| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 7 Home Security eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.05.2011, 09:43
| #1 |
| |  Win 7 Home Security eingefangen Hallo erstmal. Heute Nachmittag war ich auf der Suche nach einem neuen Hintergrundbild. Kurz darauf kam eine Meldung von Win 7 Home Security, die sagte, dass ich 33 Viren habe. McAfee hat nichts gefunden. Malwarebytes Log: Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6569
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
14.05.2011 01:42:46
mbam-log-2011-05-14 (01-42-46).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|Q:\|)
Durchsuchte Objekte: 361791
Laufzeit: 1 Stunde(n), 46 Minute(n), 3 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Lisa\AppData\Local\wsn.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\Users\Lisa\AppData\Local\wsn.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Users\Lisa\documents\ICQ\201338738\receivedfiles\437033087 marcel\lichtschalter.exe (PUP.Joke.Buttons) -> Quarantined and deleted successfully.
e:\ICQ\201338738\receivedfiles\437033087 marcel\lichtschalter.exe (PUP.Joke.Buttons) -> Quarantined and deleted successfully.
c:\Users\Lisa\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
Code:
ATTFilter OTL logfile created on: 14.05.2011 01:47:26 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Lisa\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 45,00% Memory free 8,00 Gb Paging File | 5,00 Gb Available in Paging File | 58,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,01 Gb Total Space | 388,16 Gb Free Space | 86,06% Space Free | Partition Type: NTFS Drive E: | 7,51 Gb Total Space | 2,13 Gb Free Space | 28,39% Space Free | Partition Type: FAT32 Drive F: | 3,80 Gb Total Space | 2,31 Gb Free Space | 60,87% Space Free | Partition Type: FAT32 Computer Name: DELLA | User Name: Lisa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH) PRC - c:\program files (x86)\teamviewer\version6\TeamViewer_Desktop.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version6\tv_w32.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (SoftThinks - Dell) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (SoftThinks - Dell) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE () PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe () PRC - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe () PRC - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.) PRC - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) PRC - C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation) PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Program Files (x86)\TeamViewer\Version6\tv_w32.dll (TeamViewer GmbH) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\SysWOW64\crtdll.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.) SRV:64bit: - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe () SRV:64bit: - (McODS) -- C:\Program Files\mcafee\VirusScan\mcods.exe (McAfee, Inc.) SRV:64bit: - (McProxy) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV:64bit: - (McOobeSv) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV:64bit: - (McNASvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV:64bit: - (McNaiAnn) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV:64bit: - (mcmscsvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV:64bit: - (McMPFSvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.) SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.) SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) SRV - (mfevtp) -- C:\Programme\Common Files\mcafee\systemcore\mfevtps.exe (McAfee, Inc.) SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (DockLoginService) -- C:\Programme\Dell\DellDock\DockLogin.exe (Stardock Corporation) SRV - (GameConsoleService) -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe (WildTangent, Inc.) SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) ========== Driver Services (SafeList) ========== DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.) DRV:64bit: - (mfefirek) -- C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.) DRV:64bit: - (mfewfpk) -- C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.) DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.) DRV:64bit: - (mfeapfk) -- C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.) DRV:64bit: - (mferkdet) -- C:\Windows\SysNative\drivers\mferkdet.sys (McAfee, Inc.) DRV:64bit: - (mfenlfk) -- C:\Windows\SysNative\drivers\mfenlfk.sys (McAfee, Inc.) DRV:64bit: - (cfwids) -- C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.) DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?hl=de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.04.30 13:44:15 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.04.07 16:47:36 | 000,000,000 | ---D | M] [2010.12.24 22:27:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\mozilla\Extensions [2011.05.14 00:32:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lisa\AppData\Roaming\mozilla\Firefox\Profiles\yma2uxwn.default\extensions [2011.03.26 22:21:26 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Lisa\AppData\Roaming\mozilla\Firefox\Profiles\yma2uxwn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.01.01 03:19:12 | 000,000,873 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\conduit.xml [2011.05.07 21:44:33 | 000,000,950 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\icqplugin-1.xml [2011.04.24 23:34:38 | 000,001,056 | ---- | M] () -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\searchplugins\icqplugin.xml [2011.03.25 18:34:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.12.24 23:18:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\USERS\LISA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YMA2UXWN.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}.XPI [2011.04.30 13:44:13 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.10.13 23:28:54 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\mcafee\systemcore\ScriptSn.20101224212738.dll (McAfee, Inc.) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20101224212738.dll (McAfee, Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe () O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl9] C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.) O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found O4 - Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube Download - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.05.14 01:44:59 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe [2011.05.13 23:54:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Malwarebytes [2011.05.13 23:53:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.05.13 23:53:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.05.13 23:53:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.05.13 23:53:38 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.05.13 23:53:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.05.13 23:51:53 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Lisa\Desktop\herbert.exe [2011.05.13 14:36:40 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\webcaaaam [2011.05.13 13:57:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751} [2011.05.13 13:55:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee [2011.05.12 16:10:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200} [2011.05.11 17:29:41 | 005,475,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2011.05.11 17:29:41 | 003,967,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2011.05.11 17:29:40 | 003,911,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2011.05.11 17:29:35 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbport.sys [2011.05.11 17:29:35 | 000,007,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usbd.sys [2011.05.11 17:23:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC} [2011.05.10 16:57:14 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C} [2011.05.09 17:10:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras [2011.05.09 17:10:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.05.09 17:10:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2011.05.09 15:35:06 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B} [2011.05.08 13:12:30 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D} [2011.05.08 00:19:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity [2011.05.07 21:32:32 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428} [2011.05.06 15:45:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1} [2011.05.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A} [2011.05.04 14:01:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948} [2011.05.03 13:53:34 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252} [2011.05.02 14:13:27 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0} [2011.05.02 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED} [2011.05.01 12:23:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F} [2011.04.30 13:40:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47} [2011.04.29 09:28:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519} [2011.04.28 18:31:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE} [2011.04.27 15:17:12 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2011.04.27 15:17:12 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe [2011.04.27 15:17:10 | 000,662,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll [2011.04.27 15:17:10 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll [2011.04.27 15:16:36 | 002,566,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\esent.dll [2011.04.27 15:16:35 | 000,107,904 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdsata.sys [2011.04.27 15:16:34 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\esent.dll [2011.04.27 15:16:34 | 000,187,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\storport.sys [2011.04.27 15:16:34 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fsutil.exe [2011.04.27 15:16:34 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fsutil.exe [2011.04.27 15:16:34 | 000,027,008 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdxata.sys [2011.04.27 15:16:10 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\prevhost.exe [2011.04.27 15:16:10 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\prevhost.exe [2011.04.27 13:42:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168} [2011.04.27 00:59:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5 [2011.04.27 00:58:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.5 [2011.04.26 17:58:00 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8} [2011.04.25 11:59:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639} [2011.04.24 17:31:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79} [2011.04.23 15:04:49 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF} [2011.04.22 11:17:26 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717} [2011.04.21 15:40:16 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E} [2011.04.20 12:23:52 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85} [2011.04.19 13:19:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD} [2011.04.18 14:20:24 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444} [2011.04.17 18:19:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54} [2011.04.16 13:24:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF} [2011.04.15 14:25:17 | 001,395,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42.dll [2011.04.15 14:25:17 | 001,359,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfc42u.dll [2011.04.15 14:25:16 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll [2011.04.15 14:25:16 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll [2011.04.15 14:25:14 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll [2011.04.15 14:25:14 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll [2011.04.15 14:25:12 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2011.04.15 14:25:11 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2011.04.15 14:25:11 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2011.04.15 14:25:05 | 000,367,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2011.04.15 14:25:05 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2011.04.15 14:25:04 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2011.04.15 14:25:04 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2011.04.15 14:24:45 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2011.04.15 14:24:45 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2011.04.15 14:24:44 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2011.04.15 14:24:44 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.04.15 14:24:44 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2011.04.15 14:24:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.04.15 14:24:44 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.04.15 14:24:44 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.04.15 14:24:44 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2011.04.15 14:24:43 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2011.04.15 14:24:43 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2011.04.15 14:24:43 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2011.04.15 14:24:43 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2011.04.15 14:24:43 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2011.04.15 14:24:01 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnsapi.dll [2011.04.15 14:24:01 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dnscacheugc.exe [2011.04.15 14:24:01 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe [2011.04.15 14:23:54 | 000,640,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi [2011.04.15 14:23:54 | 000,603,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.exe [2011.04.15 14:23:54 | 000,556,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi [2011.04.15 14:23:54 | 000,518,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.exe [2011.04.15 14:23:54 | 000,020,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdusb.dll [2011.04.15 14:23:54 | 000,019,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kd1394.dll [2011.04.15 14:23:54 | 000,017,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kdcom.dll [2011.04.15 14:23:51 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FXSCOVER.exe [2011.04.15 14:05:28 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D} [2011.04.14 18:13:36 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390} [2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C} ========== Files - Modified Within 30 Days ========== [2011.05.14 01:44:35 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe [2011.05.14 01:04:02 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.05.13 23:53:42 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.05.13 23:50:46 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Lisa\Desktop\herbert.exe [2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w [2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w [2011.05.13 23:25:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.05.13 21:04:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.05.13 17:39:10 | 001,529,016 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.05.13 17:39:10 | 000,665,078 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.05.13 17:39:10 | 000,625,220 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.05.13 17:39:10 | 000,134,956 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.05.13 17:39:10 | 000,110,600 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.05.13 17:21:52 | 000,465,297 | ---- | M] () -- C:\Users\Lisa\Desktop\Unbenannt.png [2011.05.13 15:40:26 | 000,527,342 | ---- | M] () -- C:\Users\Lisa\Desktop\ly61z.jpg [2011.05.13 14:37:45 | 000,014,336 | -H-- | M] () -- C:\Users\Lisa\Desktop\photothumb.db [2011.05.13 14:04:55 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.05.13 14:04:55 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.05.13 13:54:53 | 3191,623,680 | -HS- | M] () -- C:\hiberfil.sys [2011.05.08 13:12:59 | 000,010,752 | ---- | M] () -- C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.04.27 00:59:55 | 000,001,826 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.5.lnk [2011.04.17 20:48:56 | 000,001,089 | ---- | M] () -- C:\Users\Lisa\Dokumente.lnk [2011.04.16 13:20:52 | 000,289,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.04.14 18:13:09 | 457,469,474 | ---- | M] () -- C:\Windows\MEMORY.DMP ========== Files Created - No Company Name ========== [2011.05.13 23:53:42 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.05.13 17:21:51 | 000,465,297 | ---- | C] () -- C:\Users\Lisa\Desktop\Unbenannt.png [2011.05.13 16:34:42 | 000,013,676 | -HS- | C] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w [2011.05.13 16:34:42 | 000,013,676 | -HS- | C] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w [2011.05.13 15:39:17 | 000,527,342 | ---- | C] () -- C:\Users\Lisa\Desktop\ly61z.jpg [2011.05.08 00:19:11 | 000,000,957 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk [2011.04.29 18:56:07 | 000,014,336 | -H-- | C] () -- C:\Users\Lisa\Desktop\photothumb.db [2011.04.27 00:59:55 | 000,001,826 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.5.lnk [2011.04.17 20:48:56 | 000,001,089 | ---- | C] () -- C:\Users\Lisa\Dokumente.lnk [2011.04.14 18:13:09 | 457,469,474 | ---- | C] () -- C:\Windows\MEMORY.DMP [2010.12.25 03:23:40 | 000,010,752 | ---- | C] () -- C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.12.25 02:08:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.12.24 23:38:35 | 001,529,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.10.25 08:41:04 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2010.10.25 08:39:18 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini [2010.10.25 08:39:18 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini [2010.10.25 08:39:18 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini [2010.10.25 08:39:17 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini [2010.10.25 08:39:17 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini [2010.10.25 08:39:17 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini [2010.10.25 08:39:17 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini [2010.10.25 07:01:55 | 000,000,075 | RHS- | C] () -- C:\Windows\CT4CET.bin [2010.08.25 20:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2010.08.25 20:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2010.08.25 20:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\iglhsip32.dll [2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\iglhcp32.dll [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.03.12 21:54:49 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\.purple [2011.03.26 22:21:05 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\DVDVideoSoft [2010.12.24 22:58:00 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers [2011.03.14 21:49:48 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\gtk-2.0 [2011.05.13 13:58:19 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\ICQ [2011.01.07 13:50:18 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\MusE [2011.03.21 15:55:36 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\ooVoo Details [2010.12.24 23:36:35 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\OpenOffice.org [2010.12.26 22:57:51 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\PhotoScape [2011.05.12 20:26:59 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\SoftGrid Client [2011.03.26 23:12:27 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TeamViewer [2010.12.24 23:39:33 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\TP [2011.04.23 20:04:17 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 14.05.2011 01:47:26 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Lisa\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 45,00% Memory free
8,00 Gb Paging File | 5,00 Gb Available in Paging File | 58,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 451,01 Gb Total Space | 388,16 Gb Free Space | 86,06% Space Free | Partition Type: NTFS
Drive E: | 7,51 Gb Total Space | 2,13 Gb Free Space | 28,39% Space Free | Partition Type: FAT32
Drive F: | 3,80 Gb Total Space | 2,31 Gb Free Space | 60,87% Space Free | Partition Type: FAT32
Computer Name: DELLA | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java(TM) 6 Update 20 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"WinGimp-2.0_is1" = GIMP 2.6.8
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{13766F76-6C8C-4E57-A9F3-3212D1C6E0D1}" = Dell DataSafe Online
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8570AE7F-183B-44A6-AC03-416C0B8B1000}" = SA31xx Device Manager & Media Converter
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E572B060-C98B-4984-A48E-E4FA56265903}" = SA31xx Device Manager & Media Converter
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E7D93321-D301-46D1-A56A-2AD87A281CD8}" = Audials
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Audacity_is1" = Audacity 1.2.6
"Counter-Strike: Source v17" = Counter-Strike: Source v17
"Dell Dock" = Dell Dock
"Dell Webcam Central" = Dell Webcam Central
"Free Studio_is1" = Free Studio version 5.0.8
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MSC" = McAfee Security Center
"MuseScore" = MuseScore 0.9.6.3 MuseScore score typesetter
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"TeamViewer 6" = TeamViewer 6
"Uninstall_is1" = Uninstall 1.0.0.1
"WildTangent dell Master Uninstall" = WildTangent-Spiele
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6489
Error - 02.05.2011 10:50:25 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6489
Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1760221
Error - 02.05.2011 11:19:38 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1760221
Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2356
Error - 02.05.2011 11:20:05 | Computer Name = Della | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2356
Error - 02.05.2011 13:03:37 | Computer Name = Della | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ICQ.exe, Version: 7.5.0.5238, Zeitstempel:
0x4daad859 Name des fehlerhaften Moduls: xprt6.dll, Version: 6.8.9.6479, Zeitstempel:
0x4d998fdf Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000cd4c ID des fehlerhaften Prozesses:
0x10c0 Startzeit der fehlerhaften Anwendung: 0x01cc08e0ce09a744 Pfad der fehlerhaften
Anwendung: C:\Program Files (x86)\ICQ7.5\ICQ.exe Pfad des fehlerhaften Moduls: C:\Program
Files (x86)\ICQ7.5\xprt6.dll Berichtskennung: 1e625e5c-74de-11e0-ad7a-f04da2a48db4
[ Dell Events ]
Error - 30.01.2011 07:15:28 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 22.02.2011 12:46:46 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 22.02.2011 12:46:46 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 30.03.2011 09:54:24 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 30.03.2011 09:54:24 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 01.04.2011 09:29:37 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 01.04.2011 09:29:37 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 25.04.2011 14:31:17 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 25.04.2011 14:31:17 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
Error - 02.05.2011 14:32:26 | Computer Name = Della | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
[ System Events ]
Error - 24.04.2011 11:45:55 | Computer Name = Della | Source = BROWSER | ID = 8032
Description =
Error - 24.04.2011 17:30:34 | Computer Name = Della | Source = BROWSER | ID = 8032
Description =
Error - 25.04.2011 11:42:17 | Computer Name = Della | Source = BROWSER | ID = 8032
Description =
Error - 25.04.2011 14:41:55 | Computer Name = Della | Source = BROWSER | ID = 8032
Description =
Error - 25.04.2011 17:23:56 | Computer Name = Della | Source = Service Control Manager | ID = 7034
Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 26.04.2011 17:27:48 | Computer Name = Della | Source = DCOM | ID = 10010
Description =
Error - 26.04.2011 17:28:12 | Computer Name = Della | Source = DCOM | ID = 10010
Description =
Error - 26.04.2011 18:14:42 | Computer Name = Della | Source = Service Control Manager | ID = 7034
Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 27.04.2011 08:16:16 | Computer Name = Della | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
Error - 27.04.2011 11:55:25 | Computer Name = Della | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?27.?04.?2011 um 17:53:45 unerwartet heruntergefahren.
< End of report >
 |
|
14.05.2011, 17:46
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Win 7 Home Security eingefangen Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
|
15.05.2011, 11:54
| #3 |
| | Win 7 Home Security eingefangenCode:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6576
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
14.05.2011 17:38:50
mbam-log-2011-05-14 (17-38-50).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|Q:\|)
Durchsuchte Objekte: 355658
Laufzeit: 1 Stunde(n), 17 Minute(n), 21 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6576
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
14.05.2011 18:30:55
mbam-log-2011-05-14 (18-30-55).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 154623
Laufzeit: 4 Minute(n), 23 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
|
|
15.05.2011, 12:24
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangen Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
[2011.05.09 15:35:06 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B}
[2011.05.08 13:12:30 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D}
[2011.05.07 21:32:32 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428}
[2011.05.06 15:45:51 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1}
[2011.05.05 19:25:35 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A}
[2011.05.04 14:01:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948}
[2011.05.03 13:53:34 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252}
[2011.05.02 14:13:27 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0}
[2011.05.02 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED}
[2011.05.01 12:23:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F}
[2011.04.30 13:40:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47}
[2011.04.29 09:28:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519}
[2011.04.28 18:31:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE}
[2011.04.26 17:58:00 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8}
[2011.04.25 11:59:10 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639}
[2011.04.24 17:31:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79}
[2011.04.23 15:04:49 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF}
[2011.04.22 11:17:26 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717}
[2011.04.21 15:40:16 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E}
[2011.04.20 12:23:52 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85}
[2011.04.19 13:19:13 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD}
[2011.04.18 14:20:24 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444}
[2011.04.17 18:19:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54}
[2011.04.16 13:24:05 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF}
[2011.04.15 14:05:28 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D}
[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390}
[2011.04.14 17:03:04 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C}
[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w
[2011.05.13 23:35:17 | 000,013,676 | -HS- | M] () -- C:\ProgramData\v78wmgbt877o6a8hsf684i2w
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.05.2011, 12:48
| #5 |
| | Win 7 Home Security eingefangenCode:
ATTFilter ========== OTL ==========
C:\Users\Lisa\AppData\Local\{2A9A5505-7705-43C6-9922-9C192959A55B} folder moved successfully.
C:\Users\Lisa\AppData\Local\{C6B535FD-FEBE-425F-886F-7380D671DD7D} folder moved successfully.
C:\Users\Lisa\AppData\Local\{E241A777-8A61-4199-802B-A4A4F8056428} folder moved successfully.
C:\Users\Lisa\AppData\Local\{2EE56242-F29D-479B-AEEB-E0EE17A8FAF1} folder moved successfully.
C:\Users\Lisa\AppData\Local\{F445BEA7-30FE-4C62-8DE9-BC13922BF38A} folder moved successfully.
C:\Users\Lisa\AppData\Local\{595AEA8F-94FF-41CD-AEFB-25C3E2E8D948} folder moved successfully.
C:\Users\Lisa\AppData\Local\{4974C675-379A-4803-967A-7BE7CBB28252} folder moved successfully.
C:\Users\Lisa\AppData\Local\{59BD6C0A-6D4A-4EC1-9033-7786EC72AED0} folder moved successfully.
C:\Users\Lisa\AppData\Local\{54AF67C3-B797-4346-894F-0F6397C50BED} folder moved successfully.
C:\Users\Lisa\AppData\Local\{32D27882-1170-4017-A9DC-B1743CE9278F} folder moved successfully.
C:\Users\Lisa\AppData\Local\{BCB1E4D5-A1E6-4E64-BFE6-BF7895051C47} folder moved successfully.
C:\Users\Lisa\AppData\Local\{41B7B79C-D0BE-40E6-BBD8-1E0984C14519} folder moved successfully.
C:\Users\Lisa\AppData\Local\{B6FA83D2-7081-4D79-BB69-30699720E5FE} folder moved successfully.
C:\Users\Lisa\AppData\Local\{A4E07DDD-1FC4-4562-A662-CAF342307AA8} folder moved successfully.
C:\Users\Lisa\AppData\Local\{75BB2CC4-D630-4EC4-89FB-65BFF8925639} folder moved successfully.
C:\Users\Lisa\AppData\Local\{88A0840F-A7F8-4FB4-BA42-EDEA13B8BF79} folder moved successfully.
C:\Users\Lisa\AppData\Local\{288436B1-65DF-4683-A83E-0464C9B184CF} folder moved successfully.
C:\Users\Lisa\AppData\Local\{50BF37B4-DACB-4C30-BAC7-1FE695413717} folder moved successfully.
C:\Users\Lisa\AppData\Local\{9417C413-5515-45C8-981B-D987F000A48E} folder moved successfully.
C:\Users\Lisa\AppData\Local\{FA9906BB-BB6D-4DDA-9424-0162AEDDEC85} folder moved successfully.
C:\Users\Lisa\AppData\Local\{1AA45645-9042-4562-BA7E-4E531CD218CD} folder moved successfully.
C:\Users\Lisa\AppData\Local\{9A05BF66-D861-43C5-9E6B-835E29BF3444} folder moved successfully.
C:\Users\Lisa\AppData\Local\{21FBF621-8B06-402E-9520-B7737EE81A54} folder moved successfully.
C:\Users\Lisa\AppData\Local\{CCB4C19A-0AA1-489A-A6F2-09725F4DA5FF} folder moved successfully.
C:\Users\Lisa\AppData\Local\{2487BBAA-D798-46BD-ACBB-021ECED5301D} folder moved successfully.
C:\Users\Lisa\AppData\Local\{C804AA10-5B35-4632-B52E-773AC04E7390} folder moved successfully.
C:\Users\Lisa\AppData\Local\{6D31EFD8-35CC-45B4-BF02-36E624C8B20C} folder moved successfully.
C:\Users\Lisa\AppData\Local\v78wmgbt877o6a8hsf684i2w moved successfully.
C:\ProgramData\v78wmgbt877o6a8hsf684i2w moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.22.3 log created on 05152011_134443
|
|
15.05.2011, 12:49
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangen Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ --> Win 7 Home Security eingefangen |
|
15.05.2011, 12:56
| #7 |
| | Win 7 Home Security eingefangen Wurde nichts gefunden. Code:
ATTFilter 2011/05/15 13:53:20.0072 4456 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29
2011/05/15 13:53:22.0085 4456 ================================================================================
2011/05/15 13:53:22.0085 4456 SystemInfo:
2011/05/15 13:53:22.0085 4456
2011/05/15 13:53:22.0085 4456 OS Version: 6.1.7600 ServicePack: 0.0
2011/05/15 13:53:22.0085 4456 Product type: Workstation
2011/05/15 13:53:22.0085 4456 ComputerName: DELLA
2011/05/15 13:53:22.0085 4456 UserName: Lisa
2011/05/15 13:53:22.0085 4456 Windows directory: C:\Windows
2011/05/15 13:53:22.0085 4456 System windows directory: C:\Windows
2011/05/15 13:53:22.0085 4456 Running under WOW64
2011/05/15 13:53:22.0085 4456 Processor architecture: Intel x64
2011/05/15 13:53:22.0085 4456 Number of processors: 2
2011/05/15 13:53:22.0085 4456 Page size: 0x1000
2011/05/15 13:53:22.0085 4456 Boot type: Normal boot
2011/05/15 13:53:22.0085 4456 ================================================================================
2011/05/15 13:53:22.0412 4456 Initialize success
2011/05/15 13:53:25.0673 3616 ================================================================================
2011/05/15 13:53:25.0673 3616 Scan started
2011/05/15 13:53:25.0673 3616 Mode: Manual;
2011/05/15 13:53:25.0673 3616 ================================================================================
2011/05/15 13:53:26.0531 3616 1394ohci (969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/05/15 13:53:27.0498 3616 ACPI (794ff35015209b9d44f1360c42c9776d) C:\Windows\system32\DRIVERS\ACPI.sys
2011/05/15 13:53:27.0794 3616 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/05/15 13:53:28.0137 3616 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/05/15 13:53:28.0465 3616 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/05/15 13:53:28.0746 3616 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/05/15 13:53:29.0151 3616 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2011/05/15 13:53:29.0463 3616 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2011/05/15 13:53:29.0900 3616 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2011/05/15 13:53:30.0259 3616 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2011/05/15 13:53:30.0665 3616 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/05/15 13:53:31.0008 3616 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/05/15 13:53:31.0413 3616 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys
2011/05/15 13:53:31.0772 3616 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/05/15 13:53:32.0131 3616 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys
2011/05/15 13:53:32.0537 3616 ApfiltrService (8655a2983a86d6675135b1ff6892055d) C:\Windows\system32\DRIVERS\Apfiltr.sys
2011/05/15 13:53:32.0880 3616 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2011/05/15 13:53:33.0254 3616 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/05/15 13:53:33.0582 3616 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/05/15 13:53:34.0081 3616 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/05/15 13:53:34.0455 3616 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2011/05/15 13:53:34.0939 3616 athr (f8633cdd09647a64ee8db550630427ff) C:\Windows\system32\DRIVERS\athrx.sys
2011/05/15 13:53:35.0438 3616 avgntflt (39c2e2870fc0c2ae0595b883cbe716b4) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/05/15 13:53:35.0781 3616 avipbb (c98fa6e5ad0e857d22716bd2b8b1f399) C:\Windows\system32\DRIVERS\avipbb.sys
2011/05/15 13:53:36.0203 3616 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/05/15 13:53:36.0561 3616 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/05/15 13:53:36.0905 3616 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/05/15 13:53:37.0295 3616 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/05/15 13:53:37.0669 3616 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
2011/05/15 13:53:37.0981 3616 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/05/15 13:53:38.0387 3616 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/05/15 13:53:38.0777 3616 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/05/15 13:53:39.0151 3616 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/05/15 13:53:39.0510 3616 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/05/15 13:53:39.0853 3616 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/05/15 13:53:40.0243 3616 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/05/15 13:53:40.0649 3616 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/05/15 13:53:41.0023 3616 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2011/05/15 13:53:41.0398 3616 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/05/15 13:53:41.0632 3616 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/05/15 13:53:42.0068 3616 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/05/15 13:53:42.0380 3616 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2011/05/15 13:53:42.0770 3616 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2011/05/15 13:53:43.0129 3616 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/05/15 13:53:43.0457 3616 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/05/15 13:53:43.0800 3616 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/05/15 13:53:44.0143 3616 CtClsFlt (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys
2011/05/15 13:53:44.0502 3616 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2011/05/15 13:53:44.0970 3616 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/05/15 13:53:45.0282 3616 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/05/15 13:53:45.0656 3616 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/05/15 13:53:46.0078 3616 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
2011/05/15 13:53:46.0514 3616 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/05/15 13:53:46.0920 3616 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/05/15 13:53:47.0232 3616 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2011/05/15 13:53:47.0606 3616 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/05/15 13:53:47.0918 3616 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/05/15 13:53:48.0293 3616 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/05/15 13:53:48.0730 3616 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/05/15 13:53:49.0088 3616 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/05/15 13:53:49.0572 3616 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/05/15 13:53:49.0931 3616 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2011/05/15 13:53:50.0274 3616 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/05/15 13:53:50.0586 3616 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/05/15 13:53:50.0945 3616 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/05/15 13:53:51.0304 3616 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/05/15 13:53:51.0725 3616 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/05/15 13:53:52.0193 3616 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/05/15 13:53:52.0505 3616 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2011/05/15 13:53:52.0848 3616 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/05/15 13:53:53.0176 3616 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/05/15 13:53:53.0503 3616 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/05/15 13:53:53.0878 3616 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/05/15 13:53:54.0236 3616 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2011/05/15 13:53:54.0626 3616 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/05/15 13:53:55.0048 3616 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2011/05/15 13:53:55.0391 3616 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2011/05/15 13:53:55.0750 3616 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/05/15 13:53:56.0155 3616 iaStor (2064090c9faad92c090d77e50e735b2e) C:\Windows\system32\DRIVERS\iaStor.sys
2011/05/15 13:53:56.0576 3616 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys
2011/05/15 13:53:57.0169 3616 igfx (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys
2011/05/15 13:53:57.0731 3616 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2011/05/15 13:53:58.0136 3616 IntcAzAudAddService (2faaea2dc2719e67fd7c0d51f9e743f7) C:\Windows\system32\drivers\RTKVHD64.sys
2011/05/15 13:53:58.0495 3616 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2011/05/15 13:53:58.0854 3616 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/05/15 13:53:59.0197 3616 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/05/15 13:53:59.0509 3616 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/05/15 13:53:59.0806 3616 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/05/15 13:54:00.0149 3616 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/05/15 13:54:00.0445 3616 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2011/05/15 13:54:00.0851 3616 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/05/15 13:54:01.0241 3616 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/05/15 13:54:01.0600 3616 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/05/15 13:54:01.0958 3616 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2011/05/15 13:54:02.0348 3616 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2011/05/15 13:54:02.0707 3616 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/05/15 13:54:03.0097 3616 L1C (32980b4e711d2ef7128c44dc2cf85706) C:\Windows\system32\DRIVERS\L1C62x64.sys
2011/05/15 13:54:03.0487 3616 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/05/15 13:54:03.0893 3616 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/05/15 13:54:04.0252 3616 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/05/15 13:54:04.0595 3616 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/05/15 13:54:04.0938 3616 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/05/15 13:54:05.0297 3616 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/05/15 13:54:05.0702 3616 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/05/15 13:54:06.0077 3616 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/05/15 13:54:06.0420 3616 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/05/15 13:54:06.0779 3616 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/05/15 13:54:07.0138 3616 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/05/15 13:54:07.0481 3616 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/05/15 13:54:07.0793 3616 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2011/05/15 13:54:08.0167 3616 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2011/05/15 13:54:08.0526 3616 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/05/15 13:54:09.0010 3616 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2011/05/15 13:54:09.0415 3616 mrxsmb (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/05/15 13:54:09.0774 3616 mrxsmb10 (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/05/15 13:54:10.0180 3616 mrxsmb20 (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/05/15 13:54:10.0523 3616 msahci (bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys
2011/05/15 13:54:10.0928 3616 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2011/05/15 13:54:11.0303 3616 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/05/15 13:54:11.0646 3616 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/05/15 13:54:11.0974 3616 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/05/15 13:54:12.0426 3616 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2011/05/15 13:54:12.0816 3616 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/05/15 13:54:13.0128 3616 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/05/15 13:54:13.0471 3616 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2011/05/15 13:54:13.0846 3616 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/05/15 13:54:14.0220 3616 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/05/15 13:54:14.0563 3616 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/05/15 13:54:14.0922 3616 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/05/15 13:54:15.0328 3616 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/05/15 13:54:15.0749 3616 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2011/05/15 13:54:16.0092 3616 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/05/15 13:54:16.0466 3616 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/05/15 13:54:16.0841 3616 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/05/15 13:54:17.0231 3616 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/05/15 13:54:17.0621 3616 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2011/05/15 13:54:17.0980 3616 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/05/15 13:54:18.0370 3616 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2011/05/15 13:54:18.0760 3616 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/05/15 13:54:19.0103 3616 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/05/15 13:54:19.0477 3616 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/05/15 13:54:19.0992 3616 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys
2011/05/15 13:54:20.0335 3616 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/05/15 13:54:20.0663 3616 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys
2011/05/15 13:54:21.0006 3616 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys
2011/05/15 13:54:21.0365 3616 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/05/15 13:54:21.0677 3616 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/05/15 13:54:22.0051 3616 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/05/15 13:54:22.0410 3616 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2011/05/15 13:54:22.0769 3616 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2011/05/15 13:54:23.0112 3616 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2011/05/15 13:54:23.0549 3616 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/05/15 13:54:23.0892 3616 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/05/15 13:54:24.0298 3616 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/05/15 13:54:24.0719 3616 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2011/05/15 13:54:25.0015 3616 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/05/15 13:54:25.0390 3616 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2011/05/15 13:54:25.0764 3616 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
2011/05/15 13:54:26.0279 3616 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2011/05/15 13:54:26.0606 3616 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/05/15 13:54:26.0903 3616 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/05/15 13:54:27.0262 3616 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/05/15 13:54:27.0667 3616 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/05/15 13:54:28.0010 3616 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/05/15 13:54:28.0338 3616 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/05/15 13:54:28.0744 3616 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/05/15 13:54:29.0102 3616 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2011/05/15 13:54:29.0461 3616 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/05/15 13:54:29.0851 3616 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/05/15 13:54:30.0257 3616 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/05/15 13:54:30.0600 3616 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/05/15 13:54:30.0974 3616 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2011/05/15 13:54:31.0411 3616 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2011/05/15 13:54:31.0817 3616 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/05/15 13:54:32.0191 3616 RSUSBSTOR (30f463768d5143bfd7b2df822b53cf4d) C:\Windows\system32\Drivers\RtsUStor.sys
2011/05/15 13:54:32.0316 3616 SASDIFSV (99df79c258b3342b6c8a5f802998de56) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
2011/05/15 13:54:32.0347 3616 SASKUTIL (2859c35c0651e8eb0d86d48e740388f2) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
2011/05/15 13:54:32.0659 3616 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/05/15 13:54:32.0971 3616 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2011/05/15 13:54:33.0314 3616 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/05/15 13:54:33.0704 3616 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/05/15 13:54:34.0063 3616 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/05/15 13:54:34.0438 3616 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/05/15 13:54:34.0812 3616 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/05/15 13:54:35.0155 3616 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/05/15 13:54:35.0545 3616 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/05/15 13:54:35.0904 3616 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/05/15 13:54:36.0294 3616 Sftfs (72cd52403efc137290cb5a328510ebca) C:\Windows\system32\DRIVERS\Sftfslh.sys
2011/05/15 13:54:36.0700 3616 Sftplay (31a36ef71af36eabcc4b4f8ab8f76465) C:\Windows\system32\DRIVERS\Sftplaylh.sys
2011/05/15 13:54:37.0043 3616 Sftredir (2d969194fcc8eb41ed1d52863bfe7f52) C:\Windows\system32\DRIVERS\Sftredirlh.sys
2011/05/15 13:54:37.0370 3616 Sftvol (08b36d2f63af3ca2248458a4280c0c50) C:\Windows\system32\DRIVERS\Sftvollh.sys
2011/05/15 13:54:37.0698 3616 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/05/15 13:54:38.0026 3616 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/05/15 13:54:38.0353 3616 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/05/15 13:54:38.0774 3616 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/05/15 13:54:39.0211 3616 srv (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys
2011/05/15 13:54:39.0554 3616 srv2 (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys
2011/05/15 13:54:39.0866 3616 srvnet (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys
2011/05/15 13:54:40.0241 3616 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/05/15 13:54:40.0537 3616 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2011/05/15 13:54:41.0130 3616 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2011/05/15 13:54:41.0520 3616 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/05/15 13:54:41.0910 3616 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/05/15 13:54:42.0238 3616 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/05/15 13:54:42.0659 3616 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/05/15 13:54:42.0971 3616 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2011/05/15 13:54:43.0330 3616 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2011/05/15 13:54:43.0704 3616 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/05/15 13:54:44.0016 3616 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2011/05/15 13:54:44.0437 3616 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/05/15 13:54:44.0843 3616 udfs (31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys
2011/05/15 13:54:45.0264 3616 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/05/15 13:54:45.0638 3616 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2011/05/15 13:54:46.0013 3616 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/05/15 13:54:46.0387 3616 USBAAPL64 (f724b03c3dfaacf08d17d38bf3333583) C:\Windows\system32\Drivers\usbaapl64.sys
2011/05/15 13:54:46.0793 3616 usbccgp (537a4e03d7103c12d42dfd8ffdb5bdc9) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/05/15 13:54:47.0183 3616 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2011/05/15 13:54:47.0588 3616 usbehci (fbb21ebe49f6d560db37ac25fbc68e66) C:\Windows\system32\DRIVERS\usbehci.sys
2011/05/15 13:54:47.0932 3616 usbhub (6b7a8a99c4a459e73c286a6763ea24cc) C:\Windows\system32\DRIVERS\usbhub.sys
2011/05/15 13:54:48.0322 3616 usbohci (8c88aa7617b4cbc2e4bed61d26b33a27) C:\Windows\system32\drivers\usbohci.sys
2011/05/15 13:54:48.0665 3616 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/05/15 13:54:49.0008 3616 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/05/15 13:54:49.0382 3616 usbuhci (0b5b3b2df3fd1709618acfa50b8392b0) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/05/15 13:54:49.0804 3616 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
2011/05/15 13:54:50.0178 3616 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/05/15 13:54:50.0552 3616 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/05/15 13:54:50.0896 3616 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/05/15 13:54:51.0254 3616 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/05/15 13:54:51.0644 3616 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2011/05/15 13:54:52.0019 3616 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/05/15 13:54:52.0502 3616 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2011/05/15 13:54:52.0846 3616 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2011/05/15 13:54:53.0158 3616 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/05/15 13:54:53.0470 3616 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/05/15 13:54:53.0938 3616 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/05/15 13:54:54.0250 3616 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/05/15 13:54:54.0608 3616 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 13:54:54.0655 3616 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/05/15 13:54:55.0076 3616 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/05/15 13:54:55.0498 3616 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/05/15 13:54:55.0903 3616 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/05/15 13:54:56.0246 3616 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys
2011/05/15 13:54:56.0558 3616 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/05/15 13:54:57.0011 3616 WinUsb (4d52c872018af7e18d078978dcc3f6f2) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/05/15 13:54:57.0354 3616 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/05/15 13:54:57.0775 3616 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/05/15 13:54:58.0150 3616 WudfPf (c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys
2011/05/15 13:54:58.0477 3616 WUDFRd (d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/05/15 13:54:58.0852 3616 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
2011/05/15 13:54:58.0930 3616 ================================================================================
2011/05/15 13:54:58.0930 3616 Scan finished
2011/05/15 13:54:58.0930 3616 ================================================================================
|
|
15.05.2011, 12:57
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangen Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.05.2011, 13:19
| #9 |
| | Win 7 Home Security eingefangenCode:
ATTFilter ComboFix 11-05-14.01 - Lisa 15.05.2011 14:04:42.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.4058.2837 [GMT 2:00]
ausgeführt von:: c:\users\Lisa\Desktop\cofi.exe
AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Lisa\AppData\Roaming\Microsoft\Windows\Recent\httpwww.google.deimgresimgurl=httpi94.photobucket.comalbumsl109mp2zonebritinkerbell05.jpg&imgrefurl=httpwww.uns.demitgliedso.URL
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-15 bis 2011-05-15 ))))))))))))))))))))))))))))))
.
.
2011-05-15 12:10 . 2011-05-15 12:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-15 11:44 . 2011-05-15 11:44 -------- d-----w- C:\_OTL
2011-05-14 11:58 . 2011-05-14 11:58 -------- d-----w- c:\users\Lisa\AppData\Roaming\Avira
2011-05-14 11:54 . 2011-04-01 15:07 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-14 11:54 . 2011-04-01 15:07 116568 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-05-14 11:54 . 2011-05-14 11:54 -------- d-----w- c:\programdata\Avira
2011-05-14 11:54 . 2011-05-14 11:54 -------- d-----w- c:\program files (x86)\Avira
2011-05-14 11:34 . 2011-05-14 11:34 388096 ----a-r- c:\users\Lisa\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-14 11:34 . 2011-05-14 11:34 -------- d-----w- C:\Hijackthis
2011-05-14 08:46 . 2011-05-14 08:46 -------- d-----w- c:\users\Lisa\AppData\Roaming\SUPERAntiSpyware.com
2011-05-14 08:46 . 2011-05-14 08:46 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-05-14 08:45 . 2011-05-14 08:45 -------- d-----w- c:\programdata\!SASCORE
2011-05-14 08:45 . 2011-05-14 08:46 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-05-13 21:54 . 2011-05-13 21:54 -------- d-----w- c:\users\Lisa\AppData\Roaming\Malwarebytes
2011-05-13 21:53 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-13 21:53 . 2011-05-13 21:53 -------- d-----w- c:\programdata\Malwarebytes
2011-05-13 21:53 . 2011-05-13 21:53 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-13 21:53 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-13 11:57 . 2011-05-13 11:57 -------- d-----w- c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}
2011-05-12 14:10 . 2011-05-12 14:10 -------- d-----w- c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}
2011-05-11 15:29 . 2011-04-09 06:54 5475712 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-11 15:29 . 2011-04-09 06:21 3967360 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-05-11 15:29 . 2011-04-09 06:21 3911552 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-05-11 15:29 . 2011-03-29 03:32 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-05-11 15:29 . 2011-03-29 03:32 99328 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-05-11 15:29 . 2011-03-29 03:32 324608 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-05-11 15:29 . 2011-03-29 03:32 52224 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-05-11 15:29 . 2011-03-29 03:32 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2011-05-11 15:29 . 2011-03-29 03:32 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2011-05-11 15:29 . 2011-03-29 03:32 7936 ----a-w- c:\windows\system32\drivers\usbd.sys
2011-05-11 15:23 . 2011-05-11 15:24 -------- d-----w- c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}
2011-05-10 14:57 . 2011-05-10 14:57 -------- d-----w- c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}
2011-05-09 15:10 . 2011-05-13 12:37 -------- d-----w- c:\programdata\Skype Extras
2011-05-09 15:10 . 2011-05-09 15:10 -------- d-----w- c:\program files (x86)\Common Files\Skype
2011-05-07 22:19 . 2011-05-07 22:19 -------- d-----w- c:\program files (x86)\Audacity
2011-04-27 13:17 . 2011-02-26 06:23 2870272 ----a-w- c:\windows\explorer.exe
2011-04-27 13:17 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\SysWow64\explorer.exe
2011-04-27 13:17 . 2011-03-12 12:03 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-27 13:17 . 2011-03-12 11:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-04-27 11:42 . 2011-04-27 11:42 -------- d-----w- c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}
2011-04-26 22:58 . 2011-05-04 12:00 -------- d-----w- c:\program files (x86)\ICQ7.5
2011-04-15 12:23 . 2011-03-08 06:14 976896 ----a-w- c:\windows\system32\inetcomm.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr
2011-04-06 20:01 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-04 06:17 . 2011-04-27 13:16 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:17 . 2011-04-27 13:17 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]
"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]
"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-14 50472]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2010-05-21 98208]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-18 2271608]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - klmd25
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-15 10918504]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 392048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?hl=de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-05-15 14:12:10
ComboFix-quarantined-files.txt 2011-05-15 12:12
.
Vor Suchlauf: 12 Verzeichnis(se), 419.342.430.208 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 419.039.182.848 Bytes frei
.
- - End Of File - - 3679A38CDB78A356EB22E5D4FFF2EA48
|
|
15.05.2011, 14:33
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.05.2011, 14:39
| #11 |
| | Win 7 Home Security eingefangen McAfee hab ich ja gestern schon deinstalliert. Aber anscheinend ist's noch da.  |
|
15.05.2011, 14:50
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangen Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter Seccenter::
AV: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus und Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
Dirlook::
c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}
c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}
c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}
c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}
c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.05.2011, 15:15
| #13 |
| | Win 7 Home Security eingefangenCode:
ATTFilter ComboFix 11-05-14.01 - Lisa 15.05.2011 16:00:21.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.4058.2747 [GMT 2:00]
ausgeführt von:: c:\users\Lisa\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Lisa\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-15 bis 2011-05-15 ))))))))))))))))))))))))))))))
.
.
2011-05-15 14:05 . 2011-05-15 14:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-15 11:44 . 2011-05-15 11:44 -------- d-----w- C:\_OTL
2011-05-14 11:58 . 2011-05-14 11:58 -------- d-----w- c:\users\Lisa\AppData\Roaming\Avira
2011-05-14 11:54 . 2011-04-01 15:07 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-14 11:54 . 2011-04-01 15:07 116568 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-05-14 11:54 . 2011-05-14 11:54 -------- d-----w- c:\programdata\Avira
2011-05-14 11:54 . 2011-05-14 11:54 -------- d-----w- c:\program files (x86)\Avira
2011-05-14 11:34 . 2011-05-14 11:34 388096 ----a-r- c:\users\Lisa\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-14 11:34 . 2011-05-14 11:34 -------- d-----w- C:\Hijackthis
2011-05-14 08:46 . 2011-05-14 08:46 -------- d-----w- c:\users\Lisa\AppData\Roaming\SUPERAntiSpyware.com
2011-05-14 08:46 . 2011-05-14 08:46 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-05-14 08:45 . 2011-05-14 08:45 -------- d-----w- c:\programdata\!SASCORE
2011-05-14 08:45 . 2011-05-14 08:46 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-05-13 21:54 . 2011-05-13 21:54 -------- d-----w- c:\users\Lisa\AppData\Roaming\Malwarebytes
2011-05-13 21:53 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-13 21:53 . 2011-05-13 21:53 -------- d-----w- c:\programdata\Malwarebytes
2011-05-13 21:53 . 2011-05-13 21:53 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-13 21:53 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-13 11:57 . 2011-05-13 11:57 -------- d-----w- c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751}
2011-05-12 14:10 . 2011-05-12 14:10 -------- d-----w- c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200}
2011-05-11 15:29 . 2011-04-09 06:54 5475712 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-11 15:29 . 2011-04-09 06:21 3967360 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-05-11 15:29 . 2011-04-09 06:21 3911552 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-05-11 15:29 . 2011-03-29 03:32 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-05-11 15:29 . 2011-03-29 03:32 99328 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-05-11 15:29 . 2011-03-29 03:32 324608 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-05-11 15:29 . 2011-03-29 03:32 52224 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-05-11 15:29 . 2011-03-29 03:32 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2011-05-11 15:29 . 2011-03-29 03:32 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2011-05-11 15:29 . 2011-03-29 03:32 7936 ----a-w- c:\windows\system32\drivers\usbd.sys
2011-05-11 15:23 . 2011-05-11 15:24 -------- d-----w- c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC}
2011-05-10 14:57 . 2011-05-10 14:57 -------- d-----w- c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C}
2011-05-09 15:10 . 2011-05-13 12:37 -------- d-----w- c:\programdata\Skype Extras
2011-05-09 15:10 . 2011-05-09 15:10 -------- d-----w- c:\program files (x86)\Common Files\Skype
2011-05-07 22:19 . 2011-05-07 22:19 -------- d-----w- c:\program files (x86)\Audacity
2011-04-27 13:17 . 2011-02-26 06:23 2870272 ----a-w- c:\windows\explorer.exe
2011-04-27 13:17 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\SysWow64\explorer.exe
2011-04-27 13:17 . 2011-03-12 12:03 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-27 13:17 . 2011-03-12 11:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-04-27 11:42 . 2011-04-27 11:42 -------- d-----w- c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168}
2011-04-26 22:58 . 2011-05-04 12:00 -------- d-----w- c:\program files (x86)\ICQ7.5
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr
2011-04-06 20:01 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-11 06:19 . 2011-04-15 12:25 1395712 ----a-w- c:\windows\system32\mfc42.dll
2011-03-11 06:19 . 2011-04-15 12:25 1359872 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 12:25 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 12:25 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
2011-03-08 06:14 . 2011-04-15 12:23 976896 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-08 05:38 . 2011-04-15 12:23 740864 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-03-04 06:17 . 2011-04-27 13:16 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:17 . 2011-04-27 13:17 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 06:17 . 2011-04-15 12:24 182272 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-03-03 06:14 . 2011-04-15 12:24 30208 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-03-03 05:27 . 2011-04-15 12:24 28672 ----a-w- c:\windows\SysWow64\dnscacheugc.exe
2011-03-03 03:58 . 2011-04-15 12:25 3133440 ----a-w- c:\windows\system32\win32k.sys
2011-02-24 06:30 . 2011-04-15 12:25 476160 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-24 06:29 . 2011-04-15 12:24 1197056 ----a-w- c:\windows\system32\wininet.dll
2011-02-24 06:24 . 2011-04-15 12:24 57856 ----a-w- c:\windows\system32\licmgr10.dll
2011-02-24 05:32 . 2011-04-15 12:25 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-24 05:32 . 2011-04-15 12:24 981504 ----a-w- c:\windows\SysWow64\wininet.dll
2011-02-24 05:30 . 2011-04-15 12:24 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-02-24 05:05 . 2011-04-15 12:24 482816 ----a-w- c:\windows\system32\html.iec
2011-02-24 04:24 . 2011-04-15 12:24 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-02-24 04:23 . 2011-04-15 12:24 386048 ----a-w- c:\windows\SysWow64\html.iec
2011-02-24 03:50 . 2011-04-15 12:24 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-02-23 05:16 . 2011-04-15 12:25 461312 ----a-w- c:\windows\system32\drivers\srv.sys
2011-02-23 05:16 . 2011-04-15 12:25 401920 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-02-23 05:15 . 2011-04-15 12:25 161792 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-02-23 05:15 . 2011-04-15 12:23 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-23 05:15 . 2011-04-15 12:23 286720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-02-23 05:15 . 2011-04-15 12:23 126464 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-02-23 05:15 . 2011-04-15 12:23 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-02-19 06:36 . 2011-04-15 12:25 46080 ----a-w- c:\windows\system32\atmlib.dll
2011-02-19 05:32 . 2011-04-15 12:25 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-02-19 04:13 . 2011-04-15 12:25 367104 ----a-w- c:\windows\system32\atmfd.dll
2011-02-19 03:37 . 2011-04-15 12:25 294912 ----a-w- c:\windows\SysWow64\atmfd.dll
2011-02-18 06:37 . 2011-04-15 12:25 612352 ----a-w- c:\windows\system32\vbscript.dll
2011-02-18 05:36 . 2011-04-15 12:25 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\Lisa\AppData\Local\{0B332B9D-664A-4D0F-B765-54EDEDAE03BC} ----
.
.
---- Directory of c:\users\Lisa\AppData\Local\{434240F1-DB07-4945-8E0A-A7E1E70A7200} ----
.
.
---- Directory of c:\users\Lisa\AppData\Local\{A0168BF8-FD2D-480C-A8E7-07D59CD7F98C} ----
.
.
---- Directory of c:\users\Lisa\AppData\Local\{E136828D-ED73-4BC9-A48E-4BEE5E95A751} ----
.
.
---- Directory of c:\users\Lisa\AppData\Local\{F5F3F5C0-2F23-48BB-8295-F5F61151A168} ----
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-15_12.10.24 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-10-27 17:15 . 2011-05-15 12:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-27 17:15 . 2011-05-15 13:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-27 17:15 . 2011-05-15 13:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-27 17:15 . 2011-05-15 12:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-24 22:49 . 2011-05-15 13:36 265070 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]
"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]
"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-14 50472]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 135664]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2010-05-21 98208]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-18 2271608]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - klmd25
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]
.
2011-05-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-24 21:49]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-15 10918504]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-06-04 392048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Lisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\yma2uxwn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?hl=de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.0&q=
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3496867429-835713656-1144113118-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-05-15 16:06:49
ComboFix-quarantined-files.txt 2011-05-15 14:06
ComboFix2.txt 2011-05-15 12:12
.
Vor Suchlauf: 15 Verzeichnis(se), 419.071.315.968 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 419.020.505.088 Bytes frei
.
- - End Of File - - FB8943C36A1A58B3AAECD7E193530491
|
|
15.05.2011, 15:30
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 7 Home Security eingefangen Bitte nun Logs mit GMER und mbrcheck erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg Anleitung zu mbrcheck: Downloade Dir MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.05.2011, 16:22
| #15 |
| | Win 7 Home Security eingefangen Gmer hat nichts gefunden, das Log ist leer gewesen. MBR: Code:
ATTFilter MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Inspiron N5030
Logical Drives Mask: 0x0001000c
Kernel Drivers (total 197):
0x03213000 \SystemRoot\system32\ntoskrnl.exe
0x037E7000 \SystemRoot\system32\hal.dll
0x00B9F000 \SystemRoot\system32\kdcom.dll
0x00CE0000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D24000 \SystemRoot\system32\PSHED.dll
0x00D38000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00E01000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00EA5000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00EB4000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00F0B000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00F14000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00F1E000 \SystemRoot\system32\DRIVERS\pci.sys
0x00F51000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00F5E000 \SystemRoot\System32\drivers\partmgr.sys
0x00F73000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00F7C000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00F88000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00F9D000 \SystemRoot\System32\drivers\volmgrx.sys
0x00CC0000 \SystemRoot\System32\drivers\mountmgr.sys
0x010FD000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x01307000 \SystemRoot\system32\DRIVERS\atapi.sys
0x01310000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x0133A000 \SystemRoot\system32\DRIVERS\msahci.sys
0x01345000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x01355000 \SystemRoot\system32\drivers\amdxata.sys
0x01360000 \SystemRoot\system32\drivers\fltmgr.sys
0x013AC000 \SystemRoot\system32\drivers\fileinfo.sys
0x013C0000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x01403000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01000000 \SystemRoot\System32\Drivers\msrpc.sys
0x015A5000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0105E000 \SystemRoot\System32\Drivers\cng.sys
0x015BF000 \SystemRoot\System32\drivers\pcw.sys
0x015D0000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x016E3000 \SystemRoot\system32\drivers\ndis.sys
0x01600000 \SystemRoot\system32\drivers\NETIO.SYS
0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01803000 \SystemRoot\System32\drivers\tcpip.sys
0x0168B000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x00D96000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x016D5000 \SystemRoot\System32\Drivers\spldr.sys
0x01AF5000 \SystemRoot\System32\drivers\rdyboost.sys
0x01B2F000 \SystemRoot\System32\Drivers\mup.sys
0x01B41000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01B4A000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01B84000 \SystemRoot\system32\DRIVERS\disk.sys
0x01B9A000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x03EA9000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x03ED3000 \SystemRoot\System32\Drivers\Null.SYS
0x03EDC000 \SystemRoot\System32\Drivers\Beep.SYS
0x03EE3000 \SystemRoot\System32\drivers\vga.sys
0x03EF1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x03F16000 \SystemRoot\System32\drivers\watchdog.sys
0x03F26000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x03F2F000 \SystemRoot\system32\drivers\rdpencdd.sys
0x03F38000 \SystemRoot\system32\drivers\rdprefmp.sys
0x03F41000 \SystemRoot\System32\Drivers\Msfs.SYS
0x03F4C000 \SystemRoot\System32\Drivers\Npfs.SYS
0x03F5D000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03F7B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03F88000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03C00000 \SystemRoot\system32\drivers\afd.sys
0x03FCD000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x03FD6000 \SystemRoot\system32\DRIVERS\pacer.sys
0x01BD8000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x01BEE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x01A00000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x01A1B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x01A2F000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
0x01A39000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
0x01A43000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x01A94000 \SystemRoot\system32\drivers\nsiproxy.sys
0x01AA0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x01AAB000 \SystemRoot\System32\drivers\discache.sys
0x01ABA000 \SystemRoot\System32\Drivers\dfsc.sys
0x01AD8000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x017D5000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x015DA000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x04A20000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x0543F000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x05533000 \SystemRoot\System32\drivers\dxgmms1.sys
0x05579000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x05586000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x055DC000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x010D1000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x02E2D000 \SystemRoot\system32\DRIVERS\athrx.sys
0x02FB6000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x02FC3000 \SystemRoot\system32\DRIVERS\L1C62x64.sys
0x02FD8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0405B000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x040AB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x040BA000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x040C9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x040D6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x040DB000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x040E4000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x040FA000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x0410A000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04120000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04144000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04150000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0417F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0419A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x041BB000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x041D5000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04000000 \SystemRoot\system32\DRIVERS\ks.sys
0x04043000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04444000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x0449E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x060C3000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x0630B000 \SystemRoot\system32\drivers\portcls.sys
0x06348000 \SystemRoot\system32\drivers\drmk.sys
0x0636A000 \SystemRoot\system32\drivers\ksthunk.sys
0x06370000 \SystemRoot\System32\Drivers\crashdmp.sys
0x03C8A000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x0637E000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x06391000 \SystemRoot\System32\drivers\Dxapi.sys
0x063DB000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x063F8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x06000000 \SystemRoot\System32\Drivers\usbvideo.sys
0x0602E000 \SystemRoot\system32\DRIVERS\CtClsFlt.sys
0x005F0000 \SystemRoot\System32\TSDDD.dll
0x00710000 \SystemRoot\System32\cdd.dll
0x06067000 \SystemRoot\system32\drivers\luafv.sys
0x0608A000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x060A7000 \SystemRoot\system32\DRIVERS\Sftvollh.sys
0x0639D000 \SystemRoot\system32\drivers\WudfPf.sys
0x063BE000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x044B3000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04506000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04519000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x04531000 \SystemRoot\system32\drivers\HTTP.sys
0x04400000 \SystemRoot\system32\DRIVERS\bowser.sys
0x0441E000 \SystemRoot\System32\drivers\mpsdrv.sys
0x02E00000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x04828000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x04876000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x04899000 \SystemRoot\system32\drivers\peauth.sys
0x0493F000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0721B000 \SystemRoot\system32\DRIVERS\Sftfslh.sys
0x072D2000 \SystemRoot\system32\DRIVERS\Sftplaylh.sys
0x0731F000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0734C000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0735E000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0494A000 \SystemRoot\System32\DRIVERS\srv.sys
0x073C5000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys
0x07CE7000 \SystemRoot\System32\Drivers\fastfat.SYS
0x07D8E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x07D9C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x07DB5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x07DBE000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x07C57000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x07C88000 \SystemRoot\System32\Drivers\usbaapl64.sys
0x07C99000 \SystemRoot\system32\DRIVERS\WinUsb.sys
0x07D1D000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS
0x07D25000 \SystemRoot\system32\DRIVERS\monitor.sys
0x77020000 \Windows\System32\ntdll.dll
0x48330000 \Windows\System32\smss.exe
0xFF340000 \Windows\System32\apisetschema.dll
0xFFE50000 \Windows\System32\autochk.exe
0xFF200000 \Windows\System32\rpcrt4.dll
0xFF1B0000 \Windows\System32\Wldap32.dll
0xFF0D0000 \Windows\System32\advapi32.dll
0x76F00000 \Windows\System32\kernel32.dll
0x76E00000 \Windows\System32\user32.dll
0xFEF50000 \Windows\System32\urlmon.dll
0xFEED0000 \Windows\System32\difxapi.dll
0xFEE80000 \Windows\System32\ws2_32.dll
0xFEDB0000 \Windows\System32\usp10.dll
0xFEB50000 \Windows\System32\iertutil.dll
0xFEAD0000 \Windows\System32\shlwapi.dll
0xFEAB0000 \Windows\System32\sechost.dll
0xFDD20000 \Windows\System32\shell32.dll
0xFDCB0000 \Windows\System32\gdi32.dll
0xFDCA0000 \Windows\System32\lpk.dll
0xFDC00000 \Windows\System32\msvcrt.dll
0xFDAD0000 \Windows\System32\wininet.dll
0xFDAB0000 \Windows\System32\imagehlp.dll
0xFDA10000 \Windows\System32\clbcatq.dll
0x771F0000 \Windows\System32\psapi.dll
0xFDA00000 \Windows\System32\nsi.dll
0xFD8F0000 \Windows\System32\msctf.dll
0xFD710000 \Windows\System32\setupapi.dll
0xFD630000 \Windows\System32\oleaut32.dll
0xFD420000 \Windows\System32\ole32.dll
0x771E0000 \Windows\System32\normaliz.dll
0xFD3F0000 \Windows\System32\imm32.dll
0xFD350000 \Windows\System32\comdlg32.dll
0xFD1E0000 \Windows\System32\crypt32.dll
0xFD140000 \Windows\System32\comctl32.dll
0xFD0D0000 \Windows\System32\KernelBase.dll
0xFD090000 \Windows\System32\wintrust.dll
0xFD050000 \Windows\System32\cfgmgr32.dll
0xFD030000 \Windows\System32\devobj.dll
0xFD020000 \Windows\System32\msasn1.dll
Processes (total 77):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
412 csrss.exe
488 C:\Windows\System32\wininit.exe
508 csrss.exe
552 C:\Windows\System32\services.exe
576 C:\Windows\System32\winlogon.exe
588 C:\Windows\System32\lsass.exe
596 C:\Windows\System32\lsm.exe
708 C:\Windows\System32\svchost.exe
808 C:\Windows\System32\svchost.exe
908 C:\Windows\System32\svchost.exe
940 C:\Windows\System32\svchost.exe
972 C:\Windows\System32\svchost.exe
428 C:\Windows\System32\svchost.exe
664 C:\Program Files\Dell\DellDock\DockLogin.exe
312 C:\Windows\System32\svchost.exe
1156 C:\Windows\System32\spoolsv.exe
1244 C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
1324 C:\Windows\System32\taskhost.exe
1412 C:\Windows\System32\dwm.exe
1440 C:\Windows\explorer.exe
1588 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
1676 C:\Windows\System32\igfxtray.exe
1684 C:\Windows\System32\hkcmd.exe
1692 C:\Windows\System32\igfxpers.exe
1240 C:\Windows\System32\svchost.exe
1988 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
2024 C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
592 C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
2156 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2180 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2236 C:\Windows\System32\svchost.exe
2292 C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
2560 C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
2616 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
2648 C:\Windows\System32\svchost.exe
2684 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
2776 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
2788 C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
2816 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
2928 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2984 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
1496 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
1912 C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
2612 C:\Windows\System32\conhost.exe
3352 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
4068 C:\Windows\System32\SearchIndexer.exe
3980 C:\Program Files\DellTPad\hidfind.exe
3392 C:\Windows\System32\svchost.exe
3532 C:\Program Files\Windows Media Player\wmpnetwk.exe
4660 C:\Windows\System32\svchost.exe
5064 dllhost.exe
900 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
4448 C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
3700 C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
5100 C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
3696 C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
3428 C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
2860 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
4944 C:\Windows\System32\svchost.exe
1832 C:\Program Files\iPod\bin\iPodService.exe
1644 WUDFHost.exe
1004 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
3932 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
2956 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
3528 C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Desktop.exe
4092 C:\Program Files (x86)\TeamViewer\Version6\tv_w32.exe
1948 C:\Program Files (x86)\TeamViewer\Version6\tv_x64.exe
4792 C:\Windows\System32\SearchProtocolHost.exe
3616 C:\Windows\System32\SearchFilterHost.exe
2908 C:\Windows\System32\audiodg.exe
2668 dllhost.exe
3140 dllhost.exe
4940 C:\Users\Lisa\Downloads\MBRCheck.exe
3492 C:\Windows\System32\conhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`afd00000 (NTFS)
\\.\Q: --> error 5
PhysicalDrive0 Model Number: WDCWD5000BEVT-75A0RT0, Rev: 01.01A01
Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
Done!
|
|
| Themen zu Win 7 Home Security eingefangen |
| .dll, 64-bit, adobe, autorun, bho, bingbar, bonjour, c:\windows\system32\rundll32.exe, converter, desktop, error, explorer, flash player, format, google, helper, heuristics.reserved.word.exploit, hijack.startmenuinternet, home, home security, iexplore.exe, install.exe, location, logfile, microsoft office starter 2010, mozilla, mp3, oldtimer, picasa, plug-in, pup.joke.buttons, realtek, registry, rundll, scan, searchplugins, security, shell32.dll, software, start menu, studio, syswow64, viren, virus, webcheck, win7 anti spyware |
Linear-Darstellung
