| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojan.Agent und Backdoor.botWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.02.2010, 10:40
| #46 |
 |  Trojan.Agent und Backdoor.bot Deine Tastenkombies funktionieren bei mir nicht! Noch keine  d.h. strg v öffnet sich in Paint nichts... Doch, google hilft!^^ Habe es jetzt gespeichert!!! Anhäge verwalten???wo steht das? Geändert von Sandy77 (02.02.2010 um 10:53 Uhr) |
|
02.02.2010, 10:49
| #47 |
| /// Selecta Jahrusso   |  Trojan.Agent und Backdoor.bot doch die funktionieren
__________________ Nimm dir Zeit du musst natürlich auch ins paintfenster klicken damit windows weis was du machen willst
__________________ |
|
02.02.2010, 10:53
| #48 |
| /// Selecta Jahrusso | Trojan.Agent und Backdoor.bot Gerade eingefallen, geht auch anders
__________________ Start PE, links oben auf FILE --> Save as --> speichere die Datei am Desktop und poste mir den Inhalt 
__________________ |
|
02.02.2010, 11:03
| #49 |
| | Trojan.Agent und Backdoor.botCode:
ATTFilter Process PID CPU Description Company Name CPU History
System Idle Process 0 99.23
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 472 Windows Session Manager Microsoft Corporation
csrss.exe 596 Client-Server-Laufzeitprozess Microsoft Corporation
wininit.exe 636 Windows-Startanwendung Microsoft Corporation
services.exe 680 Anwendung für Dienste und Controller Microsoft Corporation
svchost.exe 880 Hostprozess für Windows-Dienste Microsoft Corporation
mobsync.exe 3668 Microsoft Sync Center Microsoft Corporation
mcagent.exe 3696 McAfee Integrated Security Platform McAfee, Inc.
nvvsvc.exe 928 NVIDIA Driver Helper Service, Version 175.19 NVIDIA Corporation
rundll32.exe 1348 Windows-Hostprozess (Rundll32) Microsoft Corporation
svchost.exe 956 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 1088 Hostprozess für Windows-Dienste Microsoft Corporation
audiodg.exe 1252 Windows Graphisolierung für Audiogeräte Microsoft Corporation
svchost.exe 1124 Hostprozess für Windows-Dienste Microsoft Corporation
dwm.exe 2320 Desktopfenster-Manager Microsoft Corporation
WUDFHost.exe 2976 Windows Driver Foundation - Benutzermodus-Treiberframework-Hostprozess Microsoft Corporation
svchost.exe 1144 Hostprozess für Windows-Dienste Microsoft Corporation
taskeng.exe 2144 Aufgabenplanungsmodul Microsoft Corporation
taskeng.exe 3112 Aufgabenplanungsmodul Microsoft Corporation
wuauclt.exe 5592 Windows Update Microsoft Corporation
svchost.exe 1276 Hostprozess für Windows-Dienste Microsoft Corporation
SLsvc.exe 1296 Microsoft-Softwarelizenzierungsdienst Microsoft Corporation
svchost.exe 1376 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 1536 Hostprozess für Windows-Dienste Microsoft Corporation
spoolsv.exe 1724 Spoolersubsystem-Anwendung Microsoft Corporation
svchost.exe 1748 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 564 Hostprozess für Windows-Dienste Microsoft Corporation
LSSrvc.exe 888 LightScribe Service Hewlett-Packard Company
McSACore.exe 1244 SiteAdvisor McAfee, Inc.
rundll32.exe 2020 Windows-Hostprozess (Rundll32) Microsoft Corporation
McProxy.exe 1416 McAfee Proxy Service Module McAfee, Inc.
Mcshield.exe 1980 On-Access Scanner service McAfee, Inc.
MpfSrv.exe 2076 McAfee Personal Firewall Service McAfee, Inc.
msksrver.exe 2120 McAfee Anti-Spam Server McAfee, Inc.
svchost.exe 2236 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 2308 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 2352 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 2432 Hostprozess für Windows-Dienste Microsoft Corporation
svchost.exe 2588 Hostprozess für Windows-Dienste Microsoft Corporation
SearchIndexer.exe 2660 Microsoft Windows Search Indexer Microsoft Corporation
mcmscsvc.exe 3464 McAfee Services McAfee, Inc.
svchost.exe 772 Hostprozess für Windows-Dienste Microsoft Corporation
wmpnetwk.exe 3360 Windows Media Player-Netzwerkfreigabedienst Microsoft Corporation
mcsysmon.exe 3592 McAfee SystemGuards Service McAfee, Inc.
McNASvc.exe 3588 McAfee Network Agent McAfee, Inc.
lsass.exe 692 Local Security Authority Process Microsoft Corporation
lsm.exe 700 Lokaler Sitzungs-Manager-Dienst Microsoft Corporation
csrss.exe 648 Client-Server-Laufzeitprozess Microsoft Corporation
winlogon.exe 816 Windows-Anmeldeanwendung Microsoft Corporation
explorer.exe 2600 Windows-Explorer Microsoft Corporation
GrooveMonitor.exe 3300 GrooveMonitor Utility Microsoft Corporation
jusched.exe 3688 Java(TM) Update Scheduler Sun Microsystems, Inc.
GoogleToolbarNotifier.exe 3916 GoogleToolbarNotifier Google Inc.
hpqtra08.exe 3924 HP Digital Imaging Monitor Hewlett-Packard Co.
hpqste08.exe 2212 HP CUE Status Root Hewlett-Packard Co.
wmpnscfg.exe 3188 Windows Media Player Network Sharing Service Configuration Application Microsoft Corporation
firefox.exe 3852 Firefox Mozilla Corporation
procexp.exe 4400 0.77 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
mspaint.exe 4764 Paint Microsoft Corporation
Cool, was ich hier alles noch so lerne!^^ Was ist überhaupt mit den Log, konntest du was sehen...Ist der/das/die Trojaner noch da??? |
|
02.02.2010, 11:57
| #50 |
| /// Selecta Jahrusso | Trojan.Agent und Backdoor.bot Ich sehe da nichts mehr. Versuchen wir es mal mit Rooter.exe Downloade Dir bitte Rooter.exe ( by Eric_71 ) und speichere es auf dem Desktop. Wichtig: Schließe alle laufenden Programme. Trenne dich vom Internet. Deaktiviere Dein Anti Viren Programm sowie vorhandene Hintergrundwächter. Bitte nichts am Computer machen während der Scan läuft. Aktiviere Dein Anti Viren Programm bevor Du wieder ins Netz gehst.
Poste mir bitte die Logfile. schritt 2. Poste mir eine neue OTL Logfile
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
02.02.2010, 14:22
| #51 |
| | Trojan.Agent und Backdoor.bot Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully ... . Windows Vista Home Edition (6.0.6001) Service Pack 1 [32_bits] - x86 Family 15 Model 107 Stepping 1, AuthenticAMD . [wscsvc] (Security Center) RUNNING (state:4) [MpsSvc] RUNNING (state:4) Windows Firewall -> Disabled ! Windows Defender -> Disabled ! User Account Control (UAC) -> Disabled ! . Internet Explorer 8.0.6001.18882 Mozilla Firefox 3.6 (de) . C:\ [Fixed-NTFS] .. ( Total:292 Go - Free:247 Go ) D:\ [Fixed-NTFS] .. ( Total:5 Go - Free:2 Go ) E:\ [Removable] F:\ [Removable] G:\ [Removable] H:\ [Removable] I:\ [CD_Rom] K:\ [CD_Rom] . Scan : 14:19.40 Path : C:\Users\saskia\Downloads\Rooter.exe User : saskia ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) Locked System (4) ______ \SystemRoot\System32\smss.exe (472) ______ C:\Windows\system32\csrss.exe (596) ______ C:\Windows\system32\wininit.exe (636) ______ C:\Windows\system32\csrss.exe (648) ______ C:\Windows\system32\services.exe (680) ______ C:\Windows\system32\lsass.exe (692) ______ C:\Windows\system32\lsm.exe (700) ______ C:\Windows\system32\winlogon.exe (816) ______ C:\Windows\system32\svchost.exe (880) ______ C:\Windows\system32\nvvsvc.exe (928) ______ C:\Windows\system32\svchost.exe (956) ______ C:\Windows\System32\svchost.exe (1088) ______ C:\Windows\System32\svchost.exe (1124) ______ C:\Windows\system32\svchost.exe (1144) Locked audiodg.exe (1252) ______ C:\Windows\system32\svchost.exe (1276) ______ C:\Windows\system32\SLsvc.exe (1296) ______ C:\Windows\system32\rundll32.exe (1348) ______ C:\Windows\system32\svchost.exe (1376) ______ C:\Windows\system32\svchost.exe (1536) ______ C:\Windows\System32\spoolsv.exe (1724) ______ C:\Windows\system32\svchost.exe (1748) ______ C:\Windows\system32\svchost.exe (564) ______ C:\Program Files\Common Files\LightScribe\LSSrvc.exe (888) ______ C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (1244) ______ c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (1416) ______ C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (1980) ______ C:\Windows\system32\rundll32.exe (2020) ______ C:\Program Files\McAfee\MPF\MPFSrv.exe (2076) ______ C:\Program Files\McAfee\MSK\MskSrver.exe (2120) ______ C:\Windows\system32\taskeng.exe (2144) ______ C:\Windows\System32\svchost.exe (2236) ______ C:\Windows\System32\svchost.exe (2308) ______ C:\Windows\system32\Dwm.exe (2320) ______ C:\Windows\system32\svchost.exe (2352) ______ C:\Windows\system32\svchost.exe (2432) ______ C:\Windows\System32\svchost.exe (2588) ______ C:\Windows\Explorer.EXE (2600) ______ C:\Windows\system32\SearchIndexer.exe (2660) ______ C:\Windows\system32\WUDFHost.exe (2976) ______ C:\Windows\system32\taskeng.exe (3112) ______ C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (3300) ______ C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (3464) ______ C:\Windows\System32\mobsync.exe (3668) ______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (3688) ______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (3696) ______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3916) ______ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (3924) ______ C:\Program Files\Windows Media Player\wmpnscfg.exe (3188) ______ C:\Windows\system32\svchost.exe (772) ______ C:\Program Files\Windows Media Player\wmpnetwk.exe (3360) ______ C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2212) ______ C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (3592) ______ c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (3588) ______ C:\Windows\system32\wuauclt.exe (5592) ______ C:\Program Files\Mozilla Firefox\firefox.exe (6984) ______ C:\Users\saskia\Downloads\Rooter.exe (5136) . ----------------------\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:313779027968) \Device\Harddisk0\Partition2 (Start_Offset:313780076544 | Length:6291456000) . ----------------------\\ Scheduled Tasks . C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job C:\Windows\Tasks\McDefragTask.job C:\Windows\Tasks\McQcTask.job C:\Windows\Tasks\SA.DAT C:\Windows\Tasks\SCHEDLGU.TXT C:\Windows\Tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job . ----------------------\\ Registry . . ----------------------\\ Files & Folders . ----------------------\\ Scan completed at 14:19.43 . C:\Rooter$\Rooter_1.txt - (02/02/2010 | 14:19.43) |
|
02.02.2010, 14:43
| #52 |
| | Trojan.Agent und Backdoor.botCode:
ATTFilter OTL logfile created on: 02.02.2010 14:25:23 - Run 2 OTL by OldTimer - Version 3.1.27.1 Folder = C:\Users\saskia\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18882) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 58,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 292,23 Gb Total Space | 247,92 Gb Free Space | 84,84% Space Free | Partition Type: NTFS Drive D: | 5,86 Gb Total Space | 2,16 Gb Free Space | 36,78% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: FAMILIEN-PC Current User Name: saskia Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010.01.31 16:10:32 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\saskia\Downloads\OTL.exe PRC - [2010.01.16 04:11:49 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.01.11 15:21:52 | 000,246,504 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jusched.exe PRC - [2009.12.08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\SiteAdvisor\McSACore.exe PRC - [2009.11.04 16:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan\Mcshield.exe PRC - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan\mcsysmon.exe PRC - [2009.10.29 06:54:44 | 001,218,008 | ---- | M] (McAfee, Inc.) -- c:\Programme\McAfee.com\Agent\mcagent.exe PRC - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MSC\mcmscsvc.exe PRC - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MPF\MpfSrv.exe PRC - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\MSK\msksrver.exe PRC - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009.02.23 17:47:28 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.05.16 13:01:00 | 000,118,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe PRC - [2008.01.19 08:33:40 | 000,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.19 08:33:15 | 000,095,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mobsync.exe PRC - [2007.07.25 14:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Common Files\LightScribe\LSSrvc.exe PRC - [2007.03.11 21:32:42 | 000,151,552 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\Digital Imaging\bin\hpqste08.exe PRC - [2007.03.11 21:26:24 | 000,210,520 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe ========== Modules (SafeList) ========== MOD - [2010.01.31 16:10:32 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Users\saskia\Downloads\OTL.exe MOD - [2009.12.08 13:12:24 | 000,014,544 | ---- | M] (McAfee, Inc.) -- c:\Programme\McAfee\SiteAdvisor\sahook.dll MOD - [2008.01.19 08:26:34 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (TuneUp.UtilitiesSvc) SRV - File not found [Unknown | Stopped] -- -- (TuneUp.Defrag) SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService) SRV - File not found [Auto | Stopped] -- -- (AntiVirService) SRV - File not found [Auto | Stopped] -- -- (AntiVirScheduler) SRV - [2009.12.08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2009.11.04 16:53:34 | 000,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan\Mcshield.exe -- (McShield) SRV - [2009.11.04 15:59:50 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Programme\McAfee\VirusScan\mcsysmon.exe -- (McSysmon) SRV - [2009.10.29 06:54:44 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Programme\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2009.10.28 11:50:32 | 000,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2009.10.27 11:19:46 | 000,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2009.10.02 13:02:56 | 000,026,640 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSK\MskSrver.exe -- (MSK80Service) SRV - [2009.07.11 20:59:37 | 000,133,104 | ---- | M] (Google Inc.) [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1ca026221051141) Google Update Service (gupdate1ca026221051141) SRV - [2009.07.08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Programme\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy) SRV - [2009.07.07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Programme\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2009.06.09 19:02:57 | 000,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2008.11.04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008.10.25 11:44:08 | 000,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) SRV - [2008.05.16 13:01:00 | 000,118,784 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\System32\nvvsvc.exe -- (nvsvc) SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 08:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2008.01.19 08:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) SRV - [2007.10.25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc) SRV - [2007.07.25 14:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2007.03.11 22:02:52 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007.03.11 21:24:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2006.11.08 16:35:38 | 000,053,248 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\System32\HPZipm12.dll -- (Pml Driver HPZ12) SRV - [2006.11.08 16:35:36 | 000,043,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\System32\HPZinw12.dll -- (Net Driver HPZ12) SRV - [2006.11.02 13:35:29 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.prosieben.de/index.php?icqpath=icq IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:3.1.2 FF - prefs.js..extensions.enabledItems: {2f17f610-5e97-4fed-828f-9940b7b577a4}:1.4.4 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7 FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0 FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010.02.01 22:40:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.01 14:36:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.01.28 16:56:06 | 000,000,000 | ---D | M] [2010.01.27 12:29:30 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Extensions [2010.02.01 18:42:13 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions [2010.01.27 12:33:26 | 000,000,000 | ---D | M] (TV-Fox) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2010.01.30 15:01:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.01.30 15:01:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.01.27 12:31:36 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\mozilla\Firefox\Profiles\hxdmxmdh.default\extensions\smarterwiki@wikiatic.com [2010.02.01 18:42:13 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2006.07.31 15:07:16 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll [2010.01.16 02:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 02:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 02:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 02:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 02:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Programme\McAfee\MSK\mskapbho.dll () O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [McENUI] C:\Programme\McAfee\MHN\McENUI.exe (McAfee, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://games.icq.com/online/online2/zuma/popcaploader_v6.cab (PopCapLoader Object) O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img16.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img16.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias [2009.05.14 14:16:09 | 000,000,000 | ---D | M] NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SafeBootMin: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: mcmscsvc - C:\Programme\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SafeBootNet: MCODS - C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SafeBootNet: Messenger - File not found SafeBootNet: MpfService - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com) OTL cannot create restorepoints on Vista OSs! ========== Files/Folders - Created Within 14 Days ========== [2010.02.02 14:19:43 | 000,000,000 | ---D | C] -- C:\Rooter$ [2010.02.01 22:41:43 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\Neuer Ordner (2) [2010.01.31 13:51:14 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.01.31 00:11:22 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\ICQ [2010.01.30 17:41:53 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\VLounge Album [2010.01.30 17:04:12 | 000,000,000 | ---D | C] -- C:\Programme\SiteAdvisor [2010.01.30 17:02:27 | 000,040,552 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys [2010.01.30 17:02:26 | 000,079,816 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys [2010.01.30 17:02:26 | 000,035,272 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys [2010.01.30 17:02:24 | 000,130,424 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys [2010.01.30 17:02:09 | 000,000,000 | ---D | C] -- C:\Programme\McAfee.com [2010.01.30 17:02:09 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\McAfee [2010.01.30 17:02:07 | 000,000,000 | ---D | C] -- C:\Programme\McAfee [2010.01.30 17:00:50 | 000,034,248 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys [2010.01.30 16:51:34 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2010.01.28 17:00:57 | 000,000,000 | -H-D | C] -- C:\$AVG [2010.01.28 17:00:41 | 000,000,000 | ---D | C] -- C:\ProgramData\avg9 [2010.01.28 17:00:41 | 000,000,000 | ---D | C] -- C:\Programme\AVG [2010.01.28 16:56:00 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe [2010.01.28 16:54:19 | 000,000,000 | ---D | C] -- C:\Programme\Java [2010.01.28 12:48:46 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2010.01.28 12:48:44 | 000,000,000 | ---D | C] -- C:\Windows\temp [2010.01.28 12:48:44 | 000,000,000 | ---D | C] -- C:\Users\saskia\AppData\Local\temp [2010.01.28 12:37:29 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2010.01.28 12:37:29 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2010.01.28 12:37:29 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2010.01.28 12:37:22 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2010.01.28 12:35:45 | 000,000,000 | ---D | C] -- C:\cofi.exe [2010.01.28 12:34:43 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe [2010.01.27 12:28:22 | 000,000,000 | ---D | C] -- C:\Users\saskia\Documents\Downloads [2010.01.23 17:00:32 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe(0) [2010.01.23 16:58:07 | 000,000,000 | ---D | C] -- C:\Users\Public\Desktop\Installationsprogramm für Adobe Reader 9 [2010.01.23 16:52:57 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS [2010.01.23 16:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.01.23 16:51:10 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.01.21 17:20:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.01.21 17:20:30 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.01.21 17:20:30 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.01.21 16:10:56 | 000,000,000 | ---D | C] -- C:\Programme\Trojancheck 6 [2010.01.21 15:52:10 | 000,000,000 | ---D | C] -- C:\Users\saskia\AppData\Local\VS Revo Group [2010.01.21 15:52:07 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys [2010.01.21 15:52:06 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group ========== Files - Modified Within 14 Days ========== [2010.02.02 14:24:28 | 003,407,872 | ---- | M] () -- C:\Users\saskia\ntuser.dat [2010.02.02 14:24:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.02.02 14:17:50 | 000,009,976 | ---- | M] () -- C:\Windows\System32\Config.MPF [2010.02.02 13:38:44 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.02.02 13:38:43 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.02.02 07:43:44 | 001,418,600 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.02.02 07:43:44 | 000,618,192 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.02.02 07:43:44 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.02.02 07:43:44 | 000,122,442 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.02.02 07:43:44 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.02.02 07:38:56 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.02.02 07:38:44 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.02.02 07:38:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.02.02 00:22:14 | 000,524,288 | -HS- | M] () -- C:\Users\saskia\ntuser.dat{900cac43-a73b-11de-a3f2-001d60aa4c99}.TMContainer00000000000000000001.regtrans-ms [2010.02.02 00:22:14 | 000,065,536 | -HS- | M] () -- C:\Users\saskia\ntuser.dat{900cac43-a73b-11de-a3f2-001d60aa4c99}.TM.blf [2010.02.02 00:22:08 | 002,582,777 | -H-- | M] () -- C:\Users\saskia\AppData\Local\IconCache.db [2010.02.01 22:38:42 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job [2010.01.31 13:15:34 | 000,017,674 | ---- | M] () -- C:\Users\saskia\AppData\Roaming\wklnhst.dat [2010.01.30 18:02:41 | 001,034,240 | -H-- | M] () -- C:\Users\saskia\Documents\photothumb.db [2010.01.30 17:43:53 | 000,151,941 | ---- | M] () -- C:\Users\saskia\Documents\Bild1132.jpg [2010.01.30 17:26:54 | 000,000,358 | ---- | M] () -- C:\Windows\tasks\McDefragTask.job [2010.01.30 17:26:54 | 000,000,320 | ---- | M] () -- C:\Windows\tasks\McQcTask.job [2010.01.30 17:04:21 | 000,000,816 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Center.lnk [2010.01.30 17:03:50 | 000,000,811 | ---- | M] () -- C:\Users\Public\Desktop\McAfee EasyNetwork.lnk [2010.01.30 15:37:16 | 000,001,905 | ---- | M] () -- C:\Windows\diagwrn.xml [2010.01.30 15:37:16 | 000,001,905 | ---- | M] () -- C:\Windows\diagerr.xml [2010.01.28 18:25:31 | 000,001,976 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2010.01.28 12:46:58 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini [2010.01.28 10:18:35 | 000,017,099 | ---- | M] () -- C:\Users\saskia\Documents\DAF 28.01..docx [2010.01.27 18:32:23 | 000,017,257 | ---- | M] () -- C:\Users\saskia\Documents\SELL.docx [2010.01.27 12:29:17 | 000,001,729 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.01.26 08:16:10 | 000,379,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.01.25 15:58:53 | 000,101,856 | ---- | M] () -- C:\Users\saskia\AppData\Local\GDIPFONTCACHEV1.DAT [2010.01.25 12:02:21 | 000,000,254 | ---- | M] () -- C:\Windows\win.ini [2010.01.22 00:56:15 | 000,001,051 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Works.lnk [2010.01.21 22:31:51 | 000,000,966 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk [2010.01.21 17:20:34 | 000,000,823 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.21 16:10:56 | 000,000,813 | ---- | M] () -- C:\Users\saskia\Desktop\Trojancheck.lnk [2010.01.21 09:50:04 | 000,014,469 | ---- | M] () -- C:\Users\saskia\Documents\DAFZ 21.1..docx ========== Files Created - No Company Name ========== [2010.01.30 17:42:28 | 000,151,941 | ---- | C] () -- C:\Users\saskia\Documents\Bild1132.jpg [2010.01.30 17:06:12 | 000,009,976 | ---- | C] () -- C:\Windows\System32\Config.MPF [2010.01.30 17:04:21 | 000,000,816 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Center.lnk [2010.01.30 17:03:50 | 000,000,811 | ---- | C] () -- C:\Users\Public\Desktop\McAfee EasyNetwork.lnk [2010.01.30 17:02:17 | 000,000,358 | ---- | C] () -- C:\Windows\tasks\McDefragTask.job [2010.01.30 17:02:15 | 000,000,320 | ---- | C] () -- C:\Windows\tasks\McQcTask.job [2010.01.30 15:37:03 | 000,001,905 | ---- | C] () -- C:\Windows\diagwrn.xml [2010.01.30 15:37:03 | 000,001,905 | ---- | C] () -- C:\Windows\diagerr.xml [2010.01.28 12:37:29 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe [2010.01.28 12:37:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2010.01.28 12:37:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2010.01.28 12:37:29 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2010.01.28 12:37:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2010.01.28 10:07:05 | 000,017,099 | ---- | C] () -- C:\Users\saskia\Documents\DAF 28.01..docx [2010.01.27 19:24:20 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2010.01.27 12:29:17 | 000,001,729 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.01.22 00:56:15 | 000,001,051 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Works.lnk [2010.01.21 17:20:34 | 000,000,823 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.01.21 16:10:56 | 000,000,813 | ---- | C] () -- C:\Users\saskia\Desktop\Trojancheck.lnk [2010.01.21 15:52:08 | 000,000,966 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk [2009.12.10 20:12:43 | 000,000,680 | ---- | C] () -- C:\Users\saskia\AppData\Local\d3d9caps.dat [2009.02.02 10:37:07 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini [2008.10.04 20:32:35 | 000,030,600 | ---- | C] () -- C:\Users\saskia\AppData\Roaming\UserTile.png [2008.02.06 15:36:00 | 000,639,224 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2008.01.31 15:17:30 | 000,000,325 | ---- | C] () -- C:\Windows\disney.ini [2008.01.31 11:53:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2008.01.31 11:07:47 | 000,036,588 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate [2008.01.28 12:46:25 | 000,017,674 | ---- | C] () -- C:\Users\saskia\AppData\Roaming\wklnhst.dat [2008.01.26 00:17:24 | 000,005,632 | ---- | C] () -- C:\Users\saskia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.01.25 18:33:15 | 000,001,308 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2007.09.20 11:05:05 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.10.27 15:16:40 | 000,138,512 | ---- | C] () -- C:\Windows\System32\OUTLCTL.DLL [1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys ========== LOP Check ========== [2009.08.30 12:33:10 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Cornelsen [2009.06.27 22:05:53 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\gtk-2.0 [2010.01.24 23:07:12 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\ICQ [2010.01.27 19:28:06 | 000,000,000 | -HSD | M] -- C:\Users\saskia\AppData\Roaming\lowsec [2008.01.26 18:29:11 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Mattel [2008.10.04 20:32:35 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\PeerNetworking [2008.05.08 08:17:04 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\Template [2008.12.26 16:18:10 | 000,000,000 | ---D | M] -- C:\Users\saskia\AppData\Roaming\TuxPaint [2008.01.29 13:45:14 | 000,000,256 | ---- | M] () -- C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job [2010.01.30 17:26:54 | 000,000,358 | ---- | M] () -- C:\Windows\Tasks\McDefragTask.job [2010.01.30 17:26:54 | 000,000,320 | ---- | M] () -- C:\Windows\Tasks\McQcTask.job [2010.02.02 00:22:13 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.02.01 22:38:42 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{09687A7B-0884-4362-B9A9-84C36040C0CA}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\ERDNT\cache\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys [2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys [2008.02.14 08:20:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTORV.SYS > [2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\ERDNT\cache\netlogon.dll [2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll [2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys [2007.01.05 20:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=615D79A1D2C98817FF2FDEB1B167D808 -- C:\NVIDIA\nForceWinVista\15.01G\IDE\WinVista\sata_ide\nvstor32.sys [2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=615D79A1D2C98817FF2FDEB1B167D808 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_a195c2b5\nvstor32.sys [2007.07.02 23:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\Windows\System32\drivers\nvstor32.sys [2007.07.02 23:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=A1CE1A6FD74C046F029448FCFA5E386D -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_efe24208\nvstor32.sys [2007.04.19 12:12:58 | 000,102,696 | ---- | M] (NVIDIA Corporation) MD5=E1C2036823B9E75535051499C61350F6 -- C:\NVIDIA\nForceWinVista\15.01G\IDE\WinVista\sataraid\nvstor32.sys < MD5 for: SCECLI.DLL > [2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\ERDNT\cache\scecli.dll [2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll [2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < c:\windows\system32\drivers\*.sys /lockedfiles > [2008.02.06 15:36:01 | 000,639,224 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys < c:\windows\system32\*.dll /lockedfiles > [2008.01.19 08:38:03 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2008.01.19 08:36:10 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < %systemroot%\*. /mp /s > < %PROGRAMFILES%\*. > [2008.11.13 23:18:56 | 000,000,000 | ---D | M] -- C:\Programme\a-squared Anti-Dialer [2007.09.21 13:51:58 | 000,000,000 | ---D | M] -- C:\Programme\Activation Assistant for the 2007 Microsoft Office suites [2010.01.28 16:55:54 | 000,000,000 | ---D | M] -- C:\Programme\Adobe [2007.09.20 09:33:59 | 000,000,000 | ---D | M] -- C:\Programme\Alice [2009.07.09 12:09:27 | 000,000,000 | ---D | M] -- C:\Programme\ArcSoft [2010.01.28 17:00:41 | 000,000,000 | ---D | M] -- C:\Programme\AVG [2010.01.30 17:02:09 | 000,000,000 | ---D | M] -- C:\Programme\Common Files [2009.08.30 14:13:26 | 000,000,000 | ---D | M] -- C:\Programme\Crawler [2008.02.06 15:38:41 | 000,000,000 | ---D | M] -- C:\Programme\DAEMON Tools [2008.01.25 23:04:29 | 000,000,000 | ---D | M] -- C:\Programme\DIFX [2008.03.25 16:56:46 | 000,000,000 | ---D | M] -- C:\Programme\Disney Interactive [2008.04.24 13:25:41 | 000,000,000 | ---D | M] -- C:\Programme\Electronic Arts [2008.04.17 21:20:28 | 000,000,000 | ---D | M] -- C:\Programme\FotoWorks [2008.01.25 18:09:43 | 000,000,000 | -HSD | M] -- C:\Programme\Gemeinsame Dateien [2008.04.17 21:30:26 | 000,000,000 | ---D | M] -- C:\Programme\GIMP-2.0 [2009.07.11 20:59:47 | 000,000,000 | ---D | M] -- C:\Programme\Google [2008.01.25 18:37:10 | 000,000,000 | ---D | M] -- C:\Programme\Hewlett-Packard [2008.01.25 18:38:29 | 000,000,000 | ---D | M] -- C:\Programme\HP [2009.07.09 12:05:54 | 000,000,000 | ---D | M] -- C:\Programme\Icatch(IV) [2009.07.14 15:27:07 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6 [2009.12.28 23:11:30 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6.5 [2008.06.18 08:23:38 | 000,000,000 | ---D | M] -- C:\Programme\ICQToolbar [2010.01.22 10:56:41 | 000,000,000 | -H-D | M] -- C:\Programme\InstallShield Installation Information [2010.01.27 19:25:12 | 000,000,000 | ---D | M] -- C:\Programme\Internet Explorer [2010.01.28 16:54:19 | 000,000,000 | ---D | M] -- C:\Programme\Java [2008.03.07 00:55:03 | 000,000,000 | ---D | M] -- C:\Programme\Kaminfeuer Titanium Edition 1.2 [2008.12.30 22:47:26 | 000,000,000 | ---D | M] -- C:\Programme\Lavalys [2007.09.21 07:39:21 | 000,000,000 | ---D | M] -- C:\Programme\LightScribe [2010.01.21 17:20:34 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware [2009.08.30 14:04:00 | 000,000,000 | ---D | M] -- C:\Programme\Mathe Perfekt [2008.01.26 18:28:34 | 000,000,000 | ---D | M] -- C:\Programme\Mattel [2008.01.31 13:12:25 | 000,000,000 | ---D | M] -- C:\Programme\Maxis [2010.01.31 22:34:52 | 000,000,000 | ---D | M] -- C:\Programme\McAfee [2010.01.30 17:02:13 | 000,000,000 | ---D | M] -- C:\Programme\McAfee.com [2008.08.09 22:01:32 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsDragons [2009.07.04 11:21:42 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsFairies [2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Games [2008.12.30 19:21:43 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Office [2008.12.30 19:21:22 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Visual Studio [2008.12.30 19:18:16 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Visual Studio 8 [2010.01.22 00:56:15 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Works [2008.12.30 19:20:24 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft.NET [2009.05.14 14:16:26 | 000,000,000 | ---D | M] -- C:\Programme\Movie Maker [2010.01.27 12:29:17 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox [2008.03.07 00:02:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox(1) [2008.03.01 22:27:29 | 000,000,000 | ---D | M] -- C:\Programme\mresreg [2008.12.30 19:21:50 | 000,000,000 | ---D | M] -- C:\Programme\MSBuild [2007.09.20 10:08:53 | 000,000,000 | ---D | M] -- C:\Programme\MSXML 4.0 [2008.01.25 23:04:18 | 000,000,000 | ---D | M] -- C:\Programme\Philips [2008.04.17 21:29:25 | 000,000,000 | ---D | M] -- C:\Programme\PhotoScape [2009.07.11 21:00:23 | 000,000,000 | ---D | M] -- C:\Programme\Real [2007.09.20 10:59:03 | 000,000,000 | ---D | M] -- C:\Programme\Realtek [2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Reference Assemblies [2010.01.30 17:04:12 | 000,000,000 | ---D | M] -- C:\Programme\SiteAdvisor [2008.02.06 16:58:59 | 000,000,000 | ---D | M] -- C:\Programme\SystemRequirementsLab [2010.01.21 16:11:51 | 000,000,000 | ---D | M] -- C:\Programme\Trojancheck 6 [2006.11.02 14:01:55 | 000,000,000 | -H-D | M] -- C:\Programme\Uninstall Information [2010.01.21 15:52:06 | 000,000,000 | ---D | M] -- C:\Programme\VS Revo Group [2009.05.14 14:16:26 | 000,000,000 | ---D | M] -- C:\Programme\Windows Calendar [2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Collaboration [2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Defender [2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Journal [2008.03.29 21:52:07 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live [2008.01.29 13:45:03 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live Favorites [2008.01.29 13:45:13 | 000,000,000 | ---D | M] -- C:\Programme\Windows Live Toolbar [2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mail [2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Media Player [2008.01.25 18:09:43 | 000,000,000 | ---D | M] -- C:\Programme\Windows NT [2009.05.14 14:16:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Photo Gallery [2010.01.30 16:25:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Sidebar [2008.12.18 14:56:17 | 000,000,000 | ---D | M] -- C:\Programme\Zylom Games < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-29 11:00:51 ========== Alternate Data Streams ========== @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2 < End of report > |
|
03.02.2010, 22:30
| #53 |
| | Trojan.Agent und Backdoor.bot Na nu...Gibt es noch was dazu zu sagen?? Wenn Du nichts mehr siehst, wird ich gern noch erfahren, wie ich das SP2 drauf bekommen könnte?? |
|
03.02.2010, 23:21
| #54 |
| /// Selecta Jahrusso | Trojan.Agent und Backdoor.bot Sorry, ich würde über deinen Beitrag nicht benachrichtigt -.- C:\Programme\Crawler bitte deinstallieren und Ordner löschen. Code:
ATTFilter [2008.08.09 22:01:32 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsDragons
[2009.07.04 11:21:42 | 000,000,000 | ---D | M] -- C:\Programme\McDonaldsFairies
Gmer haben wir ja nicht zum laufen gebracht. schritt 1 Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
schritt 2 Windows-Explorer öffnen (Windows-Taste + E) und unter => Extras => Ordneroptionen => im Reiter "Ansicht"
schritt 3 Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen Code:
ATTFilter C:\Windows\System32\rsaenh.dll
C:\Windows\System32\SLC.dll
schhritt 4 Versuch bitte GMER zu starten. Poste mir die Logfile oder teile mir mit wenns wieder nicht läuft.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.02.2010, 23:44
| #55 |
| | Trojan.Agent und Backdoor.bot oh man, soviel  Die McDonalds Dateien, sind von Spiele Cds von den Veiein halt, die sich gleich als hintergrund eingerichtet haben )Nun gut, werd ich mich morgen mal deinen "Hausaufgaben" widmen!  |
|
04.02.2010, 10:40
| #56 |
| | Trojan.Agent und Backdoor.bot Hi, defogger erstellt kein Logfile auf dem Desktop...Wenn ich es such gibt es defogger_reenable, dies kann ich aber nicht öffnen... 2.Schritt geht auch nicht, da öffnet sich doch "computer", das war schon beim letzten Versuch so Kann ich trotzdem 3.machen? sorry, schlechtes Arbeiten mit mir, ne!^^  |
|
04.02.2010, 11:23
| #57 |
| /// Selecta Jahrusso | Trojan.Agent und Backdoor.bot Und wenn du WIndows + E drückst hast Du oben keinen Button wo extras steht ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
04.02.2010, 11:58
| #58 | |
| | Trojan.Agent und Backdoor.botZitat:
Nein, es steht ja mal eine Sekunde Windows Explorer da, aber dann ist Computer mit den ganzen Laufwerken!!!  Dies scheint ja soweit richtig zu sein, !? Aber ich seh doch keine Extras... Geändert von Sandy77 (04.02.2010 um 12:12 Uhr) |
|
04.02.2010, 12:18
| #59 |
| /// Selecta Jahrusso | Trojan.Agent und Backdoor.bot Schau mal auf den Screenshot Ich muss jz in die Arbeit.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
04.02.2010, 12:26
| #60 |
| | Trojan.Agent und Backdoor.bot Die Leiste steht nicht da...  frohes Schaffen Schuldigung, jetzt hab ich sie mit hinzugefügt...man vergisst hier die einfachsten Sachen, weil man denkt alles ist hoch kompliziert...*lol* |
|
| Themen zu Trojan.Agent und Backdoor.bot |
| ?????, adobe, antivir, antivirus, avira, bho, browser, explorer, fehlermeldung, firefox, google, gupdate, helper, hijack, hijackthis, internet, internet explorer, malwarebytes' anti-malware, mozilla, object, plug-in, senden, software, starten, symantec, system, trojaner, vista, windows |
Linear-Darstellung
