte hier zu jedoch http://www.trojaner-board.de/108422-...-anfragen.html


----------------------------------------------------------------------------------------------

Dieses Thema scheint erledigt und wurde aus meinen Abos gelöscht.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und ein eigenes Thema erstellen!
__________________
Kein Asylrecht für Trojaner!

Proud Member of UNITE

Hinweis: Ich bin nur werktags erreichbar!
Anfragen über PM werden ignoriert!

Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board!

Antwort

Themen zu Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte
administrator, anti-malware, antivir, appdata, autostart, befall, betriebssystem, branding, computer, dateien, erkannt, explorer, fast start, festgestellt, festplatte, gelöscht, install.exe, linux, neu, neu aufsetzen, nicht mehr, not, onlineshop, speicher, systeme, trojan.p2p.worm, trojaner, unbedingt, unknown mbr, vista, windows, zugriff



Ähnliche Themen: Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte


  1. Verdacht: Trojaner auf externer Festplatte
    Plagegeister aller Art und deren Bekämpfung - 09.04.2014 (17)
  2. Trojaner von externer Festplatte in avast! Container verschoben. Und jetzt?
    Plagegeister aller Art und deren Bekämpfung - 18.05.2013 (28)
  3. Trojaner e621ca05.exe auf externer Festplatte. Ist auch mein Rechner befallen?
    Log-Analyse und Auswertung - 21.11.2012 (10)
  4. Dropper und Trojaner in Externer Festplatte - Fake Meldung?
    Plagegeister aller Art und deren Bekämpfung - 24.08.2012 (4)
  5. Trojaner versteckt Dateien auf externer Festplatte
    Plagegeister aller Art und deren Bekämpfung - 21.05.2012 (1)
  6. Mehre Versionen der Trojaner Sirefef und Conedex gefunden. Löschbar oder Festplatte formatieren?
    Plagegeister aller Art und deren Bekämpfung - 06.03.2012 (9)
  7. Trojaner auf externer Festplatte - Aus Ordnern wurden Verlinkungen
    Plagegeister aller Art und deren Bekämpfung - 31.01.2012 (3)
  8. Trojaner auf Externer Festplatte - Kein zuriff auf Ordner
    Plagegeister aller Art und deren Bekämpfung - 05.08.2011 (34)
  9. Windows Recovery Trojaner - erste Bekämpfung und Frage zu externer Festplatte
    Log-Analyse und Auswertung - 30.04.2011 (12)
  10. Gefahr für Mac durch Trojaner/Malware auf externer Festplatte?
    Alles rund um Mac OSX & Linux - 07.04.2011 (39)
  11. Virus autorun.inf auf Festplatte, externer Festplatte und USB
    Plagegeister aller Art und deren Bekämpfung - 15.02.2011 (20)
  12. Trojaner Fund TR/StartPage.PVU & TR/Dldr.Age.1171323 auf externer Festplatte
    Log-Analyse und Auswertung - 28.01.2011 (1)
  13. Trojaner im Recycler auf externer Festplatte gefunden: TR/Autorun.nt
    Plagegeister aller Art und deren Bekämpfung - 20.10.2010 (3)
  14. Sparkassen-Trojaner (40 TANs) von externer Festplatte entfernen
    Plagegeister aller Art und deren Bekämpfung - 06.08.2010 (16)
  15. Virus (Trojaner Win32 Fake/AV) auf externer Festplatte
    Plagegeister aller Art und deren Bekämpfung - 03.02.2010 (1)
  16. Trojaner (trojan.downloader) auf externer Festplatte.
    Log-Analyse und Auswertung - 18.05.2009 (0)
  17. Trojaner auf externer Festplatte
    Mülltonne - 03.07.2008 (0)

Zum Thema Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte - Guten Tag zusammen, seit vergangenen Mittwoch hat mich ein Trojanerangriff in Beschlag. Zunächst war Computer A betroffen. Computer A: Auf Computer A wurde Antivir beschädigt und unbrauchbar gemacht. Es wurde - Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte...
Archiv
Du betrachtest: Trojaner Sirefef.Ag.9/Pidief.hck auf 2 PCs + externer Festplatte auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.