| |
| |||||||
Log-Analyse und Auswertung: iexplorer.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
17.09.2010, 15:07
| #1 |
 |  iexplorer.exe Hallo ich hab ein Prozess gefunden names iexplorer und die datei hat den Pfad windows/system32/install Hab bist jetzt kein Thema gefunden wo das selbe war HijackThis: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:02:47, on 17.09.2010 Platform: Unknown Windows (WinNT 6.01.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\Hardcopy\hardcopy.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe C:\Users\Nico\Downloads\HiJackThis.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Nico\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll O2 - BHO: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll O3 - Toolbar: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof1.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [explorer] C:\Windows\system32\svchosb.exe O4 - HKLM\..\Run: [Windows Task Manager] C:\Windows\system32\svchosb.exe O4 - HKLM\..\Run: [Yahoo! Messenger] C:\Windows\system32\svchosb.exe O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\System32\install\iexplorer.exe O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\System32\install\iexplorer.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?') O4 - Startup: Hardcopy.LNK = C:\Program Files\Hardcopy\hardcopy.exe O4 - Global Startup: DynDNS Updater Tray Icon.lnk = C:\Program Files\DynDNS Updater\DynTray.exe O8 - Extra context menu item: Download all by FlashGet3 - C:\Users\Nico\AppData\Roaming\FlashGetBHO\GetAllUrl.htm O8 - Extra context menu item: Download by FlashGet3 - C:\Users\Nico\AppData\Roaming\FlashGetBHO\GetUrl.htm O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O13 - Gopher Prefix: O15 - Trusted Zone: hxxp://software.kuaiche.com O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Program Files\DynDNS Updater\DynUpSvc.exe O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- End of file - 6153 bytes |
|
17.09.2010, 18:28
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | iexplorer.exe Hallo und
__________________ Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
18.09.2010, 11:06
| #3 |
| | iexplorer.exe mein anti-Virus hats jetzt als TR/dropper.gen erkann natürlich geht das entfernen net da die datei wieder kommt
__________________Die logs kommen noch |
|
18.09.2010, 12:31
| #4 |
| | iexplorer.exe das tool hat schon das problem behoben ein big thx an euch |
|
18.09.2010, 12:48
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplorer.exe Poste die Logs! Wir sind noch nicht durch!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
19.09.2010, 16:12
| #6 |
| | iexplorer.exe Malwarebytes' Anti-Malware 1.46 Malwarebytes Datenbank Version: 4650 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 19.09.2010 17:11:48 mbam-log-2010-09-19 (17-11-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 217593 Laufzeit: 2 Stunde(n), 20 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 5 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 2 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hklm (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\Users\Nico\AppData\Roaming\Winbooterr (Backdoor.SpyNet.M) -> Quarantined and deleted successfully. C:\Windows\System32\Winbooterr (Trojan.Backdoor) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Users\Nico\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully. C:\Users\Nico\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\Nico\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully. C:\Windows\iexplore.exe (Backdoor.Bot) -> Quarantined and deleted successfully. |
|
19.09.2010, 16:23
| #7 |
| | iexplorer.exe OTL Logfile: Code:
ATTFilter OTL logfile created on: 19.09.2010 17:20:36 - Run 1 OTL by OldTimer - Version 3.2.14.0 Folder = C:\Users\Nico\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 37,21 Gb Total Space | 21,51 Gb Free Space | 57,80% Space Free | Partition Type: NTFS Drive D: | 149,05 Gb Total Space | 142,09 Gb Free Space | 95,33% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PC-NICO Current User Name: Nico Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010.09.19 17:20:02 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Users\Nico\Downloads\OTL.exe PRC - [2010.09.17 16:55:38 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\plugin-container.exe PRC - [2010.09.17 16:55:24 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.08.30 15:22:52 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.08.20 21:45:26 | 001,164,584 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2010.08.17 11:00:02 | 001,727,488 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\Programme\Hardcopy\hardcopy.exe PRC - [2010.07.06 17:03:00 | 000,173,352 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe PRC - [2010.06.02 16:58:20 | 000,246,520 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe PRC - [2010.04.16 18:19:28 | 000,103,800 | ---- | M] (Dynamic Network Services, Inc.) -- C:\Programme\DynDNS Updater\DynUpSvc.exe PRC - [2010.04.15 21:32:14 | 000,091,504 | ---- | M] (Dynamic Network Services, Inc.) -- C:\Programme\DynDNS Updater\DynTray.exe PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.11.24 11:32:22 | 000,234,792 | ---- | M] (Skype Technologies S.A.) -- C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.07.14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe ========== Modules (SafeList) ========== MOD - [2010.09.19 17:20:02 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Users\Nico\Downloads\OTL.exe MOD - [2010.04.21 11:00:35 | 000,058,368 | ---- | M] () -- C:\Programme\Hardcopy\HcDLL2_30_Win32.dll MOD - [2009.07.14 03:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll MOD - [2009.07.14 03:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll MOD - [2009.07.14 03:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\samcli.dll MOD - [2009.07.14 03:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll MOD - [2009.07.14 03:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netutils.dll MOD - [2009.07.14 03:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll MOD - [2009.07.14 03:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll MOD - [2009.07.14 03:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll MOD - [2009.07.14 03:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll MOD - [2009.07.14 03:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll MOD - [2009.07.14 03:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx MOD - [2009.07.14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2010.08.30 15:22:52 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.07.06 17:03:00 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2010.06.02 16:58:20 | 000,246,520 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2010.04.16 18:19:28 | 000,103,800 | ---- | M] (Dynamic Network Services, Inc.) [Auto | Running] -- C:\Programme\DynDNS Updater\DynUpSvc.exe -- (DynDNS Updater) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.07.14 03:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc) SRV - [2009.07.14 03:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc) SRV - [2009.07.14 03:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power) SRV - [2009.07.14 03:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes) SRV - [2009.07.14 03:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify) SRV - [2009.07.14 03:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc) SRV - [2009.07.14 03:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc) SRV - [2009.07.14 03:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider) SRV - [2009.07.14 03:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener) SRV - [2009.07.14 03:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009.07.14 03:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp) SRV - [2009.07.14 03:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc) SRV - [2009.07.14 03:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC) SRV - [2009.07.14 03:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX-Installer (AxInstSV) SRV - [2009.07.14 03:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc) SRV - [2009.07.14 03:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\sppsvc.exe -- (sppsvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\XDva362.sys -- (XDva362) DRV - File not found [Kernel | On_Demand | Running] -- C:\Windows\System32\XDva359.sys -- (XDva359) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nlndis.sys -- (NLNdisPT) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nlndis.sys -- (NLNdisMP) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FProtect.dat -- (HideProc) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Nico\Downloads\NtSniper1066.new2(2)\NtSniper.sys -- (FsysSdtRev) DRV - [2010.07.10 05:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.12.11 09:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg) DRV - [2009.11.16 18:33:38 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (npf) DRV - [2009.10.05 16:31:50 | 001,221,632 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009.08.19 09:04:54 | 000,189,440 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rt86win7.sys -- (RTL8167) DRV - [2009.07.14 03:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide) DRV - [2009.07.14 03:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci) DRV - [2009.07.14 03:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx) DRV - [2009.07.14 03:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs) DRV - [2009.07.14 03:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320) DRV - [2009.07.14 03:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas) DRV - [2009.07.14 03:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata) DRV - [2009.07.14 03:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc) DRV - [2009.07.14 03:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata) DRV - [2009.07.14 03:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide) DRV - [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor) DRV - [2009.07.14 03:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid) DRV - [2009.07.14 03:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960) DRV - [2009.07.14 03:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS) DRV - [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV) DRV - [2009.07.14 03:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR) DRV - [2009.07.14 03:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI) DRV - [2009.07.14 03:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC) DRV - [2009.07.14 03:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2) DRV - [2009.07.14 03:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp) DRV - [2009.07.14 03:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas) DRV - [2009.07.14 03:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy) DRV - [2009.07.14 03:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor) DRV - [2009.07.14 03:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx) DRV - [2009.07.14 03:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD) DRV - [2009.07.14 03:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends) DRV - [2009.07.14 03:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount) DRV - [2009.07.14 03:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide) DRV - [2009.07.14 03:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300) DRV - [2009.07.14 03:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost) DRV - [2009.07.14 03:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx) DRV - [2009.07.14 03:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4) DRV - [2009.07.14 03:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw) DRV - [2009.07.14 03:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2) DRV - [2009.07.14 03:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor) DRV - [2009.07.14 03:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG) DRV - [2009.07.14 02:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2009.07.14 02:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus) DRV - [2009.07.14 02:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP) DRV - [2009.07.14 01:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2) DRV - [2009.07.14 01:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf) DRV - [2009.07.14 01:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap) DRV - [2009.07.14 01:52:04 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vwififlt.sys -- (vwififlt) DRV - [2009.07.14 01:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus) DRV - [2009.07.14 01:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\1394ohci.sys -- (1394ohci) DRV - [2009.07.14 01:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass) DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 01:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf) DRV - [2009.07.14 01:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig) DRV - [2009.07.14 01:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus) DRV - [2009.07.14 01:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID) DRV - [2009.07.14 01:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.14 01:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache) DRV - [2009.07.14 01:19:21 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HidBatt.sys -- (HidBatt) DRV - [2009.07.14 01:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi) DRV - [2009.07.14 01:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM) DRV - [2009.07.14 00:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2009.07.14 00:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm) DRV - [2009.07.14 00:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer) DRV - [2009.07.14 00:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm) DRV - [2009.07.14 00:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo) DRV - [2009.07.14 00:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp) DRV - [2009.07.14 00:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x) DRV - [2009.07.14 00:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv) DRV - [2009.07.14 00:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv) DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2005.11.08 05:10:00 | 000,402,432 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZD1211BU.sys -- (ZD1211BU(WLAN)) 802.11g USB 2.0 Wireless LAN Driver (USB)(WLAN) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E 0F 3F B5 02 46 CB 01 [binary data] IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true OTL Extras logfile created on: 19.09.2010 17:20:36 - Run 1 OTL by OldTimer - Version 3.2.14.0 Folder = C:\Users\Nico\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 37,21 Gb Total Space | 21,51 Gb Free Space | 57,80% Space Free | Partition Type: NTFS Drive D: | 149,05 Gb Total Space | 142,09 Gb Free Space | 95,33% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PC-NICO Current User Name: Nico Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- (Trend Media Corporation Limited) "C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes] ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86) "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21 "{2F15C4AE-2436-4218-B101-D14F01F7CC6C}" = High Roller VIP Tool "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2 "{744D08ED-C523-40AD-886A-0CAD5B770924}" = Crossfire Keyboard Layout by -Sp0ng3B0b- v2 "{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{E04ACCBC-DF36-364E-87E8-6C24BB981AB8}" = Visual C++ 2008 x86 Runtime - (v9.0.30729.5026) "{E04ACCBC-DF36-364E-87E8-6C24BB981AB8}.vc_x86runtime_30729_5026" = Visual C++ 2008 x86 Runtime - v9.0.30729.5026 "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{FD347316-609E-4149-983C-84B40338D38A}" = Battlefield 2142-Demo "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "aTube Catcher" = aTube Catcher "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AVS Screen Capture_is1" = AVS Screen Capture version 1.1.2 "AVS Update Manager_is1" = AVS Update Manager 1.0 "AVS Video Editor_is1" = AVS Video Editor 5 "AVS Video Recorder_is1" = AVS Video Recorder 2.4 "AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4 "Cross Fire_is1" = Cross Fire En "DivX Setup.divx.com" = DivX-Setup "DynDNSUpdater" = DynDNS Updater "FlashGet 3.3" = FlashGet 3.3 "FMCODEC" = FM Screen Capture Codec (Remove Only) "Fraps" = Fraps (remove only) "Hardcopy(C__Program Files_Hardcopy)" = Hardcopy (C:\Program Files\Hardcopy) "HijackThis" = HijackThis 2.0.2 "HMIP50_is1" = Hide My IP 5.2 "ICQToolbar" = ICQ Toolbar "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10) "Mozilla Thunderbird (3.1.2)" = Mozilla Thunderbird (3.1.2) "MS-MPEG4" = Microsoft MPEG-4 VKI Video Codec V1/V2/V3 "NVIDIA Display Control Panel" = NVIDIA Display Control Panel "NVIDIA Drivers" = NVIDIA Drivers "PunkBusterSvc" = PunkBuster Services "softonic-de3 Toolbar" = softonic-de3 Toolbar "TeamViewer 5" = TeamViewer 5 "uTorrent" = µTorrent "WinPcapInst" = WinPcap 4.1.1 "WinRAR archiver" = WinRAR "Xfire" = Xfire (remove only) "xvid" = XviD MPEG-4 Video Codec ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{8BECF123-B0EF-4E51-B7F3-923EFE15CC4A}" = Battlefield 2(TM) Demo ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 17.09.2010 10:01:30 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: svchost.exe_ProfSvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16559, Zeitstempel: 0x4ba9b21e Ausnahmecode: 0xc0000005 Fehleroffset: 0x00028b25 ID des fehlerhaften Prozesses: 0x3d4 Startzeit der fehlerhaften Anwendung: 0x01cb565d6c5a5e00 Pfad der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 11fca14e-c264-11df-844b-853357d93fd2 Error - 17.09.2010 10:02:24 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3855, Zeitstempel: 0x4c48d5ce Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x24017c1e ID des fehlerhaften Prozesses: 0x1730 Startzeit der fehlerhaften Anwendung: 0x01cb5670ef6d0b70 Pfad der fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 31fa7511-c264-11df-844b-853357d93fd2 Error - 17.09.2010 10:02:24 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3855, Zeitstempel: 0x4c48d5ce Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x24017c1e ID des fehlerhaften Prozesses: 0x1138 Startzeit der fehlerhaften Anwendung: 0x01cb5670f2c2954c Pfad der fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: 32089d08-c264-11df-844b-853357d93fd2 Error - 17.09.2010 10:56:02 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: iexplorer.exe, Version: 0.0.0.0, Zeitstempel: 0x4c7a252e Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x24017c1e ID des fehlerhaften Prozesses: 0x1348 Startzeit der fehlerhaften Anwendung: 0x01cb567863264217 Pfad der fehlerhaften Anwendung: C:\Windows\System32\install\iexplorer.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: b0143ff2-c26b-11df-844b-853357d93fd2 Error - 17.09.2010 13:31:45 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: crossfire.exe, Version: 1.0.63.8, Zeitstempel: 0x4c9073b5 Name des fehlerhaften Moduls: HMIPCore.dll, Version: 1.0.0.1, Zeitstempel: 0x4c0c4e42 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001c172 ID des fehlerhaften Prozesses: 0xa98 Startzeit der fehlerhaften Anwendung: 0x01cb568e2661d835 Pfad der fehlerhaften Anwendung: D:\Program Files\Z8Games\CrossFire\crossfire.exe Pfad des fehlerhaften Moduls: C:\Windows\system32\HMIPCore.dll Berichtskennung: 7109a5d8-c281-11df-844b-853357d93fd2 Error - 17.09.2010 14:38:16 | Computer Name = PC-Nico | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 18.09.2010 05:34:46 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 1.9.2.3909, Zeitstempel: 0x4c8fdcc5 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x24017c1e ID des fehlerhaften Prozesses: 0xe30 Startzeit der fehlerhaften Anwendung: 0x01cb5714a5049ff1 Pfad der fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe Pfad des fehlerhaften Moduls: unknown Berichtskennung: f9233535-c307-11df-a692-e02990c097db Error - 19.09.2010 08:31:58 | Computer Name = PC-Nico | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16559, Zeitstempel: 0x4ba9b21e Ausnahmecode: 0xc0000005 Fehleroffset: 0x00051fe0 ID des fehlerhaften Prozesses: 0x3dc Startzeit der fehlerhaften Anwendung: 0x01cb57f18f4ac82e Pfad der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: e497c192-c3e9-11df-813e-b7d895a1bedd Error - 19.09.2010 09:16:33 | Computer Name = PC-Nico | Source = Application Hang | ID = 1002 Description = Programm javaw.exe, Version 6.0.210.7 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: e3c Startzeit: 01cb57f671da1e84 Endzeit: 112 Anwendungspfad: C:\Program Files\Java\jre6\bin\javaw.exe Berichts-ID: 07cd555d-c3f0-11df-813e-b7d895a1bedd Error - 19.09.2010 09:35:14 | Computer Name = PC-Nico | Source = Application Hang | ID = 1002 Description = Programm javaw.exe, Version 6.0.210.7 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 360 Startzeit: 01cb57fd33f82a22 Endzeit: 100 Anwendungspfad: C:\Program Files\Java\jre6\bin\javaw.exe Berichts-ID: 02a2a94e-c3f2-11df-813e-b7d895a1bedd [ Media Center Events ] Error - 06.09.2010 06:49:05 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 12:49:04 - Fehler beim Herstellen der Internetverbindung. 12:49:05 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 06:49:21 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 12:49:10 - Fehler beim Herstellen der Internetverbindung. 12:49:10 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 07:51:45 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 13:51:45 - Fehler beim Herstellen der Internetverbindung. 13:51:45 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 07:52:03 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 13:51:51 - Fehler beim Herstellen der Internetverbindung. 13:51:51 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 08:52:09 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 14:52:09 - Fehler beim Herstellen der Internetverbindung. 14:52:09 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 08:52:29 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 14:52:14 - Fehler beim Herstellen der Internetverbindung. 14:52:14 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 09:52:36 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 15:52:36 - Fehler beim Herstellen der Internetverbindung. 15:52:36 - Serververbindung konnte nicht hergestellt werden.. Error - 06.09.2010 09:52:52 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 15:52:41 - Fehler beim Herstellen der Internetverbindung. 15:52:41 - Serververbindung konnte nicht hergestellt werden.. Error - 14.09.2010 07:57:27 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 13:57:27 - Fehler beim Herstellen der Internetverbindung. 13:57:27 - Serververbindung konnte nicht hergestellt werden.. Error - 14.09.2010 07:57:49 | Computer Name = PC-Nico | Source = MCUpdate | ID = 0 Description = 13:57:32 - Fehler beim Herstellen der Internetverbindung. 13:57:32 - Serververbindung konnte nicht hergestellt werden.. [ System Events ] Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Benutzerprofildienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Aufgabenplanung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Sekundäre Anmeldung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Benachrichtigungsdienst für Systemereignisse" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Shellhardwareerkennung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Designs" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Windows-Verwaltungsinstrumentation" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:32:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7031 Description = Der Dienst "Windows Update" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error - 19.09.2010 08:33:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7032 Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Server" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056 Error - 19.09.2010 08:34:44 | Computer Name = PC-Nico | Source = Service Control Manager | ID = 7032 Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056 < End of report > |
|
19.09.2010, 18:05
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplorer.exe Die OTL-Logs hast Du irgendwie durcheinandergewürfelt. Pack beide OTL-Logs in eine Zipdatei und häng es hier an.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.09.2010, 18:14
| #9 |
| | iexplorer.exe hier ist er |
|
20.09.2010, 08:07
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplorer.exe Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\XDva362.sys -- (XDva362)
DRV - File not found [Kernel | On_Demand | Running] -- C:\Windows\System32\XDva359.sys -- (XDva359)
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
O4 - HKLM..\Run: [Windows Task Manager] C:\Windows\System32\svchosb.exe File not found
O4 - HKLM..\Run: [Yahoo! Messenger] C:\Windows\System32\svchosb.exe File not found
O4 - HKCU..\Run: [Microsoft Configuration] C:\Users\Nico\AppData\Local\Temp\msconfig.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [TRDIse] C:\Users\Nico\Downloads\Bh_PH\Red_Dragon_6.exe File not found
O33 - MountPoints2\{d0a19490-b1f3-11df-9015-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d0a19490-b1f3-11df-9015-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe -- File not found
[2010.09.19 17:12:07 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\ftmcltr.sys
[2010.09.15 14:34:35 | 000,000,065 | ---- | M] () -- C:\Windows\System32\sys.trdi
[2010.09.15 14:34:35 | 000,000,026 | ---- | M] () -- C:\Windows\System32\sys.rdi
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.09.2010, 19:18
| #11 |
| | iexplorer.exe All processes killed ========== OTL ========== Service XDva362 stopped successfully! Service XDva362 deleted successfully! File C:\Windows\System32\XDva362.sys not found. Service XDva359 stopped successfully! Service XDva359 deleted successfully! File C:\Windows\System32\XDva359.sys not found. Prefs.js: "ICQ Search" removed from browser.search.defaultenginename Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Task Manager deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Yahoo! Messenger deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Microsoft Configuration deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully. C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\TRDIse deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0a19490-b1f3-11df-9015-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0a19490-b1f3-11df-9015-806e6f6e6963}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0a19490-b1f3-11df-9015-806e6f6e6963}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0a19490-b1f3-11df-9015-806e6f6e6963}\ not found. File E:\0data\cbs.exe not found. File C:\Windows\System32\drivers\ftmcltr.sys not found. C:\Windows\System32\sys.trdi moved successfully. C:\Windows\System32\sys.rdi moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Nico ->Temp folder emptied: 1084021202 bytes ->Temporary Internet Files folder emptied: 46998776 bytes ->Java cache emptied: 127632 bytes ->FireFox cache emptied: 94225577 bytes ->Flash cache emptied: 25996 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 624339 bytes RecycleBin emptied: 923 bytes Total Files Cleaned = 1.169,00 mb OTL by OldTimer - Version 3.2.14.0 log created on 09212010_201348 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
21.09.2010, 19:19
| #12 |
| | iexplorer.exe *war ausversehn doppelpost* |
|
22.09.2010, 09:12
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplorer.exe Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.09.2010, 12:02
| #14 |
| | iexplorer.exe Combofix Logfile: Code:
ATTFilter ComboFix 10-09-22.06 - Nico 23.09.2010 12:44:32.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.2047.1380 [GMT 2:00]
ausgeführt von:: c:\users\Nico\Desktop\cofi.exe
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet 3\adns.dll
c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.exe
c:\program files\FlashGet Network\FlashGet 3\cd1.ico
c:\program files\FlashGet Network\FlashGet 3\ckcore.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\14_43260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\28_83260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\atrc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\Codecs.zip
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\cook.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ddnt3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\dnet3260.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv1.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv2.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drvc.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\hxltcolor.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\raac.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ralf.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv10.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv20.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv30.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv40.dll
c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\sipr.dll
c:\program files\FlashGet Network\FlashGet 3\commonlib.dll
c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll
c:\program files\FlashGet Network\FlashGet 3\config\clients.met
c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak
c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat
c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met
c:\program files\FlashGet Network\FlashGet 3\config\known.met
c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met
c:\program files\FlashGet Network\FlashGet 3\config\preferences.dat
c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini
c:\program files\FlashGet Network\FlashGet 3\config\server.met
c:\program files\FlashGet Network\FlashGet 3\config\server_met.old
c:\program files\FlashGet Network\FlashGet 3\config\upload.met
c:\program files\FlashGet Network\FlashGet 3\corestat.dll
c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll
c:\program files\FlashGet Network\FlashGet 3\fg.ico
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\FGResDetector.conf
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml
c:\program files\FlashGet Network\FlashGet 3\FGSoftware.exe
c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi
c:\program files\FlashGet Network\FlashGet 3\FlashGetBHO3.dll
c:\program files\FlashGet Network\FlashGet 3\FlashGetHook.dll
c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll
c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll
c:\program files\FlashGet Network\FlashGet 3\fnsLanguage.dll
c:\program files\FlashGet Network\FlashGet 3\fnslanguage_en.dll
c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll
c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll
c:\program files\FlashGet Network\FlashGet 3\game.ico
c:\program files\FlashGet Network\FlashGet 3\gb2312-unicode.dic
c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll
c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm
c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe
c:\program files\FlashGet Network\FlashGet 3\libem.dll
c:\program files\FlashGet Network\FlashGet 3\license.txt
c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin
c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet 3\p2pcore.dll
c:\program files\FlashGet Network\FlashGet 3\p2score.dll
c:\program files\FlashGet Network\FlashGet 3\perf.ini
c:\program files\FlashGet Network\FlashGet 3\pncrt.dll
c:\program files\FlashGet Network\FlashGet 3\pstat.dat
c:\program files\FlashGet Network\FlashGet 3\pup.dat
c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll
c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginfailed.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginsucc.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\msgnotify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\topmain.png
c:\program files\FlashGet Network\FlashGet 3\SnapShot.dll
c:\program files\FlashGet Network\FlashGet 3\storage.dll
c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe
c:\program files\FlashGet Network\FlashGet 3\uninst.exe
c:\program files\FlashGet Network\FlashGet 3\VodCore.dll
c:\program files\FlashGet Network\FlashGet 3\zlib.dll
c:\users\Nico\AppData\Roaming\BITS
c:\users\Nico\AppData\Roaming\BITS\BITS.ini
c:\users\Nico\AppData\Roaming\BITS\DHTTable.dat
c:\users\Nico\AppData\Roaming\BITS\ProxyList.ini
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185838.torrent
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185838.torrent.filelist
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185840.torrent
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185840.torrent.filelist
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.~tmp
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.bits
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.filelist
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.hybridlist
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.seeds
c:\users\Nico\AppData\Roaming\BITS\Torrent\20100917185841.torrent.statistic
c:\users\Nico\AppData\Roaming\BITS\UPnP.ini
c:\users\Nico\AppData\Roaming\FlashGetBHO
c:\users\Nico\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
c:\users\Nico\AppData\Roaming\FlashGetBHO\FlashGetHook.dll
c:\users\Nico\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
c:\users\Nico\AppData\Roaming\FlashGetBHO\GetUrl.htm
c:\windows\system32\secushr.dat
c:\windows\system32\secustat.dat
c:\windows\system32\vbzlib1.dll
Infizierte Kopie von c:\windows\system32\drivers\blbdrive.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
Infizierte Kopie von c:\windows\explorer.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe wurde wiederhergestellt
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_HideProc
((((((((((((((((((((((( Dateien erstellt von 2010-08-23 bis 2010-09-23 ))))))))))))))))))))))))))))))
.
2010-09-23 10:53 . 2010-09-23 10:53 -------- d-----w- C:\Device
2010-09-23 10:52 . 2010-09-23 10:55 -------- d-----w- c:\users\Nico\AppData\Local\temp
2010-09-23 10:52 . 2010-09-23 10:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-23 10:27 . 2010-09-23 10:27 -------- d-----w- c:\program files\CCleaner
2010-09-22 12:17 . 2010-09-23 06:22 -------- d-----w- c:\program files\Cheat Engine
2010-09-22 12:17 . 2009-11-03 12:07 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-09-22 12:17 . 2009-11-03 12:07 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-09-21 18:13 . 2010-09-21 18:13 -------- d-----w- C:\_OTL
2010-09-19 12:10 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-19 12:10 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-18 09:42 . 2010-09-18 09:42 -------- d-----w- c:\users\Nico\AppData\Roaming\Malwarebytes
2010-09-18 09:41 . 2010-09-19 12:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-18 09:41 . 2010-09-18 09:41 -------- d-----w- c:\programdata\Malwarebytes
2010-09-17 16:59 . 2010-09-17 16:59 -------- d-----w- c:\program files\uTorrent
2010-09-17 16:59 . 2010-09-17 18:59 -------- d-----w- c:\users\Nico\AppData\Roaming\uTorrent
2010-09-17 16:34 . 2010-06-15 16:27 282928 ----a-w- c:\windows\system32\HMIPCore.dll
2010-09-17 16:34 . 2010-09-17 17:04 -------- d-----w- c:\program files\Hide My IP
2010-09-17 13:30 . 2010-09-23 10:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-09-17 13:30 . 2010-09-21 18:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-16 16:16 . 2010-09-18 11:26 -------- d-----w- c:\windows\system32\install
2010-09-16 13:26 . 2010-01-06 11:13 506368 ----a-w- c:\windows\system32\sqlite3.dll
2010-09-14 19:57 . 2010-09-17 15:04 -------- d-----w- c:\users\Nico\AppData\Local\Topblast
2010-09-14 12:49 . 2010-09-14 12:49 -------- d-----w- C:\Nexon
2010-09-14 12:49 . 2010-09-14 12:49 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2010-09-06 14:21 . 2010-09-06 14:22 -------- dc----w- c:\users\Nico\AppData\Local\MigWiz
2010-09-05 02:22 . 2010-09-16 17:39 -------- d-----w- c:\users\Nico\AppData\Roaming\DivX
2010-09-05 02:21 . 2010-09-05 02:21 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-09-05 02:20 . 2010-09-05 02:21 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-09-05 02:20 . 2010-09-21 17:54 -------- d-----w- c:\program files\DivX
2010-09-05 02:19 . 2010-09-21 17:54 -------- d-----w- c:\programdata\DivX
2010-09-05 01:12 . 2010-09-05 18:11 138384 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-09-05 01:12 . 2010-09-05 18:20 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-09-05 01:12 . 2010-09-05 01:12 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-09-05 01:12 . 2010-09-05 01:12 2427248 ----a-w- c:\windows\system32\pbsvc_heroes.exe
2010-09-04 19:31 . 2010-09-04 19:41 -------- d-----w- c:\users\Nico\AppData\Roaming\Miranda
2010-09-04 12:03 . 2010-09-04 12:03 -------- d-----w- c:\users\Nico\AppData\Roaming\Avira
2010-09-03 16:56 . 2010-09-03 16:56 -------- d-----w- C:\Game Recordings
2010-09-03 16:56 . 2010-09-03 16:57 -------- d-----w- c:\program files\ZD Soft
2010-09-03 15:42 . 2010-09-05 01:16 -------- d-----w- c:\users\Nico\AppData\Local\PunkBuster
2010-09-02 14:33 . 2010-09-02 14:33 -------- d-----w- c:\program files\WinPcap
2010-09-02 14:33 . 2010-09-02 14:33 -------- d-----w- c:\program files\DsNET Corp
2010-08-31 14:23 . 2010-08-31 14:23 -------- d-----w- c:\users\Nico\AppData\Roaming\Hot Keyboard
2010-08-31 14:23 . 2010-09-01 11:52 -------- d-----w- c:\users\Nico\AppData\Roaming\Hot Keyboard Pro Backup
2010-08-30 13:21 . 2010-08-30 13:21 -------- d-----w- c:\programdata\Avira
2010-08-30 13:21 . 2010-08-30 13:21 -------- d-----w- c:\program files\Avira
2010-08-30 13:21 . 2010-03-01 07:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-30 13:21 . 2010-02-16 11:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-08-30 13:21 . 2009-05-11 09:49 51992 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-08-30 13:21 . 2009-05-11 09:49 17016 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-08-30 13:20 . 2010-08-30 13:20 -------- d-----w- c:\program files\Conduit
2010-08-30 13:20 . 2010-09-05 00:22 -------- d-----w- c:\program files\softonic-de3
2010-08-30 05:57 . 2010-09-22 14:38 -------- d-----w- C:\CFLog
2010-08-30 02:37 . 2010-08-30 02:37 -------- d-----w- c:\program files\Microsoft.NET
2010-08-30 02:36 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-08-29 17:35 . 2010-08-29 17:35 -------- d-----w- c:\programdata\AVS4YOU
2010-08-29 17:35 . 2010-08-29 17:35 -------- d-----w- c:\users\Nico\AppData\Roaming\AVS4YOU
2010-08-29 17:33 . 2010-08-16 12:35 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2010-08-29 17:33 . 2010-08-16 12:35 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2010-08-29 17:33 . 2010-08-29 17:34 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-08-29 17:32 . 2010-08-29 17:34 -------- d-----w- c:\program files\AVS4YOU
2010-08-29 17:32 . 2010-06-22 08:43 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-08-29 17:32 . 2010-06-22 08:43 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-08-29 17:27 . 2010-08-29 17:27 -------- d-----w- c:\users\Nico\AppData\Roaming\FlashGet
2010-08-29 12:04 . 2010-09-16 17:20 -------- d-----w- c:\users\Nico\AppData\Roaming\Xfire
2010-08-29 12:04 . 2010-09-16 17:11 -------- d-----w- c:\programdata\Xfire
2010-08-29 09:31 . 2010-09-16 13:44 -------- d-----w- c:\users\Nico\AppData\Local\ElevatedDiagnostics
2010-08-29 08:15 . 2010-09-19 13:34 -------- d-----w- c:\program files\Zicores Minecraft Admin
2010-08-29 08:04 . 2010-08-29 08:04 -------- d-----w- c:\program files\DynDNS Updater
2010-08-29 08:04 . 2010-08-29 08:04 -------- d-----w- c:\programdata\DynDNS
2010-08-28 20:14 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-08-28 20:13 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-08-28 20:13 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-08-28 20:13 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-08-28 20:13 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-08-28 20:13 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-08-28 20:09 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-08-28 19:03 . 2010-09-04 15:13 -------- d-----w- c:\users\Nico\AppData\Roaming\TeamViewer
2010-08-28 19:02 . 2010-08-28 19:02 -------- d-----w- c:\program files\TeamViewer
2010-08-28 18:57 . 2010-08-28 18:57 -------- d-----w- c:\users\Nico\AppData\Local\Apple Computer
2010-08-28 18:57 . 2010-08-28 18:57 -------- d-----w- c:\users\Nico\AppData\Roaming\Apple Computer
2010-08-28 18:57 . 2010-08-28 18:57 -------- d-----w- c:\users\Nico\AppData\Roaming\Titanium
2010-08-28 18:56 . 2010-08-29 12:37 -------- d-----w- c:\program files\High Roller VIP Tool
2010-08-28 13:53 . 2010-08-28 13:53 -------- d-----w- c:\program files\Hardcopy
2010-08-28 13:53 . 2010-03-20 07:45 501760 ----a-w- c:\windows\SwSetupu.exe
2010-08-28 12:30 . 2010-08-28 12:54 -------- d-----w- c:\users\Nico\AppData\Roaming\Teeworlds
2010-08-28 11:52 . 2010-08-28 11:52 -------- d-----w- c:\windows\Sun
2010-08-28 01:03 . 2010-05-27 07:24 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-08-28 01:03 . 2010-05-27 03:49 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-08-28 01:03 . 2009-10-19 14:10 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-08-28 00:57 . 2010-08-28 00:57 -------- d-----w- c:\users\Nico\AppData\Roaming\Need for Speed World
2010-08-28 00:34 . 2010-08-28 00:34 -------- d-----w- c:\users\Nico\AppData\Local\Electronic_Arts_Inc
2010-08-27 19:35 . 2010-08-27 19:35 0 ----a-w- c:\windows\nsreg.dat
2010-08-27 19:35 . 2010-09-22 12:12 -------- d-----w- c:\users\Nico\AppData\Local\Thunderbird
2010-08-27 19:35 . 2010-08-27 19:35 -------- d-----w- c:\users\Nico\AppData\Roaming\Thunderbird
2010-08-27 19:35 . 2010-09-23 06:54 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-08-27 19:19 . 2010-08-27 19:19 -------- d-----w- c:\program files\ICQ6Toolbar
2010-08-27 19:19 . 2010-08-27 19:19 -------- d-----w- c:\programdata\ICQ
2010-08-27 19:19 . 2010-09-23 10:17 -------- d-----w- c:\users\Nico\AppData\Roaming\ICQ
2010-08-27 19:19 . 2010-08-27 19:19 -------- d-----w- c:\users\Nico\AppData\Local\AOL
2010-08-27 19:19 . 2010-08-27 19:37 -------- d-----w- c:\program files\ICQ7.2
2010-08-27 18:22 . 2010-08-27 18:22 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-08-27 18:21 . 2010-08-27 18:21 -------- d-----w- c:\programdata\NVIDIA
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\programdata\NVIDIA Corporation
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\program files\NVIDIA Corporation
2010-08-27 18:07 . 2010-09-04 21:29 -------- d-----w- c:\users\Nico\AppData\Roaming\.minecraft
2010-08-27 17:55 . 2010-08-29 17:35 57968 ----a-w- c:\users\Nico\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-27 17:50 . 2010-08-27 17:50 -------- d-----w- c:\program files\Common Files\Java
2010-08-27 17:49 . 2010-08-27 17:49 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-27 17:49 . 2010-08-27 17:49 -------- d-----w- c:\program files\Java
2010-08-27 17:43 . 2010-08-27 17:43 -------- d-----w- c:\windows\system32\Macromed
2010-08-27 16:56 . 2010-08-27 16:14 -------- d-----w- c:\windows\Panther
2010-08-27 16:26 . 2010-05-21 12:14 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-08-27 16:25 . 2010-09-23 07:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-27 16:24 . 2010-08-27 16:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-27 16:19 . 2010-09-23 06:14 -------- d-----w- c:\users\Nico\AppData\Roaming\skypePM
2010-08-27 16:18 . 2010-09-23 10:17 -------- d-----w- c:\users\Nico\AppData\Roaming\Skype
2010-08-27 16:17 . 2010-08-27 16:17 -------- d-----w- c:\program files\Common Files\Skype
2010-08-27 16:17 . 2010-09-22 13:03 -------- d-----r- c:\program files\Skype
2010-08-27 16:17 . 2010-09-22 13:03 -------- d-sh--w- c:\windows\Installer
2010-08-27 16:17 . 2010-08-27 16:17 -------- d-----w- c:\programdata\Skype
2010-08-27 16:16 . 2010-08-27 16:16 -------- d-----w- c:\users\Nico\AppData\Local\Mozilla
2010-08-27 16:13 . 2010-09-23 10:49 -------- d-----w- c:\windows\system32\wbem\Performance
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 10:49 . 2009-07-14 08:47 653928 ----a-w- c:\windows\system32\perfh007.dat
2010-09-23 10:49 . 2009-07-14 08:47 129800 ----a-w- c:\windows\system32\perfc007.dat
2010-09-22 17:48 . 2010-08-27 18:08 65024 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\jinput-dx8_64.dll
2010-09-22 17:48 . 2010-08-27 18:08 62464 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\jinput-raw_64.dll
2010-09-22 17:48 . 2010-08-27 18:08 61952 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\jinput-dx8.dll
2010-09-22 17:48 . 2010-08-27 18:08 59392 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\jinput-raw.dll
2010-09-22 17:48 . 2010-08-27 18:08 273920 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\lwjgl64.dll
2010-09-22 17:48 . 2010-08-27 18:08 195072 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\OpenAL64.dll
2010-09-22 17:48 . 2010-08-27 18:08 193024 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\lwjgl.dll
2010-09-22 17:48 . 2010-08-27 18:08 108032 ----a-w- c:\users\Nico\AppData\Roaming\.minecraft\bin\natives\OpenAL32.dll
2010-09-21 17:54 . 2010-09-05 02:23 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-21 17:54 . 2010-09-21 17:54 56765 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-21 17:54 . 2010-09-21 17:54 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-09-21 17:51 . 2010-09-05 02:22 185640 ----a-w- c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-21 17:51 . 2010-09-05 02:19 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-21 17:51 . 2010-09-05 02:22 1062184 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-09-19 18:28 . 2010-09-19 18:26 35894951 ----a-w- c:\program files\Zicores Minecraft Admin.rar
2010-09-17 19:02 . 2005-09-06 14:05 11547 ---ha-w- c:\users\Nico\AppData\Roaming\Nicolog.dat
2010-09-15 14:52 . 2010-09-15 14:52 10189 ----a-w- c:\windows\unins000.dat
2010-09-15 14:52 . 2010-09-15 14:52 1199179 ----a-w- c:\windows\unins000.exe
2010-09-14 12:58 . 2010-09-14 12:58 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2010-09-14 12:58 . 2010-09-14 12:58 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-09-14 12:58 . 2010-09-14 12:58 1113408 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-09-05 02:22 . 2010-09-05 02:22 56997 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-05 02:22 . 2010-09-05 02:22 57691 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-09-05 02:20 . 2010-09-05 02:20 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-09-05 01:12 . 2010-09-05 01:12 138056 ----a-w- c:\users\Nico\AppData\Roaming\PnkBstrK.sys
2010-09-05 01:12 . 2010-09-05 01:12 138056 ----a-w- c:\users\Nico\AppData\Roaming\PnkBstrK.sys
2010-09-01 17:37 . 2010-09-05 02:22 850200 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-08-30 08:56 . 2010-08-30 08:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-08-30 06:20 . 2010-08-30 06:20 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2010-08-30 06:19 . 2010-08-30 06:19 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-08-30 06:19 . 2010-08-30 06:19 1113408 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-08-29 07:21 . 2009-07-14 02:37 -------- d-----w- c:\program files\Windows Mail
2010-08-28 13:35 . 2010-08-28 13:35 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\programdata\Vorlagen
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\programdata\Startmenü
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\programdata\Favoriten
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\programdata\Dokumente
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\programdata\Anwendungsdaten
2010-08-27 16:14 . 2010-08-27 16:14 -------- d-sh--we c:\program files\Gemeinsame Dateien
2010-08-19 21:46 . 2010-09-05 00:57 1312120 ----a-w- c:\users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\iokif6ga.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
2010-08-19 21:46 . 2010-09-05 00:57 724992 ----a-w- c:\users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\iokif6ga.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
2010-07-29 06:30 . 2010-08-28 01:08 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-28 01:08 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-09 19:00 . 2010-07-09 19:00 41872 ----a-w- c:\windows\system32\xfcodec.dll
2010-07-09 14:37 . 2010-07-09 14:37 66664 ----a-w- c:\windows\system32\nvshext.dll
2010-07-09 14:37 . 2010-07-09 14:37 1469544 ----a-w- c:\windows\system32\nvsvc.dll
2010-07-09 14:37 . 2010-07-09 14:37 13939816 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-09 14:37 . 2010-07-09 14:37 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-07-09 14:37 . 2010-07-09 14:37 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-06-30 06:25 . 2010-08-28 01:07 978432 ----a-w- c:\windows\system32\wininet.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files\softonic-de3\tbsof1.dll" [2010-09-05 2734688]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-09-05 00:22 2734688 ----a-w- c:\program files\softonic-de3\tbsof1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files\softonic-de3\tbsof1.dll" [2010-09-05 2734688]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\program files\softonic-de3\tbsof1.dll" [2010-09-05 2734688]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
c:\users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2010-8-28 1727488]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
DynDNS Updater Tray Icon.lnk - c:\program files\DynDNS Updater\DynTray.exe [2010-4-15 91504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 FsysSdtRev;FsysSdtRev;c:\users\Nico\Downloads\NtSniper1066.new2(2)\NtSniper.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-19 189440]
R3 XDva359;XDva359;c:\windows\system32\XDva359.sys [x]
R3 ZD1211BU(WLAN);802.11g USB 2.0 Wireless LAN Driver (USB)(WLAN);c:\windows\system32\DRIVERS\zd1211Bu.sys [2005-11-08 402432]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 DynDNS Updater;DynDNS Updater;c:\program files\DynDNS Updater\DynUpSvc.exe [2010-04-16 103800]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-06-02 246520]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
IE: Download all by FlashGet3 - c:\users\Nico\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\Nico\AppData\Roaming\FlashGetBHO\GetUrl.htm
LSP: c:\windows\system32\HMIPCore.dll
Trusted Zone: kuaiche.com\software
FF - ProfilePath - c:\users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\iokif6ga.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\iokif6ga.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\users\Nico\AppData\Roaming\Mozilla\Firefox\Profiles\iokif6ga.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
AddRemove-FlashGet 3.3 - c:\program files\FlashGet Network\FlashGet 3\uninst.exe
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'Explorer.exe'(1908)
c:\program files\Hardcopy\HcDLL2_30_Win32.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-23 13:01:03 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-09-23 11:01
Vor Suchlauf: 9 Verzeichnis(se), 24.403.841.024 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 23.935.180.800 Bytes frei
- - End Of File - - 66B95D49F187349EA545E3F606A6BBAC
|
|
23.09.2010, 12:16
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | iexplorer.exe Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu iexplorer.exe |
| antivir, antivir guard, avg, avira, bho, button, datei, desktop, dns, firefox, helper, iexplorer.exe, internet, internet explorer, messenger, micro, microsoft, mozilla, nvidia, object, plug-in, prozess, software, start, update, yahoo |
