lilithilli | 08.07.2012 09:14 | Alle 4 Minuten werden 2 Trojaner gefunden Hi,
nachdem gestern mein Virenprogramm (Avira Free Antivirus) die Meldung HTML/Malicious.PDF.Gen3 in einer Datei namens: 630ce[1].pdf und die Meldung EXP/CVE-2010-1885.AA in einer Datei namens index[1].htm gemeldet hat, hat er dann nochmal abends die Meldung SPR.NetCat.A in einer Datei namens nc.exe gemeldet. Danach war aber gestern abend Schluss. Habe danach einen Suchlauf gestartet und er hat dabei TR/ATRAPS.Gen2 gefunden. Habe diesen in Quarantäne verschieben lassen und einen erneuten Suchlauf gestartet, dabei wurde dann nichts mehr gefunden.
Als ich dann eben den PC wieder hochgefahren habe, kam kurz nach dem Hochfahren eine Meldung über zwei Trojaner: TR/ATRAPS.Gen und TR/ATRAPS.Gen2. Diese habe ich wiederum in Quarantäne verschoben.
Jetzt kommt alle 4 Minuten diesselbe Meldung über eben diese beiden Trojaner.
Was kann ich tun?
LG lili
Hi
ich habe jetzt auch mal alle Scans (bis auf Gmer, das hat nicht funktioniert) gemacht, die gefordet sind:
defogger: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:42 on 08/07/2012 (Lili)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read str.sys
-=E.O.F=-
OTL: Code:
OTL logfile created on: 08.07.2012 12:43:39 - Run 2
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Lili\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 66,81% Memory free
6,20 Gb Paging File | 5,08 Gb Available in Paging File | 81,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 224,77 Gb Total Space | 139,50 Gb Free Space | 62,06% Space Free | Partition Type: NTFS
Computer Name: LILI-PC | User Name: Lili | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.07.08 12:23:39 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Lili\Desktop\OTL.exe
PRC - [2012.07.07 19:41:37 | 000,044,544 | ---- | M] (HLBS Tech (P) Limited) -- C:\Users\Lili\AppData\Local\Temp\DATA3CE.tmp.exe
PRC - [2012.05.14 17:52:03 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.14 17:51:56 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.14 17:51:55 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.14 17:51:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 16:10:14 | 000,932,528 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.08.25 16:25:00 | 000,886,760 | ---- | M] (Search-Results) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2009.05.21 14:28:38 | 000,874,768 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe
PRC - [2009.05.21 13:04:14 | 000,473,360 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.08.28 18:10:18 | 000,233,472 | ---- | M] () -- C:\Programme\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2008.07.30 16:05:22 | 000,299,008 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\Network Utility\NSUService.exe
PRC - [2008.07.30 16:05:22 | 000,262,144 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\Network Utility\LANUtil.exe
PRC - [2008.07.07 12:28:04 | 000,182,112 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe
PRC - [2008.07.07 12:28:04 | 000,100,472 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2008.07.03 08:06:17 | 000,104,992 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RTKAUDIOSERVICE.EXE
PRC - [2008.06.19 19:53:20 | 001,771,360 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Power Management\SPMgr.exe
PRC - [2008.06.19 19:53:20 | 000,411,488 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Power Management\SPMService.exe
PRC - [2008.04.03 20:03:38 | 000,317,280 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\ISB Utility\ISBMgr.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
========== Modules (No Company Name) ==========
MOD - [2012.06.15 17:13:36 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012.06.14 21:37:05 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.14 21:36:56 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.14 13:28:36 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\75df548d77c2833a48c5da51424c93f1\System.IdentityModel.Selectors.ni.dll
MOD - [2012.05.14 13:28:35 | 001,070,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\32983e3f4c5c20053e6673f37a58a874\System.IdentityModel.ni.dll
MOD - [2012.05.14 13:28:33 | 002,346,496 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\1619144e1a9eaca847e53b952b21820b\System.Runtime.Serialization.ni.dll
MOD - [2012.05.14 13:28:30 | 000,256,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\521fb04fdfbb0039a34cc91111d11804\SMDiagnostics.ni.dll
MOD - [2012.05.14 13:28:29 | 017,404,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\1dac5ff29f483e19c77b23b00ba533f9\System.ServiceModel.ni.dll
MOD - [2012.05.14 13:27:55 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012.05.14 13:27:42 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.05.14 12:46:12 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.14 12:44:23 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.14 12:44:07 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2012.05.09 16:10:14 | 000,932,528 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.04.25 12:18:16 | 001,679,360 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3020.36966__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:16 | 000,253,952 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3020.36925__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:16 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3020.36980__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:16 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3020.37156__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:16 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3020.37121__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:16 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3020.36958__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:16 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3020.37076__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:16 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3020.36945__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:15 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3020.37184__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:14 | 000,352,256 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3020.37129__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:14 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3020.37190__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:14 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3020.37135__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:14 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3020.36939__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:14 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3020.37128__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:12 | 000,802,816 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3020.37085__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:12 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3020.37148__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:12 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3020.37084__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:10 | 000,585,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3020.36992__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,479,232 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3020.37078__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,438,272 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3020.36947__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3020.37114__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,307,200 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3020.36998__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2011.04.25 12:18:10 | 000,217,088 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3020.36985__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3020.37100__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2011.04.25 12:18:10 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3020.37077__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:10 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3020.36997__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:10 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3020.37100__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:10 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3020.37114__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:09 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3020.37084__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2011.04.25 12:18:09 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2011.04.25 12:18:09 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2939.23679__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2011.04.25 12:18:09 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2939.23767__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2011.04.25 12:18:09 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2939.23710__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2011.04.25 12:18:09 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2939.23768__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2011.04.25 12:18:09 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2011.04.25 12:18:08 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2939.23668__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2011.04.25 12:18:08 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2939.23689__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2011.04.25 12:18:08 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2939.23662__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2011.04.25 12:18:08 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2939.23802__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2011.04.25 12:18:08 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2939.23667__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2011.04.25 12:18:08 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2939.23717__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2011.04.25 12:18:08 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2939.23693__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2939.23687__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2939.23679__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2939.23707__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2939.23717__90ba9c70f846762e\DEM.OS.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2939.23718__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2939.23688__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2939.23734__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2011.04.25 12:18:08 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2939.23718__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2965.22300__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2939.23743__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2939.23740__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2939.23764__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2939.23735__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2939.23741__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2011.04.25 12:18:07 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2939.23739__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2939.23738__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2939.23742__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2939.23708__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2939.23719__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2939.23711__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2939.23665__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2011.04.25 12:18:06 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2011.04.25 12:18:06 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2939.23709__90ba9c70f846762e\APM.Foundation.dll
MOD - [2011.04.25 12:18:06 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2939.23687__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2011.04.25 12:18:05 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3020.37200__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2011.04.25 12:18:05 | 000,011,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3020.37210__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2011.04.25 12:18:05 | 000,005,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.3020.37169_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll
MOD - [2011.04.25 12:18:04 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3020.36952__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2011.04.25 12:18:04 | 000,413,696 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3020.37169__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2011.04.25 12:18:04 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3020.37176__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2011.04.25 12:18:04 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3020.36918__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2011.04.25 12:18:04 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3020.37175__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2011.04.25 12:18:04 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2939.23713__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2011.04.25 12:18:04 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2939.23678__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2011.04.25 12:18:04 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2939.23679__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2011.04.25 12:18:04 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2939.23694__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2011.04.25 12:18:04 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2939.23712__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2011.04.25 12:18:04 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2939.23677__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2011.04.25 12:18:04 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3020.36917__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2011.04.25 12:18:03 | 001,511,424 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3020.36932__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2011.04.25 12:18:03 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2939.23689__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2011.04.25 12:18:03 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3020.37176__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2011.04.25 12:18:03 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2939.23711__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2011.04.25 12:18:03 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2939.23746__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2011.04.25 12:18:02 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3020.36918__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2011.04.25 12:18:02 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3020.36916__90ba9c70f846762e\APM.Server.dll
MOD - [2011.04.25 12:18:02 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3020.36917__90ba9c70f846762e\AEM.Server.dll
MOD - [2011.04.25 12:18:02 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2009.12.09 08:54:50 | 000,495,616 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.ServiceModel.resources\3.0.0.0_de_b77a5c561934e089\System.ServiceModel.resources.dll
MOD - [2009.03.30 06:42:12 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.08.28 18:10:18 | 000,233,472 | ---- | M] () -- C:\Programme\DisplayLink Core Software\DisplayLinkUI.exe
MOD - [2008.07.10 14:42:47 | 000,086,016 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\SPMCommon\3.1.0.6020__e3c7096ba83f9295\SPMCommon.dll
MOD - [2008.07.10 14:42:47 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\SPMDam\3.1.0.6020__1b3c579b6925895f\SPMDam.dll
MOD - [2008.07.09 02:05:20 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2007.12.06 15:59:56 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
========== Win32 Services (SafeList) ==========
SRV - [2012.07.07 19:41:37 | 000,044,544 | ---- | M] (HLBS Tech (P) Limited) [Auto | Stopped] -- C:\Users\Lili\AppData\Local\Temp\DATA3CE.tmp.exe -- (wzstqyneejxe)
SRV - [2012.06.18 20:10:08 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.14 17:52:03 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.14 17:51:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.04.21 19:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.04.21 19:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009.05.21 14:28:38 | 000,874,768 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2009.05.21 13:04:14 | 000,473,360 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2009.04.11 08:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008.07.30 16:05:22 | 000,299,008 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\Network Utility\NSUService.exe -- (NSUService)
SRV - [2008.07.07 12:28:04 | 000,182,112 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2008.07.03 08:06:17 | 000,104,992 | ---- | M] (Realtek Semiconductor) [Auto | Running] -- C:\Windows\RTKAUDIOSERVICE.EXE -- (RtkAudioService)
SRV - [2008.06.19 19:53:20 | 000,411,488 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\igdkmd32.sys -- (igfx)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Lili\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012.05.14 17:52:03 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.14 17:52:03 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009.05.28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008.07.09 02:05:17 | 003,548,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.06.28 02:33:45 | 000,068,608 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008.06.27 18:37:42 | 000,010,216 | ---- | M] (Sony Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\DMICall.sys -- (DMICall)
DRV - [2008.06.21 02:03:04 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2008.06.10 02:04:47 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.06.07 02:02:55 | 000,131,000 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2008.03.10 13:01:26 | 000,009,344 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SFEP.sys -- (SFEP)
DRV - [2008.01.25 04:14:25 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {6C46687A-47DF-4C56-9E42-77258AB738EB}
IE - HKLM\..\SearchScopes\{6C46687A-47DF-4C56-9E42-77258AB738EB}: "URL" = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0D7562AE-8EF6-416d-A838-AB665251703A}
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{6C46687A-47DF-4C56-9E42-77258AB738EB}: "URL" = hxxp://www.google.de/search?hl=de&q={searchTerms}&meta=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.13.1.18132
FF - prefs.js..extensions.enabledItems: toolbar@web.de:1.7
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.4.1
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.20 01:10:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.18 20:10:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.23 15:03:50 | 000,000,000 | ---D | M]
[2011.04.12 09:05:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lili\AppData\Roaming\mozilla\Extensions
[2012.07.08 10:54:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions
[2012.01.26 18:20:45 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.05.04 11:05:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.03.10 18:39:18 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.30 12:08:37 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.11.10 14:28:08 | 000,000,000 | ---D | M] (preisspion.de) -- C:\Users\Lili\AppData\Roaming\mozilla\Firefox\Profiles\qkrymm6w.default\extensions\finder@meingutscheincode.de
[2012.07.01 13:45:46 | 000,000,853 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Mozilla\Firefox\Profiles\qkrymm6w.default\searchplugins\11-suche.xml
[2012.07.01 13:45:46 | 000,002,209 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Mozilla\Firefox\Profiles\qkrymm6w.default\searchplugins\englische-ergebnisse.xml
[2012.07.01 13:45:46 | 000,010,506 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Mozilla\Firefox\Profiles\qkrymm6w.default\searchplugins\gmx-suche.xml
[2012.07.01 13:45:46 | 000,002,368 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Mozilla\Firefox\Profiles\qkrymm6w.default\searchplugins\lastminute.xml
[2012.07.01 13:45:45 | 000,005,489 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Mozilla\Firefox\Profiles\qkrymm6w.default\searchplugins\webde-suche.xml
[2012.06.07 20:52:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.01 13:45:38 | 000,578,962 | ---- | M] () (No name found) -- C:\USERS\LILI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKRYMM6W.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012.06.18 20:10:08 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.23 15:36:30 | 000,002,048 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2011.05.02 12:32:10 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Search-Results)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SONY VGP-UPR1 (Display Adapter)] C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [NSUFloatingUI] C:\Program Files\Sony\Network Utility\LANUtil.exe (Sony Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Lili\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Lili\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lili\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Lili\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D02EB0B-D3E8-4528-8FD4-409B058AE975}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DD359DE3-3C3B-45B6-A15C-6B946D191EED}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - File not found
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Lili\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Lili\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.07.08 12:23:36 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Lili\Desktop\OTL.exe
[2012.07.08 12:17:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.08 12:17:57 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.08 12:17:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.08 10:46:17 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Lili\Desktop\mbam-setup-1.61.0.1400.exe
[2012.07.03 22:12:24 | 000,000,000 | ---D | C] -- C:\Users\Lili\WSV
[2012.06.12 12:26:00 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox
========== Files - Modified Within 30 Days ==========
File not found -- C:\Windows\System32\
[2012.07.08 12:42:33 | 000,000,000 | ---- | M] () -- C:\Users\Lili\defogger_reenable
[2012.07.08 12:42:02 | 000,717,826 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.08 12:42:02 | 000,661,540 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.08 12:42:02 | 000,156,658 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.08 12:42:02 | 000,128,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.08 12:36:15 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.08 12:36:11 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\str.sys
[2012.07.08 12:36:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.08 12:36:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.08 12:35:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.08 12:29:01 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.08 12:25:04 | 000,302,592 | ---- | M] () -- C:\Users\Lili\Desktop\tp5ep4xc.exe
[2012.07.08 12:23:39 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Lili\Desktop\OTL.exe
[2012.07.08 12:23:27 | 000,050,477 | ---- | M] () -- C:\Users\Lili\Desktop\Defogger.exe
[2012.07.08 12:17:58 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.08 12:10:08 | 000,151,552 | ---- | M] () -- C:\Users\Lili\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.08 10:46:45 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Lili\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.26 12:27:07 | 000,182,258 | ---- | M] () -- C:\Users\Lili\Frederik_Fabian_Brügmann.pdf
[2012.06.14 21:34:28 | 000,404,280 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.12 12:26:07 | 000,000,950 | ---- | M] () -- C:\Users\Lili\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.06.12 12:25:54 | 000,000,916 | ---- | M] () -- C:\Users\Lili\Desktop\Dropbox.lnk
========== Files Created - No Company Name ==========
File not found -- C:\Windows\System32\
[2012.07.08 12:42:33 | 000,000,000 | ---- | C] () -- C:\Users\Lili\defogger_reenable
[2012.07.08 12:36:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\drivers\str.sys
[2012.07.08 12:25:03 | 000,302,592 | ---- | C] () -- C:\Users\Lili\Desktop\tp5ep4xc.exe
[2012.07.08 12:23:27 | 000,050,477 | ---- | C] () -- C:\Users\Lili\Desktop\Defogger.exe
[2012.07.08 12:17:58 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.08 09:42:49 | 000,001,696 | ---- | C] () -- C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\U\00000001.@
[2012.07.07 19:41:48 | 000,001,696 | ---- | C] () -- C:\Windows\Installer\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\U\00000001.@
[2012.06.26 12:27:07 | 000,182,258 | ---- | C] () -- C:\Users\Lili\Frederik_Fabian_Brügmann.pdf
[2012.01.11 22:02:15 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\@
[2012.01.11 22:02:15 | 000,002,048 | -HS- | C] () -- C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\@
[2011.12.24 18:04:23 | 000,001,466 | ---- | C] () -- C:\Users\Lili\.recently-used.xbel
[2011.11.08 23:08:59 | 000,000,582 | ---- | C] () -- C:\Windows\eReg.dat
[2011.05.02 15:53:11 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011.05.02 15:53:11 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.05.02 15:53:11 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011.05.02 15:53:11 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.05.02 15:53:11 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.05.02 15:31:45 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.05.02 15:31:44 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.05.02 14:26:37 | 000,251,401 | ---- | C] () -- C:\Users\Lili\2011-04-21-1134886211_04-RG.PDF
[2011.05.02 14:26:34 | 000,010,871 | ---- | C] () -- C:\Users\Lili\2011-04-21-1134886211_04-EVN.PDF
[2011.05.01 18:44:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.04.26 19:52:58 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.04.17 21:35:49 | 000,155,648 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2011.04.12 08:36:26 | 000,151,552 | ---- | C] () -- C:\Users\Lili\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.12 08:22:08 | 000,002,032 | ---- | C] () -- C:\Users\Lili\AppData\Local\d3d9caps.dat
[2011.04.11 23:16:52 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
========== LOP Check ==========
[2011.08.27 16:56:40 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\DeepBurner
[2012.07.08 12:37:04 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\Dropbox
[2012.07.08 10:43:17 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\DVDVideoSoft
[2011.04.25 20:35:26 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\DynaGeo
[2012.01.26 18:21:47 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\Garmin
[2011.12.24 18:04:23 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\gtk-2.0
[2011.04.13 22:57:18 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\kock
[2011.12.02 21:19:02 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\LibreOffice
[2011.04.23 12:10:57 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\PhotoFiltre
[2011.12.24 17:08:52 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\PhotoScape
[2011.12.10 09:55:09 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\redsn0w
[2012.07.04 11:55:49 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\Spotify
[2011.06.07 10:27:56 | 000,000,000 | ---D | M] -- C:\Users\Lili\AppData\Roaming\SumatraPDF
[2012.07.08 12:34:46 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report > Gmer hat nicht funktioniert, da kam kurz nach Klicken auf Scan nur ein komischer,verzerrter Bildschirm und ich musste den PC manuell durch langes Drücken auf die AN/AUS-Taste neustarten.
Hatte davor schon einen Scan mit Malwarebytes durchgeführt: Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.07.08.01
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Lili :: LILI-PC [Administrator]
Schutz: Aktiviert
08.07.2012 12:22:41
mbam-log-2012-07-08 (12-22-41).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 201980
Laufzeit: 6 Minute(n), 53 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Daten: C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n. -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 2
C:\Windows\Installer\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n (Trojan.Dropper.PE4) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\System32\drivers\str.sys (Rootkit.Agent) -> Löschen bei Neustart.
(Ende) und: Code:
2012/07/08 12:19:03 +0200 LILI-PC Lili MESSAGE Starting protection
2012/07/08 12:19:03 +0200 LILI-PC Lili MESSAGE Executing scheduled update: Daily
2012/07/08 12:19:04 +0200 LILI-PC Lili MESSAGE Database already up-to-date
2012/07/08 12:19:05 +0200 LILI-PC Lili MESSAGE Protection started successfully
2012/07/08 12:19:08 +0200 LILI-PC Lili MESSAGE Starting IP protection
2012/07/08 12:19:08 +0200 LILI-PC Lili ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/07/08 12:22:27 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\U\800000cb.@ Rootkit.0Access QUARANTINE
2012/07/08 12:23:16 +0200 LILI-PC Lili DETECTION c:\users\lili\appdata\local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\u\800000cb.@ Rootkit.0Access DENY
2012/07/08 12:26:09 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 QUARANTINE
2012/07/08 12:26:09 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:09 +0200 LILI-PC Lili ERROR Quarantine failed: DeleteFile failed with error code 5
2012/07/08 12:26:09 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:09 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:09 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:12 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:13 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:13 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:13 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:13 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:13 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:16 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\n Trojan.Dropper.PE4 DENY
2012/07/08 12:26:32 +0200 LILI-PC Lili DETECTION C:\Users\Lili\AppData\Local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\U\800000cb.@ Rootkit.0Access DENY
2012/07/08 12:32:56 +0200 LILI-PC Lili DETECTION c:\users\lili\appdata\local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\u\800000cb.@ Rootkit.0Access DENY
2012/07/08 12:33:42 +0200 LILI-PC Lili DETECTION c:\users\lili\appdata\local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\u\800000cb.@ Rootkit.0Access DENY
2012/07/08 12:34:35 +0200 LILI-PC Lili DETECTION c:\users\lili\appdata\local\{0b4711aa-1a9f-0727-09c7-a1655d633a2e}\u\800000cb.@ Rootkit.0Access DENY
2012/07/08 12:36:36 +0200 LILI-PC Lili MESSAGE Starting protection
2012/07/08 12:36:40 +0200 LILI-PC Lili MESSAGE Protection started successfully
2012/07/08 12:36:43 +0200 LILI-PC Lili MESSAGE Starting IP protection
2012/07/08 12:36:43 +0200 LILI-PC Lili ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/07/08 13:06:45 +0200 LILI-PC Lili MESSAGE Starting protection
2012/07/08 13:06:48 +0200 LILI-PC Lili MESSAGE Protection started successfully
2012/07/08 13:06:51 +0200 LILI-PC Lili MESSAGE Starting IP protection
2012/07/08 13:06:51 +0200 LILI-PC Lili ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753 habe auch alte Malewarebyte-Logdateien, die sind aber von Januar 2011, weil ich da auch schon mal ein großes Virenproblem hatte, weiß nicht ob ihr die braucht, wenn ja kann ich sie auch noch posten.
So ich hoffe das gibt etwas mehr Aufschluss...
LG Lili |