| vollhoax | 10.04.2013 11:33 |
OTL Code:
OTL logfile created on: 10.04.2013 12:27:56 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = H:\Dokumente und Einstellungen\User\Desktop\trojaner
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,75 Gb Total Physical Memory | 3,30 Gb Available Physical Memory | 88,09% Memory free
5,59 Gb Paging File | 5,28 Gb Available in Paging File | 94,58% Paging File free
Paging file location(s): H:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = H: | %SystemRoot% = H:\WINDOWS | %ProgramFiles% = H:\Programme
Drive C: | 1,89 Gb Total Space | 1,88 Gb Free Space | 99,42% Space Free | Partition Type: FAT
Drive H: | 465,75 Gb Total Space | 403,80 Gb Free Space | 86,70% Space Free | Partition Type: NTFS
Drive I: | 24,41 Gb Total Space | 21,32 Gb Free Space | 87,32% Space Free | Partition Type: NTFS
Drive J: | 75,81 Gb Total Space | 44,08 Gb Free Space | 58,15% Space Free | Partition Type: NTFS
Drive K: | 48,83 Gb Total Space | 1,07 Gb Free Space | 2,18% Space Free | Partition Type: NTFS
Computer Name: SYSTEM-A9968172 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - H:\Dokumente und Einstellungen\User\Desktop\trojaner\OTL.exe (OldTimer Tools)
PRC - h:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - H:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - H:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - H:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - H:\Programme\Canon\IJPLM\ijplmsvc.exe ()
PRC - H:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - H:\Programme\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - H:\Programme\Ralink\Common\RaRegistry.exe (Ralink Technology, Corp.)
PRC - H:\WINDOWS\UnsignedThemesSvc.exe (The Within Network, LLC)
PRC - H:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - H:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
========== Modules (No Company Name) ==========
MOD - H:\WINDOWS\system32\mpg2splt.ax ()
MOD - H:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll ()
MOD - H:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll ()
MOD - H:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - H:\Programme\Canon\IJPLM\ijplmsvc.exe ()
MOD - H:\Programme\Ralink\Common\RaWLAPI.dll ()
MOD - H:\WINDOWS\system32\DiagFunc.dll ()
MOD - H:\WINDOWS\system32\msdmo.dll ()
MOD - H:\WINDOWS\system32\wnicapi.dll ()
MOD - H:\WINDOWS\system32\WlanApp.dll ()
========== Services (SafeList) ==========
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- H:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MsMpSvc) -- h:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) -- H:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (MBAMService) -- H:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- H:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Adobe LM Service) -- H:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (IJPLMSVC) -- H:\Programme\Canon\IJPLM\ijplmsvc.exe ()
SRV - (RalinkRegistryWriter) -- H:\Programme\Ralink\Common\RaRegistry.exe (Ralink Technology, Corp.)
SRV - (UnsignedThemes) -- H:\WINDOWS\UnsignedThemesSvc.exe (The Within Network, LLC)
SRV - (ANIWZCSdService) -- H:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe (Wireless Service)
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (StarOpen) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (catchme) -- H:\DOKUME~1\User\LOKALE~1\Temp\catchme.sys File not found
DRV - (Cardex) -- H:\WINDOWS\system32\drivers\TBPANEL.SYS File not found
DRV - (AsrCDDrv) -- H:\WINDOWS\system32\Drivers\AsrCDDrv.sys File not found
DRV - (MBAMProtector) -- H:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NVHDA) -- H:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (VIAHdAudAddService) -- H:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (rt2870) -- H:\WINDOWS\system32\drivers\rt2870.sys (Ralink Technology, Corp.)
DRV - (uxpatch) -- H:\WINDOWS\system32\drivers\uxpatch.sys ()
DRV - (AMBFilt) -- H:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Scutum50) -- H:\WINDOWS\system32\drivers\Scutum50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MonFilt) -- H:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (nvgts) -- H:\WINDOWS\system32\drivers\nvgts.sys (NVIDIA Corporation)
DRV - (nvnetbus) -- H:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- H:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (RT61) -- H:\WINDOWS\system32\drivers\rt61.sys (Ralink Technology Inc.)
DRV - (ANIO) -- H:\WINDOWS\system32\ANIO.sys (Alpha Networks Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?PC=BNHP
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\..\URLSearchHook: - No CLSID value found
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\..\SearchScopes\{353BD8EC-4794-4411-AB67-CFA6540ADE5E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=F15CC0F6-6429-4A1A-BE8B-0B6157FF5A30&apn_sauid=7F7AF933-092A-47E6-A3D9-C608D7217753
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_deDE426
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - prefs.js..browser.startup.homepage: "hxxp://www.windowsxlive.net"
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: H:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: H:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: H:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: H:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: H:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: h:\Programme\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: h:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: H:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: H:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: H:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
[2012.10.13 12:52:24 | 000,000,000 | ---D | M] (No name found) -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Extensions
[2013.03.30 11:57:54 | 000,000,000 | ---D | M] (No name found) -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\lddarju1.default-1361461956816\Extensions
========== Chrome ==========
CHR - homepage: hxxp://www.windowsxlive.net/
CHR - Extension: No name found = H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: No name found = H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: No name found = H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013.04.09 09:33:07 | 000,000,027 | ---- | M]) - H:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] H:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ANIWZCS2Service] H:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [APSDaemon] H:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] H:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [IJNetworkScanUtility] H:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [MSC] h:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] H:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] H:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] H:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] H:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Ralink Wireless Utility.lnk = H:\Programme\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2000478354-1715567821-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download by Orbit - res://J:\Programme\Orbitdownloader\orbitmxt.dll/201 File not found
O8 - Extra context menu item: &Grab video by Orbit - res://J:\Programme\Orbitdownloader\orbitmxt.dll/204 File not found
O8 - Extra context menu item: Do&wnload selected by Orbit - res://J:\Programme\Orbitdownloader\orbitmxt.dll/203 File not found
O8 - Extra context menu item: Down&load all by Orbit - res://J:\Programme\Orbitdownloader\orbitmxt.dll/202 File not found
O8 - Extra context menu item: Google Sidewiki... - res://H:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - H:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1364836253000 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7052E820-8F28-4CB7-8343-99D9BA7C1CC3}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - H:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (H:\WINDOWS\system32\userinit.exe) - H:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.21 20:45:50 | 000,000,000 | ---- | M] () - I:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.04.10 11:34:09 | 000,000,000 | ---D | C] -- H:\WINDOWS\ERUNT
[2013.04.10 11:33:47 | 000,000,000 | ---D | C] -- H:\JRT
[2013.04.10 11:33:30 | 000,551,587 | ---- | C] (Oleg N. Scherbakov) -- H:\Dokumente und Einstellungen\User\Desktop\JRT.exe
[2013.04.09 16:32:14 | 000,000,000 | ---D | C] -- H:\Programme\Microsoft Security Client
[2013.04.09 16:31:57 | 000,000,000 | -HSD | C] -- H:\RECYCLER
[2013.04.09 16:31:43 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\User\Desktop\Microsoft_Security_Essentials_4.2.233
[2013.04.09 15:54:14 | 000,000,000 | --SD | C] -- H:\ComboFix
[2013.04.09 15:47:32 | 005,049,517 | R--- | C] (Swearware) -- H:\Dokumente und Einstellungen\User\Desktop\ComboFix.exe
[2013.04.09 09:25:49 | 000,000,000 | RHSD | C] -- H:\cmdcons
[2013.04.09 09:22:43 | 000,518,144 | ---- | C] (SteelWerX) -- H:\WINDOWS\SWREG.exe
[2013.04.09 09:22:43 | 000,406,528 | ---- | C] (SteelWerX) -- H:\WINDOWS\SWSC.exe
[2013.04.09 09:22:43 | 000,212,480 | ---- | C] (SteelWerX) -- H:\WINDOWS\SWXCACLS.exe
[2013.04.09 09:22:43 | 000,060,416 | ---- | C] (NirSoft) -- H:\WINDOWS\NIRCMD.exe
[2013.04.09 09:13:56 | 000,000,000 | ---D | C] -- H:\Qoobox
[2013.04.09 09:13:47 | 000,000,000 | ---D | C] -- H:\WINDOWS\erdnt
[2013.04.06 10:05:58 | 000,018,160 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\mucltui.dll.mui
[2013.04.06 10:05:57 | 000,275,696 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\mucltui.dll
[2013.03.30 11:58:20 | 000,237,088 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\MpSigStub.exe
[2013.03.30 11:41:23 | 000,228,600 | ---- | C] (AVAST Software) -- H:\WINDOWS\System32\aswBoot.exe
[2013.03.30 11:40:53 | 000,000,000 | ---D | C] -- H:\Programme\AVAST Software
[2013.03.30 11:40:28 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software
[2013.03.30 10:59:28 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DoNotTrackPlus
[2013.03.30 10:54:21 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2013.03.29 13:13:02 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Styler
[2013.03.29 12:57:10 | 000,000,000 | ---D | C] -- H:\WINDOWS\UXBackup
[2013.03.29 12:56:31 | 000,076,288 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\taskkill.exe
[2013.03.29 12:56:31 | 000,000,000 | ---D | C] -- H:\Programme\UX Pack
[2013.03.29 12:55:14 | 000,000,000 | ---D | C] -- H:\Programme\Styler
[2013.03.29 12:44:29 | 000,000,000 | ---D | C] -- H:\design
[2013.03.29 12:27:29 | 000,000,000 | RH-D | C] -- H:\Dokumente und Einstellungen\User\Recent
[2013.03.25 20:55:57 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\User\Desktop\trojaner
[2013.03.25 20:03:53 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2013.03.25 20:03:51 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- H:\WINDOWS\System32\drivers\mbam.sys
[2013.03.25 20:03:51 | 000,000,000 | ---D | C] -- H:\Programme\Malwarebytes' Anti-Malware
[2013.03.23 13:10:48 | 000,000,000 | ---D | C] -- H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\libimobiledevice
[2013.03.16 13:28:20 | 000,012,928 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\dllcache\usb8023x.sys
[2013.03.16 13:28:20 | 000,012,928 | ---- | C] (Microsoft Corporation) -- H:\WINDOWS\System32\dllcache\usb8023.sys
[2013.03.12 19:27:50 | 000,000,000 | -HSD | C] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\KB980218
[2011.10.30 19:05:41 | 024,526,992 | ---- | C] (Any-Video-Converter.com ) -- H:\Programme\avc-free.exe
[2011.06.29 12:24:45 | 003,987,480 | ---- | C] (Nike) -- H:\Programme\Nike+Connect_Installer.exe
[4 H:\WINDOWS\*.tmp files -> H:\WINDOWS\*.tmp -> ]
[1 H:\WINDOWS\System32\*.tmp files -> H:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.04.10 12:04:00 | 000,000,884 | ---- | M] () -- H:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.04.10 12:00:27 | 000,020,078 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Eigene Dateien\txt.odt
[2013.04.10 11:59:56 | 000,003,284 | ---- | M] () -- H:\WINDOWS\System32\ANIWZCS{7052E820-8F28-4CB7-8343-99D9BA7C1CC3}
[2013.04.10 11:54:07 | 000,000,386 | -H-- | M] () -- H:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013.04.10 11:54:02 | 000,000,358 | -H-- | M] () -- H:\WINDOWS\tasks\MpIdleTask.job
[2013.04.10 11:45:00 | 000,001,086 | ---- | M] () -- H:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.04.10 11:45:00 | 000,001,082 | ---- | M] () -- H:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.04.10 11:44:23 | 000,000,005 | ---- | M] () -- H:\WINDOWS\System32\ANIWZCSUSERNAME{7052E820-8F28-4CB7-8343-99D9BA7C1CC3}
[2013.04.10 11:44:12 | 000,000,007 | ---- | M] () -- H:\WINDOWS\System32\ANIWZCSUSERNAME
[2013.04.10 11:44:00 | 000,002,048 | --S- | M] () -- H:\WINDOWS\bootstat.dat
[2013.04.10 11:33:47 | 000,551,587 | ---- | M] (Oleg N. Scherbakov) -- H:\Dokumente und Einstellungen\User\Desktop\JRT.exe
[2013.04.10 08:17:22 | 000,000,416 | -H-- | M] () -- H:\WINDOWS\tasks\User_Feed_Synchronization-{1BF20002-2818-453C-AD8F-83F0ECF46897}.job
[2013.04.09 16:32:28 | 000,001,912 | ---- | M] () -- H:\WINDOWS\epplauncher.mif
[2013.04.09 16:32:11 | 000,013,646 | ---- | M] () -- H:\WINDOWS\System32\wpa.dbl
[2013.04.09 15:47:32 | 005,049,517 | R--- | M] (Swearware) -- H:\Dokumente und Einstellungen\User\Desktop\ComboFix.exe
[2013.04.09 09:33:07 | 000,000,027 | ---- | M] () -- H:\WINDOWS\System32\drivers\etc\hosts
[2013.04.09 09:25:52 | 000,000,327 | RHS- | M] () -- H:\boot.ini
[2013.04.06 13:39:35 | 000,001,508 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Desktop\Zeichentabelle.lnk
[2013.04.02 12:33:22 | 000,237,088 | ---- | M] (Microsoft Corporation) -- H:\WINDOWS\System32\MpSigStub.exe
[2013.04.01 19:09:41 | 000,492,384 | ---- | M] () -- H:\WINDOWS\System32\perfh007.dat
[2013.04.01 19:09:41 | 000,472,948 | ---- | M] () -- H:\WINDOWS\System32\perfh009.dat
[2013.04.01 19:09:41 | 000,091,030 | ---- | M] () -- H:\WINDOWS\System32\perfc007.dat
[2013.04.01 19:09:41 | 000,076,042 | ---- | M] () -- H:\WINDOWS\System32\perfc009.dat
[2013.03.30 11:41:24 | 000,002,951 | ---- | M] () -- H:\WINDOWS\System32\CONFIG.NT
[2013.03.29 13:11:58 | 000,173,872 | ---- | M] () -- H:\WINDOWS\System32\FNTCACHE.DAT
[2013.03.28 10:39:35 | 000,905,743 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Desktop\sowi keynes neo1.pdf
[2013.03.28 10:39:29 | 001,029,554 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Desktop\sowi keynes neo.pdf
[2013.03.25 20:57:40 | 000,000,084 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\mbam.context.scan
[2013.03.25 20:56:39 | 000,039,424 | ---- | M] () -- H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.03.16 12:04:38 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- H:\WINDOWS\System32\FlashPlayerApp.exe
[2013.03.16 12:04:38 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- H:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[4 H:\WINDOWS\*.tmp files -> H:\WINDOWS\*.tmp -> ]
[1 H:\WINDOWS\System32\*.tmp files -> H:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.04.10 12:00:27 | 000,020,078 | ---- | C] () -- H:\Dokumente und Einstellungen\User\Eigene Dateien\txt.odt
[2013.04.09 16:42:24 | 000,000,386 | -H-- | C] () -- H:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013.04.09 16:42:24 | 000,000,358 | -H-- | C] () -- H:\WINDOWS\tasks\MpIdleTask.job
[2013.04.09 16:32:25 | 000,001,683 | ---- | C] () -- H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Security Essentials.lnk
[2013.04.09 09:25:52 | 000,000,210 | ---- | C] () -- H:\Boot.bak
[2013.04.09 09:25:49 | 000,262,448 | RHS- | C] () -- H:\cmldr
[2013.04.09 09:22:43 | 000,256,000 | ---- | C] () -- H:\WINDOWS\PEV.exe
[2013.04.09 09:22:43 | 000,208,896 | ---- | C] () -- H:\WINDOWS\MBR.exe
[2013.04.09 09:22:43 | 000,098,816 | ---- | C] () -- H:\WINDOWS\sed.exe
[2013.04.09 09:22:43 | 000,080,412 | ---- | C] () -- H:\WINDOWS\grep.exe
[2013.04.09 09:22:43 | 000,068,096 | ---- | C] () -- H:\WINDOWS\zip.exe
[2013.03.30 11:46:29 | 000,001,912 | ---- | C] () -- H:\WINDOWS\epplauncher.mif
[2013.03.29 12:56:31 | 000,069,632 | ---- | C] () -- H:\WINDOWS\System32\moveex.exe
[2013.03.28 10:39:34 | 000,905,743 | ---- | C] () -- H:\Dokumente und Einstellungen\User\Desktop\sowi keynes neo1.pdf
[2013.03.28 10:39:28 | 001,029,554 | ---- | C] () -- H:\Dokumente und Einstellungen\User\Desktop\sowi keynes neo.pdf
[2013.03.25 20:57:40 | 000,000,084 | ---- | C] () -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\mbam.context.scan
[2012.04.04 13:09:51 | 080,783,696 | ---- | C] () -- H:\Programme\Audials_One-Setup.exe
[2012.01.11 21:12:45 | 000,000,127 | ---- | C] () -- H:\WINDOWS\System32\MRT.INI
[2011.12.30 18:49:13 | 000,162,304 | ---- | C] () -- H:\WINDOWS\System32\ztvunrar36.dll
[2011.12.30 18:49:13 | 000,077,312 | ---- | C] () -- H:\WINDOWS\System32\ztvunace26.dll
[2011.10.30 18:31:50 | 000,006,642 | ---- | C] () -- H:\WINDOWS\mgxoschk.ini
[2011.10.15 18:24:30 | 000,027,968 | -H-- | C] () -- H:\WINDOWS\System32\mlfcache.dat
[2011.04.16 12:17:53 | 000,000,953 | ---- | C] () -- H:\Dokumente und Einstellungen\User\.recently-used.xbel
[2011.04.09 13:04:51 | 000,039,424 | ---- | C] () -- H:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.02.06 17:29:13 | 000,000,652 | ---- | C] () -- H:\Programme\Orbit.lnk
========== ZeroAccess Check ==========
[2011.04.16 19:57:46 | 000,000,227 | RHS- | M] () -- H:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010.04.16 18:06:44 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2013.02.22 12:59:56 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013.03.30 11:47:05 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software
[2012.03.20 23:00:49 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2011.04.27 11:11:31 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canon IJ Network Tool
[2011.04.27 11:05:28 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011.04.27 11:12:45 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonEPP
[2012.12.29 13:18:40 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ
[2011.11.23 18:10:00 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2011.04.27 11:12:45 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX2
[2011.04.27 11:10:19 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMSetup
[2011.04.27 11:12:37 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMyPrinter
[2013.04.10 12:12:18 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJPLM
[2012.12.29 13:13:06 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2011.04.27 11:12:45 | 000,000,000 | -H-D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJSolutionMenuEX
[2011.04.27 11:09:31 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJWSpt
[2011.08.15 10:29:03 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2013.03.25 20:19:01 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.10.30 18:37:08 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2011.04.09 18:34:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ralink Driver
[2012.04.04 13:10:21 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RapidSolution
[2011.10.15 17:19:18 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012.03.05 20:49:45 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\Gast\Anwendungsdaten\Orbit
[2012.02.14 19:28:35 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\Gast\Anwendungsdaten\ProgSense
[2011.10.30 19:06:53 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\AnvSoft
[2012.06.11 15:50:31 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Bikil
[2012.03.20 23:00:49 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Canneverbe Limited
[2012.12.29 13:13:06 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Canon
[2012.06.06 11:04:29 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Cefoat
[2012.12.21 16:54:53 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.08.15 10:47:33 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoft
[2011.10.16 11:25:36 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Easy MP3 Recorder
[2011.04.16 12:17:53 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\gtk-2.0
[2012.04.29 13:22:53 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Huhu
[2011.06.19 19:41:54 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\ICQ
[2012.06.09 11:47:40 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Ilpu
[2012.06.09 11:40:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Inhoac
[2012.06.11 15:50:31 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Iqyp
[2012.03.20 23:08:12 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\K-PACS-Lite
[2012.04.04 14:34:03 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\KastorFreeVimeoDownloader
[2013.03.12 19:34:54 | 000,000,000 | -HSD | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\KB980218
[2011.06.21 18:00:59 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Leadertech
[2012.07.08 22:19:49 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Nouc
[2013.03.11 13:17:19 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Ofirs
[2011.04.08 11:05:29 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\OpenOffice.org
[2013.03.05 18:41:28 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Orbit
[2012.06.02 15:12:33 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Paiv
[2012.10.20 18:40:46 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\PhotoScape
[2011.04.09 12:36:14 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\ProgSense
[2013.01.12 16:18:15 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Qaviic
[2012.06.11 15:50:31 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Rawa
[2012.04.29 13:23:48 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Roza
[2011.10.16 11:31:10 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Simfy
[2013.03.30 19:23:53 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify
[2013.03.29 13:13:02 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Styler
[2012.06.11 15:50:30 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Viakly
[2013.03.23 12:36:09 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Vuyrv
[2012.06.04 07:50:57 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Wahe
[2012.06.04 22:19:43 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Yksax
[2012.06.10 20:32:27 | 000,000,000 | ---D | M] -- H:\Dokumente und Einstellungen\User\Anwendungsdaten\Zeux
========== Purity Check ==========
< End of report >
Extra Code:
OTL Extras logfile created on: 10.04.2013 12:27:56 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = H:\Dokumente und Einstellungen\User\Desktop\trojaner
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,75 Gb Total Physical Memory | 3,30 Gb Available Physical Memory | 88,09% Memory free
5,59 Gb Paging File | 5,28 Gb Available in Paging File | 94,58% Paging File free
Paging file location(s): H:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = H: | %SystemRoot% = H:\WINDOWS | %ProgramFiles% = H:\Programme
Drive C: | 1,89 Gb Total Space | 1,88 Gb Free Space | 99,42% Space Free | Partition Type: FAT
Drive H: | 465,75 Gb Total Space | 403,80 Gb Free Space | 86,70% Space Free | Partition Type: NTFS
Drive I: | 24,41 Gb Total Space | 21,32 Gb Free Space | 87,32% Space Free | Partition Type: NTFS
Drive J: | 75,81 Gb Total Space | 44,08 Gb Free Space | 58,15% Space Free | Partition Type: NTFS
Drive K: | 48,83 Gb Total Space | 1,07 Gb Free Space | 2,18% Space Free | Partition Type: NTFS
Computer Name: SYSTEM-A9968172 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "H:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "H:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"12972:TCP" = 12972:TCP:LocalSubNet:Enabled:audials localhttpserver 12972
"14714:TCP" = 14714:TCP:LocalSubNet:Enabled:audials localhttpserver 14714
"31931:TCP" = 31931:TCP:LocalSubNet:Enabled:audials localhttpserver 31931
"7485:TCP" = 7485:TCP:*:Enabled:Remote Assistance Local
"6003:TCP" = 6003:TCP:*:Enabled:Remote Assistance Remote
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"H:\Programme\Bonjour\mDNSResponder.exe" = H:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Dienst "Bonjour" -- (Apple Inc.)
"H:\Programme\Orbitdownloader\orbitnet.exe" = H:\Programme\Orbitdownloader\orbitnet.exe:*:Enabled:P2P service of Orbit Downloader -- (Orbitdownloader.com)
"H:\Programme\RapidSolution\Audials 9\Audials.exe" = H:\Programme\RapidSolution\Audials 9\Audials.exe:LocalSubNet:Enabled:Audials local subnet -- (RapidSolution Software AG)
"%windir%\explorer.exe" = %windir%\explorer.exe -- (Microsoft Corporation)
"H:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify\spotify.exe" = H:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify\spotify.exe:*:Enabled:Spotify -- (Spotify Ltd)
"H:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = H:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"H:\Programme\iTunes\iTunes.exe" = H:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D3CECCA-A589-ECCA-EC0B-2F98F2789F60}" = simfy
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{236BB7C4-4419-42FD-0407-2E257A25E34D}" = Adobe Photoshop CS2
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 24
"{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}" = Ralink Wireless LAN
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{390DD8BB-BB57-4942-A029-2D913E4E9D74}" = Microsoft Security Client
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72EBA4A9-25D7-4F86-AB6D-0848C74CC3F8}" = Conceptronic 54Mbps Wireless Utility
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E363055-15E5-4D8A-9C69-A0A9DE9A3337}" = UxStyle Core Beta
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 263.14
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 263.14
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.36
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.1.12.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C8773FDB-D0DB-BE52-D536-F48F9886B57B}" = Adobe Download Assistant
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DA078193-6951-49D6-9702-0E92B569E182}" = Audials
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-2E257A25E34D}" = Adobe Photoshop CS2
"Age of Empires 2.0" = Microsoft Age of Empires II
"Any Video Converter_is1" = Any Video Converter 3.3.0
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon MG5200 series Benutzerregistrierung" = Canon MG5200 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 4.0.3.804
"ie8" = Windows Internet Explorer 8
"Image Analyzer" = Image Analyzer
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{72EBA4A9-25D7-4F86-AB6D-0848C74CC3F8}" = Conceptronic 54Mbps Wireless Utility
"Kastor Free Vimeo Downloader_is1" = Kastor Free Vimeo Downloader V 1.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PhotoScape" = PhotoScape
"Simfy" = simfy
"TUGZip_is1" = TUGZip 3.5
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.10
"Windows XP Service Pack" = Windows XP Service Pack 3
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2000478354-1715567821-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Nike+ Connect" = Nike+ Connect
"Spotify" = Spotify
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 08.04.2013 11:26:56 | Computer Name = SYSTEM-A9968172 | Source = SecurityCenter | ID = 1802
Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der
WMI herstellen, um Antivirus- und Firewallprogramme von Drittanbietern zu überwachen.
Error - 08.04.2013 11:56:25 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.2.223.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.
Error - 09.04.2013 03:01:59 | Computer Name = SYSTEM-A9968172 | Source = SecurityCenter | ID = 1802
Description = Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der
WMI herstellen, um Antivirus- und Firewallprogramme von Drittanbietern zu überwachen.
Error - 09.04.2013 03:13:16 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.2.223.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.
Error - 09.04.2013 10:32:22 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0x80070003, P2 moac, P3 cachereset, P4 4.2.223.0,
P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.
Error - 09.04.2013 10:32:26 | Computer Name = SYSTEM-A9968172 | Source = Microsoft Security Client | ID = 5000
Description =
Error - 09.04.2013 10:34:19 | Computer Name = SYSTEM-A9968172 | Source = Microsoft Security Client | ID = 5000
Description =
Error - 09.04.2013 11:43:39 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.2.223.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.
Error - 10.04.2013 05:33:13 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.2.223.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.
Error - 10.04.2013 05:42:10 | Computer Name = SYSTEM-A9968172 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 unspecified, P2 hardeningtelemetry, P3 hardeningtelemetrydisablertp,
P4 4.2.223.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10
NIL.
[ System Events ]
Error - 08.04.2013 11:28:41 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 08.04.2013 12:04:55 | Computer Name = SYSTEM-A9968172 | Source = nvgts | ID = 262153
Description = Das Gerät \Device\Scsi\nvgts1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.
Error - 08.04.2013 12:04:55 | Computer Name = SYSTEM-A9968172 | Source = nvgts | ID = 262149
Description = Ein Paritätsfehler wurde auf \Device\Scsi\nvgts1 gefunden.
Error - 09.04.2013 03:03:44 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 09.04.2013 09:41:44 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 09.04.2013 09:41:44 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7034
Description = Dienst "ANIWZCSd Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 09.04.2013 09:56:40 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 09.04.2013 11:49:19 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 10.04.2013 02:12:53 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error - 10.04.2013 05:44:03 | Computer Name = SYSTEM-A9968172 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
< End of report >
|
Lesestoff:
GMER herunter: (Dateiname zufällig) 
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
aswMBR.exe und speichere die Datei auf deinem Desktop.
TDSSKiller.exe und speichere diese Datei auf dem Desktop
AdwCleaner auf deinen Desktop.
Textbox. 