| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HTML/Infected.WebPage.Gen2Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.05.2011, 11:53
| #1 |
| |  HTML/Infected.WebPage.Gen2 Hallo zusammen, ich habe folgenden Virus über AntiVir entdeckt und weiss nicht wo der herkommt. --> HTML/Infected.WebPage.Gen2 Löschen unter AntiVir bringt leider nichts, der IE öffnet immer eine Werbeseite. Wenn ich meinen Laptop abmelde und zwar unter "Energie sparen" stürzt Windows mit "bluescreen" ab usw. Hab mir jetzt Malwarebytes gedownloadet und poste die Logdatei. Ist der Rechner clean nachdem ich unter Malwarebytes die Viren gelöscht habe? Sollte ich das System neu aufsetzen? Wie sieht es mit Passwörtern im Netz aus? Alle nochmals neu vergeben? Im Vorfeld vielen Dank! Hier die Log-Datei: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6483 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 01.05.2011 12:43:03 mbam-log-2011-05-01 (12-43-03).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 186829 Laufzeit: 10 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 6 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully. Infizierte Dateien: c:\Windows\System32\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully. c:\Recycle.Bin\recycle.bin.exe (Trojan.SpyEyes) -> Quarantined and deleted successfully. c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully. |
|
01.05.2011, 16:17
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | HTML/Infected.WebPage.Gen2 Hallo und
__________________ Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL-Custom: CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ |
|
01.05.2011, 17:54
| #3 |
| | HTML/Infected.WebPage.Gen2 Ich hab mit Malwarebytes einen kompletten Scan durchgeführt mit folgendem Ergebnis:
__________________Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6483 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000 01.05.2011 18:36:59 mbam-log-2011-05-01 (18-36-59).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|Y:\|) Durchsuchte Objekte: 454221 Laufzeit: 1 Stunde(n), 55 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Uwe\AppData\Roaming\Pyol\vopu.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully. e:\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully. y:\Arbeit\Studium\ITA\07. semester\ita7 schmied u. rühle\brutus-aet2\BrutusA2.exe (HackTool.Brutus) -> Quarantined and deleted successfully. OTL-Quick-Scan bringt folgendes Ergebnis:OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.05.2011 18:43:03 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Schumacher\Desktop Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 53,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 68,36 Gb Total Space | 26,06 Gb Free Space | 38,12% Space Free | Partition Type: NTFS Drive D: | 68,36 Gb Total Space | 46,85 Gb Free Space | 68,53% Space Free | Partition Type: NTFS Drive E: | 161,37 Gb Total Space | 140,56 Gb Free Space | 87,11% Space Free | Partition Type: NTFS Drive G: | 569,83 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Drive I: | 697,98 Gb Total Space | 177,10 Gb Free Space | 25,37% Space Free | Partition Type: NTFS Drive J: | 1,89 Gb Total Space | 1,79 Gb Free Space | 94,73% Space Free | Partition Type: FAT Drive Y: | 249,94 Gb Total Space | 223,67 Gb Free Space | 89,49% Space Free | Partition Type: FAT32 Computer Name: LIFEBOOK | User Name: Schumacher | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe PRC - [2011.03.24 15:21:01 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2009.03.19 19:14:14 | 002,521,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\Updater6\Adobe_Updater.exe PRC - [2009.02.27 13:14:26 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe PRC - [2008.11.06 23:09:22 | 000,777,656 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SclStart.exe PRC - [2008.10.15 14:31:50 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe PRC - [2008.10.15 14:29:58 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe PRC - [2008.08.09 16:34:04 | 000,277,576 | ---- | M] () -- C:\Programme\SmartCase Logon+\Password Manager\SmartCaseServer.exe PRC - [2008.08.09 16:33:54 | 000,237,568 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\logonuser.exe PRC - [2008.08.09 16:33:54 | 000,098,388 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SmartyLog.exe PRC - [2008.08.09 16:33:54 | 000,064,952 | ---- | M] (TODO: <Company name>) -- C:\Programme\SmartCase Logon+\System\SecureDriveInterface.exe PRC - [2008.08.09 16:33:54 | 000,036,280 | ---- | M] (iC ComPas GmbH & Co KG) -- C:\Programme\SmartCase Logon+\System\SecuFil.exe PRC - [2008.08.07 22:31:18 | 001,664,248 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\AtService.exe PRC - [2008.08.07 22:31:18 | 000,124,152 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\ATSwpNav.exe PRC - [2008.06.13 14:52:52 | 006,183,456 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.06.12 14:28:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe PRC - [2008.05.01 09:41:38 | 000,136,488 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Pen_TabletUser.exe PRC - [2008.05.01 09:40:44 | 003,032,360 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe PRC - [2008.04.07 14:55:40 | 000,647,168 | ---- | M] (Fujitsu Computer Systems) -- C:\Programme\Fujitsu\Utils\FjMenu.exe PRC - [2008.04.07 14:53:40 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjEvents.exe PRC - [2008.04.07 14:53:02 | 000,020,480 | ---- | M] (Fujitsu Computer Systems Corporation) -- C:\Programme\Fujitsu\Utils\FjDspMon.exe PRC - [2008.01.21 04:25:55 | 000,198,656 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe PRC - [2008.01.21 04:25:54 | 000,300,032 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\TabTip.exe PRC - [2008.01.21 04:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.21 04:23:59 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.06.09 00:23:50 | 000,208,896 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMWDSrv.exe PRC - [2007.06.08 11:19:22 | 000,397,312 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMCONFIG.exe PRC - [2007.04.04 11:30:40 | 000,327,680 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\KMProcess.exe PRC - [2007.03.06 14:51:14 | 000,212,992 | ---- | M] (UASSOFT.COM) -- C:\Programme\Trust\Trust R-Series Mouse\StartAutorun.exe PRC - [2006.11.07 15:45:38 | 000,097,072 | ---- | M] (FUJITSU LIMITED) -- C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe PRC - [2005.11.11 11:49:50 | 000,204,800 | ---- | M] (National Instruments, Inc.) -- C:\Programme\National Instruments\shared\Security\nidmsrv.exe PRC - [2005.11.11 11:46:58 | 000,053,248 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lktsrv.exe PRC - [2005.11.11 11:46:56 | 000,045,056 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lkads.exe PRC - [2005.11.01 00:58:54 | 000,005,728 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\MAX\nimxs.exe PRC - [2005.10.10 15:08:32 | 000,049,152 | ---- | M] (National Instruments Corp.) -- C:\Windows\System32\nisvcloc.exe PRC - [2005.09.22 18:16:08 | 000,005,728 | ---- | M] (National Instruments Corporation) -- C:\Windows\System32\nipalsm.exe PRC - [2005.09.13 08:30:00 | 000,057,344 | ---- | M] (O2Micro International) -- C:\Windows\System32\o2flash.exe PRC - [2005.08.25 14:43:14 | 000,688,190 | ---- | M] (National Instruments, Inc.) -- C:\Windows\System32\lkcitdl.exe ========== Modules (SafeList) ========== MOD - [2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe MOD - [2008.01.21 04:25:52 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll MOD - [2008.01.21 04:24:11 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009.03.18 13:18:34 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2008.10.15 14:31:50 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler) SRV - [2008.10.15 14:29:58 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService) SRV - [2008.08.15 06:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4) SRV - [2008.08.09 16:34:04 | 000,277,576 | ---- | M] () [Auto | Running] -- C:\Programme\SmartCase Logon+\Password Manager\SmartCaseServer.exe -- (SmartCaseServer) SRV - [2008.08.09 16:33:54 | 000,237,568 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\logonuser.exe -- (LogonUserService) SRV - [2008.08.09 16:33:54 | 000,098,388 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\SmartyLog.exe -- (SmartyLogService) SRV - [2008.08.09 16:33:54 | 000,064,952 | ---- | M] (TODO: <Company name>) [Auto | Running] -- C:\Program Files\SmartCase Logon+\System\SecureDriveInterface.exe -- (SecureDriveInterface) SRV - [2008.08.09 16:33:54 | 000,036,280 | ---- | M] (iC ComPas GmbH & Co KG) [Auto | Running] -- C:\Programme\SmartCase Logon+\System\SecuFil.exe -- (SecuFil) SRV - [2008.08.07 22:31:18 | 001,664,248 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Programme\Fingerprint Sensor\AtService.exe -- (ATService) SRV - [2008.05.15 13:32:28 | 000,229,376 | ---- | M] (charismathics) [Auto | Stopped] -- C:\Windows\System32\cmTCSVista.exe -- (cmTCS Service) SRV - [2008.05.01 09:40:44 | 003,032,360 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen) SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.06.09 00:23:50 | 000,208,896 | ---- | M] (UASSOFT.COM) [Auto | Running] -- C:\Programme\Trust\Trust R-Series Mouse\KMWDSrv.exe -- (KMWDSERVICE) SRV - [2005.11.11 11:49:50 | 000,204,800 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService) SRV - [2005.11.11 11:46:58 | 000,053,248 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lktsrv.exe -- (lkTimeSync) SRV - [2005.11.11 11:46:56 | 000,045,056 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lkads.exe -- (lkClassAds) SRV - [2005.11.02 14:56:48 | 000,913,408 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager) SRV - [2005.11.01 00:58:54 | 000,005,728 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Program Files\National Instruments\MAX\nimxs.exe -- (mxssvr) SRV - [2005.10.10 15:08:32 | 000,049,152 | ---- | M] (National Instruments Corp.) [Auto | Running] -- C:\Windows\System32\nisvcloc.exe -- (niSvcLoc) SRV - [2005.09.22 18:16:08 | 000,005,728 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Windows\System32\nipalsm.exe -- (nipxirmu) SRV - [2005.09.13 08:30:00 | 000,057,344 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\o2flash.exe -- (O2Flash) SRV - [2005.08.25 14:43:14 | 000,688,190 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\Windows\System32\lkcitdl.exe -- (LkCitadelServer) ========== Driver Services (SafeList) ========== DRV - [2010.08.26 12:11:05 | 000,024,224 | ---- | M] (LUCAS-NÜLLE GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UNIUSB.sys -- (UniUsb) DRV - [2010.05.04 16:30:14 | 000,012,532 | ---- | M] (Virtual Ink) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mimiousb.sys -- (mimio) Virtual Ink's mimio USB Adapter (mimiousb.sys) DRV - [2009.10.21 22:43:40 | 000,223,432 | ---- | M] (TrueCrypt Foundation) [Kernel | Disabled | Running] -- I:\Portable_TrueCrypt_6.3\truecrypt.sys -- (truecrypt) DRV - [2009.05.27 15:32:28 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2009.05.27 15:32:27 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt) DRV - [2009.05.27 15:32:25 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio) DRV - [2008.08.21 16:35:00 | 000,034,816 | ---- | M] (iC ComPas GmbH & Co KG ) [Kernel | System | Running] -- C:\Windows\System32\drivers\fcrimg4.sys -- (fcrimg4) DRV - [2008.08.09 16:33:54 | 000,046,512 | ---- | M] (Siemens AG) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\smsw.sys -- (smsw) DRV - [2008.06.30 06:52:26 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) DRV - [2008.06.26 07:30:50 | 003,662,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2008.06.17 14:16:22 | 000,476,672 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF) DRV - [2008.06.12 03:23:00 | 000,101,848 | ---- | M] (O2Micro) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ozscr.sys -- (O2SCBUS) DRV - [2008.05.15 10:30:38 | 000,012,160 | ---- | M] (Fujitsu Siemens Computers) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FscGabi.sys -- (FscGabi) DRV - [2008.05.12 21:20:46 | 000,011,392 | ---- | M] (Fujitsu Siemens Computers) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FscBapi.sys -- (FscBapi) DRV - [2008.03.27 12:39:58 | 000,224,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1y6032.sys -- (e1yexpress) Intel(R) DRV - [2008.03.27 05:21:34 | 000,030,888 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wisdpen.sys -- (WISDPen) DRV - [2008.03.12 09:16:00 | 000,041,560 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2sd.sys -- (O2SDRDR) DRV - [2008.03.02 20:34:00 | 000,018,944 | ---- | M] (Fujitsu Computer Systems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FjBtnDrv.sys -- (Fjbtndrv) DRV - [2008.02.05 02:23:00 | 000,047,448 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR) DRV - [2008.01.21 04:23:46 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV - [2008.01.15 06:11:46 | 000,013,480 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid) DRV - [2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ahcix86s.sys -- (ahcix86s) DRV - [2007.11.08 19:03:26 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2007.10.31 12:23:00 | 000,124,960 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32) DRV - [2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32) DRV - [2007.09.29 14:30:52 | 000,065,024 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID) DRV - [2007.03.29 15:00:16 | 000,017,024 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KMWDFilter.SYS -- (KMWDFilter) DRV - [2007.02.16 05:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter) DRV - [2007.02.15 10:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVKHid.sys -- (WacomVKHid) DRV - [2006.11.01 20:59:24 | 000,005,632 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02e3.sys -- (FUJ02E3) DRV - [2006.11.01 20:20:28 | 000,005,888 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fuj02b1.sys -- (FUJ02B1) DRV - [2005.10.18 11:00:00 | 000,004,096 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cvintdrv.sys -- (cvintdrv) DRV - [2005.10.12 18:13:56 | 000,008,704 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViFWK.sys -- (NiViFWK) DRV - [2005.10.12 18:07:32 | 000,038,400 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiUsbTmc.sys -- (NIUSBTMC) DRV - [2005.10.12 18:04:28 | 000,010,752 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViPxiK.sys -- (NiViPxiK) DRV - [2005.10.12 18:04:26 | 000,037,376 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NiViPciK.sys -- (NiViPciK) DRV - [2005.10.06 17:22:48 | 000,038,912 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\niorbk.dll -- (niorbk) DRV - [2005.09.28 22:14:02 | 000,141,824 | ---- | M] (National Instruments Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nidimk.dll -- (nidimk) DRV - [2005.09.22 22:12:08 | 000,531,968 | ---- | M] (National Instruments Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nipalk.sys -- (NIPALK) DRV - [2005.09.21 12:30:46 | 000,055,296 | ---- | M] (National Instruments Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nipxirmk.dll -- (nipxirmk) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.14 22:10:45 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.24 15:21:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.08.15 10:17:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.04.30 21:56:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schumacher\AppData\Roaming\mozilla\Extensions [2011.04.30 21:56:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schumacher\AppData\Roaming\mozilla\Firefox\Profiles\b0634jkp.default\extensions [2011.04.29 20:35:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.01.13 19:13:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2009.03.10 22:46:31 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2009.03.29 20:30:43 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2011.01.13 19:13:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2005.10.12 16:04:02 | 000,020,480 | ---- | M] (National Instruments) -- C:\Programme\Mozilla Firefox\plugins\NPLV80Win32.dll [2011.03.04 22:54:36 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.03.04 22:54:36 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.03.04 22:54:36 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.03.04 22:54:36 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.03.04 22:54:36 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml Hosts file not found O2 - BHO: (SingleSignOn Class) - {37B109B0-E817-4072-8429-EDC6A987FCE3} - C:\Programme\SmartCase Logon+\Password Manager\SmartCaseBho.dll () O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Programme\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ATSwpNav] C:\Program Files\Fingerprint Sensor\ATSwpNav.exe (AuthenTec, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [FjStrtAp] C:\Programme\Fujitsu\Utils\FjStrtAp.exe (Fujitsu Computer Systems Corp.) O4 - HKLM..\Run: [IndicatorUtility] C:\Programme\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [KMCONFIG] File not found O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SclStart.exe] C:\Programme\SmartCase Logon+\System\SclStart.exe (iC ComPas GmbH & Co KG) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching__ = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.06.18 23:12:18 | 000,000,088 | ---- | M] () - G:\autorun.inf -- [ UDF ] O33 - MountPoints2\{08a3f3d0-0f54-11df-92cf-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{08a3f3d0-0f54-11df-92cf-806e6f6e6963}\Shell\AutoRun\command - "" = G:\WD SmartWare.exe -- [2009.09.05 00:20:42 | 002,770,208 | ---- | M] (Western Digital) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - State: "services" - 0 MsConfig - State: "startup" - 0 SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {41B797EC-43A3-993D-BDAB-9885C8F10F2E} - Internet Explorer ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {9DC813BB-0835-5D87-D2C6-FD0CC436DC8C} - Microsoft Windows Media Player 11.0 ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {FD141BEA-0352-F89C-5C2A-59708D8978E3} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation) CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2011.05.01 18:41:28 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe [2011.05.01 13:34:16 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Microsoft Help [2011.05.01 12:31:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Malwarebytes [2011.05.01 12:31:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.01 12:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.05.01 12:31:23 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.05.01 12:31:23 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.04.30 23:00:49 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Talkback [2011.04.30 23:00:40 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird [2011.04.30 23:00:40 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Thunderbird [2011.04.30 22:43:18 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\VirtualStore [2011.04.30 21:57:18 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Macromedia [2011.04.30 21:56:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Mozilla [2011.04.30 21:56:38 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Mozilla [2011.04.30 21:54:26 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings [2011.04.30 21:42:12 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Apple Computer [2011.04.30 21:42:12 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Adobe [2011.04.30 21:41:43 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Adobe [2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Searches [2011.04.30 21:41:37 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.04.30 21:41:29 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\Identities [2011.04.30 21:41:28 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Contacts [2011.04.30 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Roaming\WTablet [2011.04.30 21:41:22 | 000,000,000 | --SD | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Videos [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Saved Games [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Pictures [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Music [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Links [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Favorites [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Downloads [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Documents [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\Desktop [2011.04.30 21:41:22 | 000,000,000 | R--D | C] -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Vorlagen [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Verlauf [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Temporary Internet Files [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Startmenü [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\SendTo [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Recent [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Netzwerkumgebung [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Lokale Einstellungen [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Videos [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Musik [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Eigene Dateien [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Documents\Eigene Bilder [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Druckumgebung [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Cookies [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\AppData\Local\Anwendungsdaten [2011.04.30 21:41:22 | 000,000,000 | -HSD | C] -- C:\Users\Schumacher\Anwendungsdaten [2011.04.30 21:41:22 | 000,000,000 | -H-D | C] -- C:\Users\Schumacher\AppData [2011.04.30 21:41:22 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Temp [2011.04.30 21:41:22 | 000,000,000 | ---D | C] -- C:\Users\Schumacher\AppData\Local\Microsoft [2011.04.13 22:55:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinFACT 8 [2011.04.13 22:55:19 | 000,000,000 | ---D | C] -- C:\Programme\Kahlert [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.05.01 18:44:59 | 000,000,414 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7FDEF06A-4FD4-4AFE-89EB-22B248A9C822}.job [2011.05.01 18:41:29 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Schumacher\Desktop\OTL.exe [2011.05.01 18:37:39 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\xhyfls.sys [2011.05.01 18:35:23 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.05.01 18:35:23 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.05.01 15:33:59 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.05.01 15:33:59 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.05.01 15:33:59 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.05.01 15:33:59 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.05.01 13:23:16 | 000,001,024 | ---- | M] () -- C:\Users\Schumacher\.rnd [2011.05.01 13:23:16 | 000,001,024 | ---- | M] () -- C:\.rnd [2011.05.01 13:21:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.05.01 13:21:45 | 3156,074,496 | -HS- | M] () -- C:\hiberfil.sys [2011.05.01 13:21:44 | 311,110,518 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011.05.01 13:19:28 | 000,003,538 | ---- | M] () -- C:\Users\Schumacher\AppData\Roaming\FjMenu1.XML [2011.05.01 12:31:29 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.05.01 00:01:15 | 000,000,183 | ---- | M] () -- C:\Users\Schumacher\Desktop\GDS2 (Y) - Verknüpfung.lnk [2011.04.30 23:44:31 | 000,000,704 | ---- | M] () -- C:\Users\Schumacher\Desktop\_mounten_link.lnk [2011.04.30 23:44:31 | 000,000,650 | ---- | M] () -- C:\Users\Schumacher\Desktop\_trennen_link.lnk [2011.04.30 22:40:14 | 000,000,466 | RHS- | M] () -- C:\ProgramData\ntuser.pol [2011.04.29 15:39:00 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2011.04.26 17:13:56 | 000,000,227 | ---- | M] () -- C:\Windows\FTRUN32.INI [2011.04.12 16:59:05 | 001,536,505 | ---- | M] () -- C:\Users\Public\Documents\KA Mechas.pdf [2011.04.12 16:56:25 | 000,004,096 | -H-- | M] () -- C:\Users\Public\Documents\._sc00063f0b.pdf [2011.04.08 20:28:31 | 000,090,024 | ---- | M] () -- C:\bar.emf [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.01 18:37:39 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\xhyfls.sys [2011.05.01 13:23:16 | 000,001,024 | ---- | C] () -- C:\.rnd [2011.05.01 12:31:29 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.05.01 00:01:15 | 000,000,183 | ---- | C] () -- C:\Users\Schumacher\Desktop\GDS2 (Y) - Verknüpfung.lnk [2011.04.30 23:44:31 | 000,000,704 | ---- | C] () -- C:\Users\Schumacher\Desktop\_mounten_link.lnk [2011.04.30 23:44:31 | 000,000,650 | ---- | C] () -- C:\Users\Schumacher\Desktop\_trennen_link.lnk [2011.04.30 22:40:22 | 000,003,538 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\FjMenu1.XML [2011.04.30 22:40:14 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2011.04.30 21:52:12 | 3156,074,496 | -HS- | C] () -- C:\hiberfil.sys [2011.04.30 21:41:46 | 000,001,024 | ---- | C] () -- C:\Users\Schumacher\.rnd [2011.04.30 21:41:38 | 000,000,949 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.04.30 21:41:37 | 000,000,944 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2011.04.30 21:41:27 | 000,000,915 | ---- | C] () -- C:\Users\Schumacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2011.04.12 16:56:25 | 001,536,505 | ---- | C] () -- C:\Users\Public\Documents\KA Mechas.pdf [2011.04.12 16:56:25 | 000,004,096 | -H-- | C] () -- C:\Users\Public\Documents\._sc00063f0b.pdf [2011.04.08 20:06:36 | 000,548,731 | ---- | C] () -- C:\Users\Public\Documents\Laufzettel.pdf [2011.03.24 23:10:55 | 000,000,227 | ---- | C] () -- C:\Windows\FTRUN32.INI [2011.01.28 10:18:01 | 000,000,059 | ---- | C] () -- C:\Windows\Mehrgewinnrechner.INI [2010.11.04 22:59:28 | 000,087,612 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2010.09.27 07:47:02 | 000,000,036 | ---- | C] () -- C:\Windows\bi_group.ini [2010.08.15 16:36:18 | 000,164,166 | ---- | C] () -- C:\Windows\hpoins19.dat [2010.08.15 16:35:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat [2010.05.22 09:08:09 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI [2010.05.22 08:25:22 | 000,002,543 | ---- | C] () -- C:\Windows\basecad.ini [2010.05.04 16:30:49 | 000,102,400 | ---- | C] () -- C:\Windows\System32\mimio_printer_resource.dll [2010.05.03 14:34:50 | 000,000,032 | ---- | C] () -- C:\Windows\DVD_Start.INI [2010.02.14 16:15:12 | 000,000,041 | ---- | C] () -- C:\Windows\zinsrechner.INI [2010.02.14 16:14:28 | 000,000,070 | ---- | C] () -- C:\Windows\Skontorechner.INI [2009.03.11 21:47:40 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI [2009.03.11 17:46:06 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2009.03.10 08:39:18 | 000,618,430 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.03.10 08:39:18 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.03.10 08:39:18 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.03.10 08:39:18 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.03.10 01:24:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2009.03.10 00:12:39 | 000,000,205 | ---- | C] () -- C:\Windows\hbcikrnl.ini [2009.03.10 00:04:58 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2009.03.10 00:04:49 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1518.dll [2009.03.10 00:04:49 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll [2009.03.10 00:04:48 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2009.03.10 00:04:48 | 000,495,376 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2009.03.10 00:04:48 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin [2008.08.09 16:33:54 | 000,258,048 | ---- | C] () -- C:\Windows\System32\SCINF.dll [2008.08.09 16:33:54 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SCTPM.dll [2008.01.21 04:25:51 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2008.01.21 04:24:41 | 000,100,043 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2006.11.02 14:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:43 | 002,203,184 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 12:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2005.10.18 11:00:00 | 000,004,096 | ---- | C] () -- C:\Windows\System32\drivers\cvintdrv.sys [2005.09.28 17:26:34 | 000,000,244 | ---- | C] () -- C:\Windows\System32\nirpc.ini [2005.09.22 22:11:56 | 000,003,584 | ---- | C] () -- C:\Windows\System32\nipalpg.dll [2004.07.26 11:00:00 | 000,102,400 | ---- | C] () -- C:\Windows\System32\cviUSI.dll [2004.07.15 15:35:14 | 000,143,360 | ---- | C] () -- C:\Windows\System32\CleanupUtility.exe [1999.11.15 12:58:52 | 000,028,672 | ---- | C] () -- C:\Windows\NIRegApp.exe [1998.10.02 13:02:46 | 000,060,416 | ---- | C] () -- C:\Windows\System32\Opcenum.exe [1998.03.11 22:15:52 | 000,025,600 | ---- | C] () -- C:\Windows\System32\CBNDLL.DLL [1998.03.11 22:00:30 | 000,015,408 | ---- | C] () -- C:\Windows\System32\CB560WIN.DLL [1997.01.29 17:53:26 | 000,240,640 | ---- | C] () -- C:\Windows\System32\NMOCOD.DLL [1997.01.15 13:33:46 | 000,009,216 | ---- | C] () -- C:\Windows\System32\CBNVDD.DLL ========== LOP Check ========== [2011.04.30 21:54:26 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings [2011.04.30 23:00:41 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird [2011.05.01 13:19:39 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.05.01 18:44:59 | 000,000,414 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{7FDEF06A-4FD4-4AFE-89EB-22B248A9C822}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.04.30 21:57:18 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Adobe [2011.04.30 21:42:12 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Apple Computer [2011.04.30 21:41:29 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Identities [2011.04.30 21:57:18 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Macromedia [2011.05.01 12:31:38 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Malwarebytes [2011.05.01 13:34:16 | 000,000,000 | --SD | M] -- C:\Users\Schumacher\AppData\Roaming\Microsoft [2011.04.30 23:00:42 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Mozilla [2011.04.30 21:54:26 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Sync App Settings [2011.04.30 23:00:49 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Talkback [2011.04.30 23:00:41 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\Thunderbird [2011.05.01 13:22:28 | 000,000,000 | ---D | M] -- C:\Users\Schumacher\AppData\Roaming\WTablet < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: AHCIX86S.SYS > [2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=0DEE2B628D4C6E23285BB91EFFDABFDE -- C:\Windows\System32\drivers\ahcix86s.sys [2007.12.19 19:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) MD5=0DEE2B628D4C6E23285BB91EFFDABFDE -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_71554ba4\ahcix86s.sys < MD5 for: ATAPI.SYS > [2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys [2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys [2008.04.23 13:28:55 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys [2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.04.23 13:28:54 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTOR.SYS > [2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\fsc.tmp\1022821\IaStor.sys [2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\drivers\iaStor.sys [2008.05.26 07:57:38 | 000,317,976 | ---- | M] (Intel Corporation) MD5=80C633722DA72E97F3F5B3B11325696D -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1ab0331f\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2008.01.21 04:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll [2008.01.21 04:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Windows\System32\drivers\nvstor32.sys [2007.10.31 12:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_04bc6797\nvstor32.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll [2008.01.21 04:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 04:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2008.01.21 04:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.21 04:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 04:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2008.01.21 04:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe [2008.01.21 04:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2003.03.18 20:05:58 | 000,106,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\atl71.dll [2008.01.21 04:24:18 | 000,798,208 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dbghelp.dll < > < End of report > Vielen Dank |
|
02.05.2011, 09:33
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HTML/Infected.WebPage.Gen2Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
02.05.2011, 11:20
| #5 |
| | HTML/Infected.WebPage.Gen2 Keine Ahnung. Ich hab jetzt nochmals einen Voll-Scan durchlaufen lassen und anscheinend ist das Problem mit dem Virus behoben. Wahrscheinlich wäre es aber besser den Laptop nochmals neu aufzusetzen oder? Oder soll ich lieber die ganze Platte formatieren? Gruß und Danke |
|
02.05.2011, 12:51
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | HTML/Infected.WebPage.Gen2 Wieso weißt du das nicht? Ist das nicht deine Arbeit? 
__________________ --> HTML/Infected.WebPage.Gen2 |
|
| Themen zu HTML/Infected.WebPage.Gen2 |
| .dll, anti-malware, antivir, aufsetzen, bluescreen, clean, dateien, explorer, folge, gelöscht, hallo zusammen, html/infected.webpage.gen, laptop, log-datei, malwarebytes, neu, neu aufsetzen, passwörter, rechner, recycle.bin, service, system, system neu, system neu aufsetzen, system32, version, viren, virus, windows, öffnet |
Textbox.
.
Linear-Darstellung
