Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   HEUR:Trojan.Win32.Generic (https://www.trojaner-board.de/129480-heur-trojan-win32-generic.html)

rainy13 13.01.2013 16:59
HEUR:Trojan.Win32.Generic
 
Hallo,

laut Kapersky Lab habe ich mir folgenden Trojaner eingefangen:
HEUR:Trojan.Win32.Generic

Symptome: Bei der Google-Suche werden die Links umgeleitet auf Werbeseiten, vorwiegend Sexseiten, Casino-Seiten etc.

Infiziert ist folgende Datei:
getmac7.dll
c:\Windows\System32

Diese Datei ist geschützt und versteckt, ich habe keine Zugriffsrechte, d.h. ich kann sie weder löschen noch bei bei Virustotal hochladen.

Ich habe nacheinander verschiedene Antivirenprogramme und Malware-Programme laufen lassen, dabei jeweils das zuletzt verwendete zuvor wieder deinstalliert. Weder Malwarebytes noch Avira noch Avast konnten den Virus finden. Alle drei Programme zeigten keine Fundstellen an, mein System sei sauber.

Den Virus eingefangen habe ich mir saudämlich - dafür gibt es echt keine Entschuldigung. Ich habe nachts nach Übungsblättern für meinen Nachhilfeschüler gesucht und als ich über die google suche auf eine pdf Seite bei pons geleitet werden sollte hat sich eine Anwendung geöffnet, die ich ausführen sollte, um die pdf-Datei zu lesen. Ich weiß... :headbang: Ich war übermüdet und pons eine vertrauenswürdige Seite...

OTL zeigt die Datei auch an Datum und Uhrzeit stimmen mit der vorher beschriebenen Situation überein.

Ich habe über einen anderen Laptop bereits sämtliche Passwörter geändert. Ich vermute an eine Neuformatierung komme ich nicht vorbei, würde aber gerne wissen, ob ich meine Word-Dokumente gefahrlos vorher auf einen USB-Stick schieben kann.

Anbei die Logfiles von OTL.

Und hier das Log von Malwarebytes

Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.13.06

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.16982
eva :: EVA-PC [Administrator]

13.01.2013 17:21:28
mbam-log-2013-01-13 (17-21-28).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 197579
Laufzeit: 10 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Vielen Dank im Voraus.

cosinus 13.01.2013 22:08
Hallo und :hallo:

Mal eine kurze Frage, das ist jetzt nichts speziell gegen dich, ich hätte auch jeden anderen fragen können der die Logs so postet - wo bitte steht, dass die Logs in den Anhang gelegt werden sollen bzw. wo genau hast du das herausgelesen?

Logfiles im Anhang erschweren die Auswertung massivst

Bitte um Erläuterung damit man die Textstelle in der Anleitung für alle Neulinge mal gezielt ändern/verbessern kann. Danke.
Zitat:
Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

rainy13 13.01.2013 22:45
Hallo Cosinus,
ich hatte das in anderen Beiträgen gesehen und einfach analog gemacht, später hab ich in einem anderen Post den Hinweis gesehen, dass im Text posten besser ist, deswegen habe ich das Malwarebytes Log, das ich nachträglich eingefügt habe, in CODE-Tags eingefügt, die alten Anhänge konnte ich aber nicht löschen, also hab ich sie erstmal so gelassen.

Aber es wäre sicherlich hilfreich auf dieser Seite: http://www.trojaner-board.de/69886-a...-beachten.html unter Punkt 2 Schritt 2 OTL ("Kopiere nun den Inhalt aus OTL.txt und Extra.txt in deinen Thread") die Anleitung zum Posten in CODE-Tags zu ergänzen, dann hätte ich es sicherlich gemacht.

Danke im Voraus.

OTL Log:

Code:
OTL logfile created on: 13.01.2013 16:25:49 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\eva\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 54,46% Memory free
3,72 Gb Paging File | 2,88 Gb Available in Paging File | 77,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,76 Gb Total Space | 20,21 Gb Free Space | 25,66% Space Free | Partition Type: NTFS
Drive D: | 21,30 Gb Total Space | 8,69 Gb Free Space | 40,80% Space Free | Partition Type: NTFS
Drive G: | 982,72 Mb Total Space | 260,81 Mb Free Space | 26,54% Space Free | Partition Type: FAT
 
Computer Name: EVA-PC | User Name: eva | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.13 16:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\eva\Desktop\OTL.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2012.08.24 03:25:56 | 000,683,696 | ---- | M] (Juniper Networks) -- C:\Programme\Juniper Networks\Common Files\dsNcService.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.19 19:58:38 | 000,253,952 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Programme\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe
PRC - [2012.04.25 18:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
PRC - [2010.09.08 16:10:36 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.09.08 15:31:40 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.25 18:52:28 | 001,270,160 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtscript4.dll
MOD - [2012.04.25 18:52:26 | 007,422,352 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtgui4.dll
MOD - [2012.04.25 18:52:24 | 000,795,024 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtnetwork4.dll
MOD - [2012.04.25 18:52:24 | 000,192,912 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtsql4.dll
MOD - [2012.04.25 18:52:22 | 002,453,904 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtdeclarative4.dll
MOD - [2012.04.25 18:52:22 | 002,126,224 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\qtcore4.dll
MOD - [2011.09.05 18:36:52 | 000,025,088 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\imageformats\qgif4.dll
MOD - [2011.09.05 18:36:50 | 000,180,224 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\imageformats\qjpeg4.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.01.09 19:36:27 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.08.24 03:25:56 | 000,683,696 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Programme\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.04.25 18:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe -- (KSS)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.09.09 10:32:02 | 000,265,912 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.11.04 02:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)
SRV - [2006.11.02 13:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.10.30 23:51:58 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.04.09 13:27:18 | 000,026,624 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dsNcAdpt.sys -- (dsNcAdpt)
DRV - [2008.12.13 10:27:50 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008.11.04 02:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2008.10.09 12:50:08 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2008.10.09 12:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2006.11.02 08:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: globefish@projects.6831.courses.csail.mit.edu:1.4.1
FF - prefs.js..extensions.enabledAddons: zotero@chnm.gmu.edu:3.0.11
FF - prefs.js..extensions.enabledAddons: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2012.09.13
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.1.10
FF - prefs.js..extensions.enabledItems: globefish@projects.6831.courses.csail.mit.edu:1.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2010.11.18
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\eva\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\eva\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2010.11.27 16:54:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.01.13 14:13:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.06 00:11:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.08 20:08:54 | 000,000,000 | ---D | M]
 
[2010.09.05 19:08:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eva\AppData\Roaming\mozilla\Extensions
[2012.12.30 18:22:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eva\AppData\Roaming\mozilla\Firefox\Profiles\ff57kbdg.default\extensions
[2010.09.11 09:17:05 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\eva\AppData\Roaming\mozilla\Firefox\Profiles\ff57kbdg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.11.28 17:06:10 | 000,000,000 | ---D | M] (Zotero) -- C:\Users\eva\AppData\Roaming\mozilla\Firefox\Profiles\ff57kbdg.default\extensions\zotero@chnm.gmu.edu
[2012.12.30 18:22:29 | 000,234,999 | ---- | M] () (No name found) -- C:\Users\eva\AppData\Roaming\mozilla\firefox\profiles\ff57kbdg.default\extensions\artur.dubovoy@gmail.com.xpi
[2012.01.12 00:22:00 | 000,165,007 | ---- | M] () (No name found) -- C:\Users\eva\AppData\Roaming\mozilla\firefox\profiles\ff57kbdg.default\extensions\globefish@projects.6831.courses.csail.mit.edu.xpi
[2012.11.28 16:15:53 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\eva\AppData\Roaming\mozilla\firefox\profiles\ff57kbdg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.03.04 19:36:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.11.27 16:54:32 | 000,000,000 | ---D | M] (Citavi Picker) -- C:\PROGRAMDATA\SWISS ACADEMIC SOFTWARE\CITAVI PICKER\FIREFOX
[2012.03.04 19:36:27 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.11 11:33:03 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.11 11:33:03 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.11 11:33:03 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.11 11:33:03 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.11 11:33:03 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.11 11:33:03 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\eva\AppData\Local\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\eva\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\eva\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\eva\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Drive = C:\Users\eva\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Google-Suche = C:\Users\eva\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\eva\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\
 
O1 HOSTS File: ([2012.12.16 03:00:03 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKCU..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKCU..\Run: [KSS] C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Kaspersky Lab ZAO)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\eva\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\eva\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{597F76CD-5B7B-4C83-B189-02107ED20278}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\eva\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\eva\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{240186a4-d1cb-11e1-8689-9bd7ab33d825}\Shell - "" = AutoRun
O33 - MountPoints2\{240186a4-d1cb-11e1-8689-9bd7ab33d825}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{240186a6-d1cb-11e1-8689-9bd7ab33d825}\Shell - "" = AutoRun
O33 - MountPoints2\{240186a6-d1cb-11e1-8689-9bd7ab33d825}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{86025ffc-bd1e-11df-80bf-00140b421571}\Shell\AutoRun\command - "" = F:\Menu.exe
O33 - MountPoints2\{de08a4bb-d321-11e1-96d3-dabd32358ef7}\Shell - "" = AutoRun
O33 - MountPoints2\{de08a4bb-d321-11e1-96d3-dabd32358ef7}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{dfcd9688-e889-11e1-9e71-df2293e3652a}\Shell - "" = AutoRun
O33 - MountPoints2\{dfcd9688-e889-11e1-9e71-df2293e3652a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.13 16:24:48 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\eva\Desktop\OTL.exe
[2013.01.13 15:55:43 | 000,000,000 | ---D | C] -- C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ClearProg
[2013.01.13 15:55:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClearProg
[2013.01.13 15:55:43 | 000,000,000 | ---D | C] -- C:\Program Files\ClearProg
[2013.01.13 14:13:46 | 000,021,256 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013.01.13 14:13:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.01.13 14:13:45 | 000,361,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013.01.13 14:13:43 | 000,035,928 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2013.01.13 14:13:42 | 000,054,232 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013.01.13 14:13:41 | 000,738,504 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013.01.13 14:13:40 | 000,058,680 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013.01.13 14:12:51 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2013.01.13 14:12:51 | 000,041,224 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.01.13 14:12:20 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.01.13 14:12:20 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.01.13 02:59:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.01.13 02:59:12 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.01.13 02:59:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.01.12 20:25:09 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2013.01.12 20:11:32 | 000,202,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2013.01.12 20:11:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2013.01.12 20:09:13 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2013.01.12 20:09:12 | 000,000,000 | ---D | C] -- C:\Users\eva\AppData\Roaming\TestApp
[2013.01.12 19:19:56 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2013.01.12 19:18:47 | 000,000,000 | ---D | C] -- C:\Program Files\stinger
[2013.01.12 18:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.01.12 15:07:17 | 000,000,000 | ---D | C] -- C:\Users\eva\AppData\Roaming\Malwarebytes
[2013.01.12 15:07:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.01.02 17:20:27 | 000,000,000 | ---D | C] -- C:\Users\eva\AppData\Local\Dictionnaire Freelang
[2013.01.02 17:20:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dictionnaire Freelang
[2012.12.25 18:20:03 | 000,000,000 | ---D | C] -- C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.12.16 21:18:04 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Geographie
[2012.12.16 21:17:38 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Textgenese
[2012.12.16 21:17:04 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Zusammenarbeit
[2012.12.16 21:15:36 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Mehrsprachige Editionen
[2012.12.16 21:15:12 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\das liebe geld
[2012.12.16 21:14:20 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Peritexte
[2012.12.16 21:13:37 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Trilinguale Selbstübersetzer
[2012.12.16 21:13:00 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\einzelne Selbstübersetzer
[2012.12.16 21:09:54 | 000,000,000 | ---D | C] -- C:\Users\eva\Documents\Udine Artikel und Vortrag
[3 C:\Users\eva\Documents\*.tmp files -> C:\Users\eva\Documents\*.tmp -> ]
[1 C:\Users\eva\Desktop\*.tmp files -> C:\Users\eva\Desktop\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.13 16:19:14 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.13 16:19:14 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.13 16:16:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\eva\Desktop\OTL.exe
[2013.01.13 16:13:11 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3866032820-2864927761-1577058539-1000UA.job
[2013.01.13 15:59:20 | 000,640,596 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.13 15:59:20 | 000,609,730 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.13 15:59:20 | 000,116,328 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.13 15:59:20 | 000,103,512 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.13 15:55:43 | 000,000,822 | ---- | M] () -- C:\Users\eva\Desktop\ClearProg.lnk
[2013.01.13 15:55:18 | 000,000,414 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EDBA1CA9-A8C2-4B14-A2FA-834B3E666C26}.job
[2013.01.13 15:35:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.13 15:23:14 | 000,846,106 | ---- | M] () -- C:\Users\eva\Desktop\Setup_ClearProg_1.6.0_Final_neu.exe
[2013.01.13 14:13:47 | 000,001,356 | ---- | M] () -- C:\Users\eva\AppData\Local\d3d9caps.dat
[2013.01.13 14:13:46 | 000,001,835 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.01.13 14:13:40 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013.01.13 13:56:08 | 097,495,576 | ---- | M] () -- C:\Users\eva\Desktop\avast_free_antivirus1474_setup.exe
[2013.01.13 12:20:36 | 000,883,840 | ---- | M] () -- C:\Users\eva\Desktop\Avira-DE-Cleaner.exe
[2013.01.13 12:19:14 | 000,000,302 | ---- | M] () -- C:\Windows\tasks\ILOOMYGHBP.job
[2013.01.13 12:19:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.13 12:19:04 | 1877,458,944 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.13 02:59:14 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.12 21:31:37 | 000,270,736 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.12 20:12:26 | 001,211,615 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2013.01.12 20:09:14 | 000,001,390 | ---- | M] () -- C:\Users\eva\Desktop\sd9setup.exe.lnk
[2013.01.12 19:19:56 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2013.01.12 19:13:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3866032820-2864927761-1577058539-1000Core.job
[2013.01.12 02:28:07 | 000,113,377 | ---- | M] () -- C:\Users\eva\Documents\Gram_GL2_U1.pdf
[2013.01.12 02:27:15 | 000,193,319 | ---- | M] () -- C:\Users\eva\Documents\GL2_Gram_Past_prog_NEW.pdf
[2013.01.12 02:26:52 | 000,392,492 | ---- | M] () -- C:\Users\eva\Documents\GL2_U3_Puzzle.pdf
[2013.01.12 02:26:14 | 000,515,158 | ---- | M] () -- C:\Users\eva\Documents\GL2_U4_Puzzle.483129.pdf
[2013.01.12 02:25:41 | 000,256,084 | ---- | M] () -- C:\Users\eva\Documents\GL2_U4_Gram_Pres_perfect.pdf
[2013.01.12 02:24:07 | 000,127,677 | ---- | M] () -- C:\Users\eva\Documents\past oder perfect.pdf
[2013.01.12 02:21:21 | 000,101,715 | ---- | M] () -- C:\Users\eva\Documents\simple past.pdf
[2013.01.12 02:20:49 | 000,875,630 | ---- | M] () -- C:\Users\eva\Documents\6a - Solution 03.pdf
[2013.01.12 02:12:13 | 000,131,072 | RHS- | M] () -- C:\Windows\System32\getmac7.dll
[2013.01.11 21:27:58 | 000,327,116 | ---- | M] () -- C:\Users\eva\Desktop\_Sara mamacha, papa mamacha- representaciones alimenticias en la poesía quechua_.pdf
[2013.01.11 19:05:14 | 015,351,448 | ---- | M] () -- C:\Users\eva\Desktop\1301_epaper_januar_biograph.pdf
[2013.01.07 16:35:54 | 002,015,876 | ---- | M] () -- C:\Users\eva\Desktop\controleidentitejournal.pdf
[2013.01.06 00:50:47 | 000,465,003 | ---- | M] () -- C:\Users\eva\Desktop\Alexakis 2012 entretien process d ecriture.pdf
[2013.01.03 22:15:36 | 003,109,848 | ---- | M] () -- C:\Users\eva\Desktop\lourdes in the contactzone.pdf
[2013.01.03 22:11:26 | 000,630,616 | ---- | M] () -- C:\Users\eva\Desktop\william_mackey_literary_diglossia.pdf
[2012.12.31 13:05:25 | 001,024,857 | ---- | M] () -- C:\Users\eva\Desktop\Bibliography self-translation (10 - 01.01.13).pdf
[2012.12.29 13:11:18 | 000,000,993 | ---- | M] () -- C:\Users\eva\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.12.27 17:56:48 | 000,219,160 | ---- | M] () -- C:\Users\eva\Desktop\triling_postface_fr.pdf
[2012.12.25 18:20:05 | 000,002,068 | ---- | M] () -- C:\Users\eva\Desktop\Google Chrome.lnk
[2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[3 C:\Users\eva\Documents\*.tmp files -> C:\Users\eva\Documents\*.tmp -> ]
[1 C:\Users\eva\Desktop\*.tmp files -> C:\Users\eva\Desktop\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.13 15:55:43 | 000,000,822 | ---- | C] () -- C:\Users\eva\Desktop\ClearProg.lnk
[2013.01.13 15:55:13 | 000,846,106 | ---- | C] () -- C:\Users\eva\Desktop\Setup_ClearProg_1.6.0_Final_neu.exe
[2013.01.13 14:13:46 | 000,001,835 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.01.13 14:10:54 | 097,495,576 | ---- | C] () -- C:\Users\eva\Desktop\avast_free_antivirus1474_setup.exe
[2013.01.13 12:35:58 | 000,883,840 | ---- | C] () -- C:\Users\eva\Desktop\Avira-DE-Cleaner.exe
[2013.01.13 02:59:14 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.12 21:31:02 | 1877,458,944 | -HS- | C] () -- C:\hiberfil.sys
[2013.01.12 20:11:40 | 001,211,615 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2013.01.12 20:09:14 | 000,001,390 | ---- | C] () -- C:\Users\eva\Desktop\sd9setup.exe.lnk
[2013.01.12 02:28:06 | 000,113,377 | ---- | C] () -- C:\Users\eva\Documents\Gram_GL2_U1.pdf
[2013.01.12 02:27:14 | 000,193,319 | ---- | C] () -- C:\Users\eva\Documents\GL2_Gram_Past_prog_NEW.pdf
[2013.01.12 02:26:51 | 000,392,492 | ---- | C] () -- C:\Users\eva\Documents\GL2_U3_Puzzle.pdf
[2013.01.12 02:26:13 | 000,515,158 | ---- | C] () -- C:\Users\eva\Documents\GL2_U4_Puzzle.483129.pdf
[2013.01.12 02:25:41 | 000,256,084 | ---- | C] () -- C:\Users\eva\Documents\GL2_U4_Gram_Pres_perfect.pdf
[2013.01.12 02:24:07 | 000,127,677 | ---- | C] () -- C:\Users\eva\Documents\past oder perfect.pdf
[2013.01.12 02:21:20 | 000,101,715 | ---- | C] () -- C:\Users\eva\Documents\simple past.pdf
[2013.01.12 02:20:48 | 000,875,630 | ---- | C] () -- C:\Users\eva\Documents\6a - Solution 03.pdf
[2013.01.12 02:12:14 | 000,000,302 | ---- | C] () -- C:\Windows\tasks\ILOOMYGHBP.job
[2013.01.12 02:12:13 | 000,131,072 | RHS- | C] () -- C:\Windows\System32\getmac7.dll
[2013.01.11 21:27:57 | 000,327,116 | ---- | C] () -- C:\Users\eva\Desktop\_Sara mamacha, papa mamacha- representaciones alimenticias en la poesía quechua_.pdf
[2013.01.11 19:05:04 | 015,351,448 | ---- | C] () -- C:\Users\eva\Desktop\1301_epaper_januar_biograph.pdf
[2013.01.07 16:35:52 | 002,015,876 | ---- | C] () -- C:\Users\eva\Desktop\controleidentitejournal.pdf
[2013.01.06 00:50:44 | 000,465,003 | ---- | C] () -- C:\Users\eva\Desktop\Alexakis 2012 entretien process d ecriture.pdf
[2013.01.03 22:15:36 | 003,109,848 | ---- | C] () -- C:\Users\eva\Desktop\lourdes in the contactzone.pdf
[2013.01.03 22:11:26 | 000,630,616 | ---- | C] () -- C:\Users\eva\Desktop\william_mackey_literary_diglossia.pdf
[2013.01.03 09:21:29 | 000,001,356 | ---- | C] () -- C:\Users\eva\AppData\Local\d3d9caps.dat
[2012.12.31 13:05:12 | 001,024,857 | ---- | C] () -- C:\Users\eva\Desktop\Bibliography self-translation (10 - 01.01.13).pdf
[2012.12.25 18:20:05 | 000,002,068 | ---- | C] () -- C:\Users\eva\Desktop\Google Chrome.lnk
[2012.12.25 18:01:35 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3866032820-2864927761-1577058539-1000UA.job
[2012.12.25 18:01:33 | 000,001,060 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3866032820-2864927761-1577058539-1000Core.job
[2012.12.16 01:57:48 | 000,219,160 | ---- | C] () -- C:\Users\eva\Desktop\triling_postface_fr.pdf
[2012.05.07 22:17:58 | 000,202,638 | ---- | C] () -- C:\Users\eva\AppData\Local\census.cache
[2012.05.07 22:17:37 | 000,157,988 | ---- | C] () -- C:\Users\eva\AppData\Local\ars.cache
[2012.05.07 22:08:28 | 000,000,036 | ---- | C] () -- C:\Users\eva\AppData\Local\housecall.guid.cache
[2011.10.22 11:31:14 | 000,073,216 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011.02.22 20:17:04 | 000,000,552 | ---- | C] () -- C:\Users\eva\AppData\Local\d3d8caps.dat
[2010.09.05 19:02:46 | 000,011,776 | ---- | C] () -- C:\Users\eva\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.09.09 10:14:18 | 011,315,712 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.09.08 15:54:44 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2006.11.02 10:46:13 | 000,348,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.01.13 12:37:45 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\Dropbox
[2012.10.06 22:39:16 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\Juniper Networks
[2012.12.25 17:55:41 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\QuickScan
[2012.12.24 13:59:51 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\Spotify
[2011.10.22 11:26:13 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\Stereoscopic Player
[2012.09.13 10:59:52 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\Swiss Academic Software
[2012.07.19 19:58:40 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\T-Mobile
[2012.07.19 20:18:55 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\T-Mobile Internet Manager
[2013.01.12 20:09:12 | 000,000,000 | ---D | M] -- C:\Users\eva\AppData\Roaming\TestApp
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

OTL EXTRA LOG
Code:
OTL Extras logfile created on: 13.01.2013 16:25:49 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\eva\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 0,95 Gb Available Physical Memory | 54,46% Memory free
3,72 Gb Paging File | 2,88 Gb Available in Paging File | 77,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,76 Gb Total Space | 20,21 Gb Free Space | 25,66% Space Free | Partition Type: NTFS
Drive D: | 21,30 Gb Total Space | 8,69 Gb Free Space | 40,80% Space Free | Partition Type: NTFS
Drive G: | 982,72 Mb Total Space | 260,81 Mb Free Space | 26,54% Space Free | Partition Type: FAT
 
Computer Name: EVA-PC | User Name: eva | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02D19E2C-AB73-47A4-943A-FE37F51616F2}" = rport=138 | protocol=17 | dir=out | app=system |
"{153BC705-BF52-4A12-AD73-925FCD50AEE3}" = lport=138 | protocol=17 | dir=in | app=system |
"{305076F3-DB39-4A10-9650-7A865DC65E7A}" = lport=445 | protocol=6 | dir=in | app=system |
"{47F676BA-1319-4171-9A0E-1C2CCD1C7FB1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{54408804-E17C-4FE8-84F9-E6E75DC04ED0}" = rport=139 | protocol=6 | dir=out | app=system |
"{56EEA50D-95A6-4E28-9C03-8556D03B577F}" = lport=137 | protocol=17 | dir=in | app=system |
"{77B1644B-5426-4D38-8EC3-FFB604A169BA}" = rport=445 | protocol=6 | dir=out | app=system |
"{80220139-4DF0-433B-BD06-AF438EC2F18E}" = lport=139 | protocol=6 | dir=in | app=system |
"{81FAD883-36E7-4A86-883D-87663D58A738}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9A9FC947-EF3A-4FE4-98F6-41546D16DAB8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C57A707E-CBAD-4557-ADD3-F444DFE39EA3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DE70E9BD-C924-481E-893B-E058EB32BBC4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DF56E268-4C93-46C1-BBFB-2A025CDC0B20}" = rport=137 | protocol=17 | dir=out | app=system |
"{EB32D0A1-7CD8-46C7-BAB1-2355E1DE3770}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3D4C09D5-FF46-4881-800B-8017200259A3}" = protocol=17 | dir=in | app=c:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe |
"{3DFAB9A0-607F-4A64-A269-435D261B3248}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{412137DF-5450-40D7-B913-E3CF6E4C197F}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{525856AF-DAB5-4295-86D9-2366B72D664F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{582BB95D-CDBF-4E12-89EA-57FB7FEAA779}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7FDD0714-B573-430D-BF62-B99FAA51F576}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{8B410B1E-CCFC-4C35-81FF-59460FEF3746}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{92D7BB5E-DBEF-4146-AB5C-CBA7B01A55E4}" = protocol=6 | dir=in | app=c:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe |
"{9CEFDC8A-C142-4455-8064-21559653C9C2}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{ABAC9BA3-A3DD-4AD5-ADDF-C11AF076E6E1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{B54DF12A-C0B4-40EA-B433-B141B69F584A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C073DE6F-8F87-47F8-B88A-A44910B507E3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DD5018E1-E8B6-4179-89E0-8A96B34E28A1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"TCP Query User{3739FC95-6343-4F35-A1A3-E677EB63FE92}C:\users\eva\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\eva\appdata\roaming\spotify\spotify.exe |
"TCP Query User{D5C21FF1-4844-485C-BDBD-D785E0E39C0D}C:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{3AD65847-B7BE-4731-82BF-05AB95F1483E}C:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\eva\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{7EFAA12C-3ECD-47AE-A98B-62FCF8C23F71}C:\users\eva\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\eva\appdata\roaming\spotify\spotify.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series" = Canon MP550 series MP Drivers
"{14B380D6-8205-4F9D-81D8-515235929F2A}_is1" = Dictionnaire Freelang (liste de mots)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{539B6D66-26B1-4FE9-A9F8-95CA9369C645}" = Dissertation-HU für Microsoft Word 2010 Deutsch
"{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{8CD2E489-03F4-4AC0-8B68-D8C7DFE731DD}" = Stereoscopic Player
"{8CE152BA-1D16-11E1-867D-984BE15F174E}" = Evernote v. 4.5.2
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"ClearProg" = ClearProg 1.6.0 Final
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"ffdshow_is1" = ffdshow v1.1.3892 [2011-06-20]
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"Juniper Network Connect 7.0.0" = Juniper Networks Network Connect 7.0.0
"Juniper Network Connect 7.1.8" = Juniper Networks Network Connect 7.1.8
"Juniper Network Connect 7.2.0" = Juniper Networks Network Connect 7.2.0
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mendeley Desktop" = Mendeley Desktop 0.9.9.2
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"T-Mobile Internet Manager" = T-Mobile Internet Manager
"VLC media player" = VLC media player 1.1.7
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Juniper_Setup_Client" = Juniper Networks, Inc. Setup Client
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 04.01.2013 08:35:28 | Computer Name = eva-PC | Source = RasClient | ID = 20227
Description =
 
Error - 04.01.2013 08:36:49 | Computer Name = eva-PC | Source = RasClient | ID = 20227
Description =
 
Error - 07.01.2013 15:02:32 | Computer Name = eva-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung plugin-container.exe, Version 10.0.2.4428, Zeitstempel
 0x4f3cdac0, fehlerhaftes Modul NPSWF32_11_5_502_135.dll_unloaded, Version 0.0.0.0,
 Zeitstempel 0x50b84b27, Ausnahmecode 0xc0000005, Fehleroffset 0x6aa6b745,  Prozess-ID
 0x1f4, Anwendungsstartzeit 01cded03f0b088a2.
 
Error - 12.01.2013 10:14:40 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 12.01.2013 11:09:46 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 12.01.2013 11:41:35 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 12.01.2013 13:59:36 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 12.01.2013 15:34:01 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 12.01.2013 16:04:27 | Computer Name = eva-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 13.01.2013 07:37:10 | Computer Name = eva-PC | Source = RasClient | ID = 20227
Description =
 
[ OSession Events ]
Error - 24.06.2012 07:38:13 | Computer Name = eva-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3979
 seconds with 600 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 13.01.2013 08:34:29 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:34:32 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:13 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:16 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:19 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:21 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:24 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:27 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:30 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 13.01.2013 08:56:33 | Computer Name = eva-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
 
< End of report >

cosinus 13.01.2013 23:02
Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner?
Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

rainy13 14.01.2013 00:41
Hallo Cosinus,

den von Malwarebytes hatte ich oben im ersten Post bereits eingefügt.
Ich hatte gehofft, dass diese Daten erstmal reichen. Mir geht es ja auch nur um eine Einschätzung zwecks Datensicherung. Ich werde die Festplatte in jedem Fall neu formatieren, daher solltet Ihr da nicht zu viel Zeit und Arbeit investieren. Es geht mir nur darum zu wissen, ob ich gefahrlos meine .doc Dateien auf einem USB Stick sichern kann, oder ob ich damit Gefahr laufe, selbigen oder/und das neue System zu infizieren.

cosinus 14.01.2013 08:50
Zitat:
den von Malwarebytes hatte ich oben im ersten Post bereits eingefügt.
Ja und? hab ich gesehen, die Frage war ja auch nach weiteren Logs und die nicht nur von Malwarebytes

Zitat:
Es geht mir nur darum zu wissen, ob ich gefahrlos meine .doc Dateien auf einem USB Stick sichern kann, oder ob ich damit Gefahr laufe, selbigen oder/und das neue System zu infizieren.
Gefahrlos ist relativ. Nur um die Daten zu sichern muss man das System nicht erst vorher analysieren.

Zum Thema Datensicherung von infizierten Systemen; mach das über ne Live-CD wie Knoppix, Ubuntu (zweiter Link in meiner Signatur) oder über PartedMagic. Grund: Bei einem Live-System sind keine Schädlinge des infizierten Windows-Systems aktiv, damit ist dann auch eine negative Beeinflussung des Backups durch Schädlinge ausgeschlossen.

Du brauchst natürlich auch ein Sicherungsmedium, am besten dürfte eine externe Platte sein. Sofern du nicht allzuviel sichern musst, kann auch ein USB-Stick ausreichen.

Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipiell so aber fast genauso mit allen anderen Live-Systemen auch.
  1. Lade Dir ISO-Image von PartedMagic
  2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
  3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist
  4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken
  5. Mounte die Partitionen wo Windows installiert ist, meistens ist das /dev/sda1 bzw. /dev/sda2 bei Win7 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du
    bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind)
  6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!
  7. Wenn fertig, starte den Rechner neu, schalte die ext. Platte ab und boote von der Windows-DVD zur Neuinstallation (Anleitung beachten)

rainy13 14.01.2013 18:41
Hallo Cosinus,
danke für die Anleitung, dann werde ich das so machen.

cosinus 14.01.2013 22:10
Gut, dann wünsche ich viel Erfolg ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:15 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19