| |
| |||||||
Log-Analyse und Auswertung: Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dllWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
03.08.2011, 11:10
| #1 |
| |  Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll Hallo zusammen, zu dem Problem im Betreff gibt es eine kurze Vorgeschichte: Letzten Monat meldete mir Avast einen Win32:MBRoot-J im MBR Ich hab den MBR gesäubert und beim anschließenden BootScan etwas altes Adware-Zeugs löschen lassen (das Zeug lag eigentlich nur noch rum und wurde schon ewig nicht mehr genutzt/installiert). Eine Online-Analyse meines HiJackThis-Logs sah unauffällig aus. Nach meiner Online-Recherche war das ein Trojaner der auf TAN-Diebstahl spezialisiert ist. Da mir nix entsprechendes aufgefallen war und meine Bank das TAN-Verfahren abgeschafft hat dachte ich glimpflich abgelaufen, schnell erkannt und alles wieder sauber. Seit Sonntag hatte ich dann Schwierigkeiten das mein Windows beim ersten Start mit BlueScreen neu startet und hab gestern aus "Spaß an der Freud" wieder einen Bootscan machen lassen. Mit o.g. Ergebnis. Meine Suche ergab leider wiedersprüchliche Informationen zum aktuellen Trojaner und ich konnte auch nicht herausfinden wozu diese dll gut ist (SysWOW64 ist klar, aber diese Datei?). Vor allem mach ich mir Sorgen das mein oder das zweite System im Netzwerk noch mit irgendwas infiziert ist, bzw. das irgendwo ein Tor offen steht...  Das Log von PC1 (W*) Soweit ich gesehen hab ein Haufen alter Schrott mit dabei. Code:
ATTFilter OTL logfile created on: 03.08.2011 10:49:32 - Run 1 OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\D*\Desktop 64bit-Windows Server 2003 Service Pack 2 (Version = 5.2.3790) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,24% Memory free 3,87 Gb Paging File | 3,27 Gb Available in Paging File | 84,42% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86) Drive C: | 60,00 Gb Total Space | 7,38 Gb Free Space | 12,29% Space Free | Partition Type: NTFS Drive D: | 80,01 Gb Total Space | 6,77 Gb Free Space | 8,46% Space Free | Partition Type: NTFS Drive E: | 49,91 Gb Total Space | 7,85 Gb Free Space | 15,74% Space Free | Partition Type: NTFS Computer Name: W* | User Name: D* | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.03 10:39:34 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daniel\Desktop\OTL.exe PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe PRC - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe PRC - [2011.04.28 09:59:58 | 000,220,552 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\pdf24\pdf24.exe PRC - [2009.11.11 09:34:53 | 000,479,232 | ---- | M] () -- C:\Program Files (x86)\BOINC\projects\setiathome.berkeley.edu\astropulse_5.05_windows_intelx86.exe PRC - [2008.05.02 04:00:00 | 000,077,824 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe PRC - [2008.03.07 19:24:18 | 000,417,792 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe PRC - [2008.02.20 20:58:46 | 000,019,968 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\SysWOW64\Ctxfihlp.exe PRC - [2008.02.20 20:58:44 | 000,019,456 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\SysWOW64\CtHelper.exe PRC - [2008.02.20 20:55:12 | 000,969,216 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\SysWOW64\CTxfispi.exe PRC - [2006.08.03 01:26:30 | 001,966,080 | ---- | M] (Space Sciences Laboratory) -- C:\Program Files (x86)\BOINC\boincmgr.exe PRC - [2006.08.03 01:24:40 | 000,319,488 | ---- | M] (Space Sciences Laboratory) -- C:\Program Files (x86)\BOINC\boinc.exe ========== Modules (SafeList) ========== MOD - [2011.08.03 10:39:34 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daniel\Desktop\OTL.exe MOD - [2011.05.14 01:17:40 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcr80.dll MOD - [2010.09.07 18:04:52 | 001,051,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\wow64_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.4770_x-ww_8D2E3180\comctl32.dll MOD - [2008.05.02 04:00:00 | 000,038,912 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\x86\lgscroll.dll MOD - [2008.05.02 04:00:00 | 000,010,752 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\x86\IMHook.dll MOD - [2008.02.20 20:58:42 | 000,008,704 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\SysWOW64\ctagent.dll MOD - [2007.02.18 11:05:38 | 000,177,152 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\msctfime.ime MOD - [2007.02.18 11:05:22 | 000,797,184 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\comres.dll MOD - [2005.03.25 14:00:00 | 000,178,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\wbem\framedyn.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV:64bit: - [2008.05.02 02:49:54 | 000,160,272 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2008.07.25 11:17:02 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.06.15 21:52:49 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service) SRV - [2008.03.28 21:05:00 | 000,663,552 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\SysWOW64\ati2saag.exe -- (ATI Smart) SRV - [2008.03.07 19:24:18 | 000,417,792 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2007.02.17 00:44:20 | 000,077,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc.dll -- (helpsvc) SRV - [2005.03.25 14:00:00 | 000,039,424 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\wdfmgr.exe -- (UMWdf) ========== Driver Services (SafeList) ========== DRV - [2009.01.30 01:02:44 | 000,120,256 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysWOW64\Drivers\AnyDVD.sys -- (AnyDVD) DRV - [2005.03.25 14:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\SysWow64\mnmdd.dll -- (mnmdd) DRV - [2005.03.24 17:34:44 | 000,042,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\Drivers\usbser.sys -- (usbser) DRV - [2003.09.19 20:23:40 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\Drivers\VMNetSrv.sys -- (VPCNetS2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) Hosts file not found O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3:64bit: - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - File not found O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - File not found O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - File not found O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [AsioThk32Reg] C:\WINDOWS\SysWow64\ctasio.dll (Creative Technology Ltd) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\SysWow64\CtHelper.exe (Creative Technology Ltd) O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\SysWow64\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\SysWOW64\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\pdf24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Valve\Steam\Steam.exe (Valve Corporation) O4 - HKCU..\Run: [updateMgr] File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BOINC Manager.lnk = C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\SysWow64\GPhotos.scr (Google Inc.) O9:64bit: - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1171364292609 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - File not found O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - File not found O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - File not found O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - File not found O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - File not found O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - File not found O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - File not found O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - File not found O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - File not found O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - File not found O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - File not found O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - File not found O18:64bit: - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - File not found O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - File not found O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - File not found O18:64bit: - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - File not found O18:64bit: - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - File not found O18:64bit: - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - File not found O18:64bit: - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - File not found O18:64bit: - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - File not found O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - File not found O20:64bit: - HKLM Winlogon: UIHost - (%SystemRoot%\system32\logonui.exe) - File not found O20:64bit: - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: System - (lsass.exe) - File not found O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Key error. - File not found O20:64bit: - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - File not found O20:64bit: - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - File not found O20:64bit: - Winlogon\Notify\cscdll: DllName - cscdll.dll - File not found O20:64bit: - Winlogon\Notify\dimsntfy: DllName - dimsntfy.dll - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O20:64bit: - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found O20:64bit: - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found O20:64bit: - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - File not found O20:64bit: - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found O20:64bit: - Winlogon\Notify\termsrv: DllName - Reg Error: Key error. - File not found O20:64bit: - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found O21:64bit: - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - File not found O21:64bit: - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - File not found O21:64bit: - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - File not found O22:64bit: - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - File not found O22:64bit: - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - File not found O24 - Desktop WallPaper: C:\Documents and Settings\Daniel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Daniel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.02.12 12:06:29 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{5acf794a-918d-11de-8138-0007e913edde}\Shell - "" = AutoRun O33 - MountPoints2\{5acf794a-918d-11de-8138-0007e913edde}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{5acf794a-918d-11de-8138-0007e913edde}\Shell\AutoRun\command - "" = K:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Reg Error: Value error. ActiveX:64bit: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX:64bit: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX:64bit: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} - Help and Support Center ActiveX:64bit: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX:64bit: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework ActiveX:64bit: {B6EC01E7-431D-4D29-B9D4-E1D74CAF0AB0} - .NET Framework ActiveX:64bit: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler ActiveX:64bit: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player 9 ActiveX ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\INF\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX:64bit: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789) ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\SysWOW64\Rundll32.exe c:\WINDOWS\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework ActiveX: {B6EC01E7-431D-4D29-B9D4-E1D74CAF0AB0} - .NET Framework ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.08.03 10:39:30 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Daniel\Desktop\OTL.exe [2011.08.01 06:42:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN [2011.07.07 21:19:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2011.07.07 21:19:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daniel\Start Menu\Programs\HiJackThis [2008.02.20 20:59:14 | 000,034,816 | ---- | C] ( ) -- C:\WINDOWS\SysWow64\a3d.dll [2008.02.20 20:44:02 | 000,010,240 | ---- | C] ( ) -- C:\WINDOWS\SysWow64\killapps.exe [2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.08.03 10:44:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.08.03 10:43:22 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\Daniel\defogger_reenable [2011.08.03 10:39:34 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daniel\Desktop\OTL.exe [2011.08.03 10:39:23 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Daniel\Desktop\Defogger.exe [2011.07.28 15:06:25 | 000,000,002 | ---- | M] () -- C:\WINDOWS\SysWow64\config.nt [2011.07.13 12:08:05 | 000,000,970 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.07.08 06:43:02 | 000,004,096 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\00000197.LCS [2011.07.07 12:44:52 | 000,023,995 | ---- | M] () -- C:\WINDOWS\uedit32.INI [2011.07.04 13:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2011.07.04 13:43:51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysWow64\aswBoot.exe [2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.08.03 10:43:22 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\Daniel\defogger_reenable [2011.08.03 10:39:23 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Daniel\Desktop\Defogger.exe [2010.10.07 07:17:15 | 000,000,089 | ---- | C] () -- C:\WINDOWS\SysWow64\MSBII.dll [2010.10.07 07:10:09 | 000,032,768 | ---- | C] () -- C:\WINDOWS\SysWow64\WKAuxil.dll [2010.10.07 07:10:08 | 000,338,944 | ---- | C] () -- C:\WINDOWS\SysWow64\lffpx7.dll [2010.10.07 07:10:08 | 000,118,784 | ---- | C] () -- C:\WINDOWS\SysWow64\lfkodak.dll [2010.10.07 07:10:00 | 000,017,920 | ---- | C] () -- C:\WINDOWS\SysWow64\implode.dll [2010.10.07 07:09:58 | 003,782,416 | ---- | C] () -- C:\WINDOWS\SysWow64\mso97.dll [2010.10.07 07:09:15 | 000,080,384 | ---- | C] () -- C:\WINDOWS\SysWow64\ccmove32.dll [2010.10.07 07:09:15 | 000,080,384 | ---- | C] () -- C:\WINDOWS\SysWow64\Cc32.dll [2009.02.23 13:41:25 | 000,000,125 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib [2009.02.13 19:29:51 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Daniel\Local Settings\Application Data\fusioncache.dat [2008.06.15 21:52:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI [2008.05.02 09:53:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2008.05.02 09:44:56 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\SysWow64\ezsidmv.dat [2008.02.25 14:55:32 | 000,101,603 | ---- | C] () -- C:\WINDOWS\SysWow64\instwdm.ini [2008.02.20 21:24:36 | 000,000,054 | ---- | C] () -- C:\WINDOWS\SysWow64\ctzapxx.ini [2008.02.20 21:00:12 | 000,043,520 | ---- | C] () -- C:\WINDOWS\SysWow64\CTBurst.dll [2008.02.20 20:58:46 | 000,037,888 | ---- | C] () -- C:\WINDOWS\SysWow64\psconv.exe [2008.02.20 20:49:46 | 000,321,512 | ---- | C] () -- C:\WINDOWS\SysWow64\ctdlang.dat [2008.02.20 20:49:46 | 000,056,509 | ---- | C] () -- C:\WINDOWS\SysWow64\ctdnlstr.dat [2008.02.20 20:44:10 | 000,313,207 | ---- | C] () -- C:\WINDOWS\SysWow64\ctstatic.dat [2008.02.20 20:44:10 | 000,053,932 | ---- | C] () -- C:\WINDOWS\SysWow64\ctdaught.dat [2008.02.20 20:44:08 | 000,005,120 | ---- | C] () -- C:\WINDOWS\SysWow64\enlocstr.exe [2007.08.13 20:45:02 | 000,077,824 | ---- | C] () -- C:\WINDOWS\SysWow64\ctmmactl.dll [2007.05.20 09:44:22 | 000,000,241 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI [2007.05.06 12:58:47 | 000,053,248 | ---- | C] () -- C:\WINDOWS\SysWow64\pagesync.dll [2007.04.29 12:32:49 | 000,290,904 | R--- | C] () -- C:\WINDOWS\SysWow64\vc6-re200l.dll [2007.04.15 21:40:53 | 000,000,469 | ---- | C] () -- C:\Program Files\img2ozf.ini [2007.04.15 21:40:46 | 001,329,664 | ---- | C] () -- C:\Program Files\Img2ozf.exe [2007.04.15 21:40:46 | 000,673,610 | ---- | C] () -- C:\Program Files\unins000.exe [2007.04.15 21:40:46 | 000,092,909 | ---- | C] () -- C:\Program Files\Img2Ozf.chm [2007.04.15 21:40:46 | 000,003,887 | ---- | C] () -- C:\Program Files\unins000.dat [2007.03.12 13:22:10 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007.03.11 12:32:11 | 000,000,926 | ---- | C] () -- C:\WINDOWS\PVAStrumento.ini [2007.03.03 12:37:16 | 000,023,995 | ---- | C] () -- C:\WINDOWS\uedit32.INI [2007.02.26 08:44:32 | 000,626,688 | ---- | C] () -- C:\WINDOWS\SysWow64\xvid.dll [2007.02.25 13:36:44 | 000,002,508 | ---- | C] () -- C:\Documents and Settings\Daniel\Application Data\$_hpcst$.hpc [2007.02.20 17:50:04 | 000,081,920 | ---- | C] () -- C:\WINDOWS\SysWow64\acedrv06.dll [2007.02.20 17:49:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\stduser.ini [2007.02.18 13:29:16 | 000,000,264 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini [2007.02.13 14:00:42 | 000,003,072 | ---- | C] () -- C:\WINDOWS\SysWow64\CTXFIGER.DLL [2007.02.13 13:55:54 | 000,000,130 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007.02.13 13:50:42 | 000,663,552 | ---- | C] () -- C:\WINDOWS\SysWow64\ati2saag.exe [2007.02.13 13:49:47 | 000,198,656 | ---- | C] () -- C:\WINDOWS\SysWow64\psisdecd.dll [2007.02.13 13:30:48 | 001,092,680 | ---- | C] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI [2007.02.12 12:50:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2007.02.12 12:10:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2007.02.12 12:06:22 | 000,061,752 | ---- | C] () -- C:\WINDOWS\SysWow64\mapi32.dll [2006.10.02 17:25:18 | 000,000,307 | ---- | C] () -- C:\WINDOWS\SysWow64\kill.ini [2005.03.25 14:00:00 | 001,278,464 | ---- | C] () -- C:\WINDOWS\SysWow64\quartz.dll [2005.03.25 14:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\SysWow64\qedwipes.dll [2005.03.25 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat [2005.03.25 14:00:00 | 000,512,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qedit.dll [2005.03.25 14:00:00 | 000,498,742 | ---- | C] () -- C:\WINDOWS\SysWow64\dxmasf.dll [2005.03.25 14:00:00 | 000,396,288 | ---- | C] () -- C:\WINDOWS\SysWow64\encdec.dll [2005.03.25 14:00:00 | 000,385,536 | ---- | C] () -- C:\WINDOWS\SysWow64\qdvd.dll [2005.03.25 14:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll [2005.03.25 14:00:00 | 000,279,040 | ---- | C] () -- C:\WINDOWS\SysWow64\qdv.dll [2005.03.25 14:00:00 | 000,276,992 | ---- | C] () -- C:\WINDOWS\SysWow64\sbe.dll [2005.03.25 14:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\SysWow64\ir32_32.dll [2005.03.25 14:00:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qcap.dll [2005.03.25 14:00:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\SysWow64\msencode.dll [2005.03.25 14:00:00 | 000,072,704 | ---- | C] () -- C:\WINDOWS\SysWow64\amstream.dll [2005.03.25 14:00:00 | 000,062,464 | ---- | C] () -- C:\WINDOWS\SysWow64\mciqtz32.dll [2005.03.25 14:00:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SysWow64\devenum.dll [2005.03.25 14:00:00 | 000,055,808 | ---- | C] () -- C:\WINDOWS\SysWow64\dvdplay.exe [2005.03.25 14:00:00 | 000,046,907 | ---- | C] () -- C:\WINDOWS\mib.bin [2005.03.25 14:00:00 | 000,016,896 | ---- | C] () -- C:\WINDOWS\SysWow64\tsd32.dll [2005.03.25 14:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\SysWow64\msdmo.dll [2005.03.25 14:00:00 | 000,012,498 | ---- | C] () -- C:\WINDOWS\SysWow64\append.exe [2005.03.25 14:00:00 | 000,004,126 | ---- | C] () -- C:\WINDOWS\SysWow64\msdxmlc.dll [2005.03.25 14:00:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\vwipxspx.exe [2002.04.02 17:08:34 | 000,311,108 | ---- | C] () -- C:\WINDOWS\ml-cleanup.exe [2002.04.02 17:08:32 | 000,036,868 | ---- | C] () -- C:\WINDOWS\ml-winamp-shutdown.exe ========== LOP Check ========== [2011.01.16 10:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2011.04.05 05:47:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software [2008.04.30 12:36:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avery [2007.02.14 11:31:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ [2009.02.23 13:41:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft [2011.07.25 05:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\The Bat! [2010.06.06 10:11:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\Amazon [2007.07.15 17:11:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\Artweaver [2009.12.04 14:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\CadSoft [2009.01.11 13:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\CD-LabelPrint [2007.03.30 12:33:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\Cuttermaran [2008.05.18 11:45:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\DAEMON Tools [2007.05.07 10:03:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\EDrawings [2007.02.14 11:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\Opera [2007.02.28 12:02:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\Pegasys Inc [2011.07.01 08:00:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\SumatraPDF [2011.08.02 07:46:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daniel\Application Data\The Bat! [2011.08.03 10:43:41 | 000,032,550 | ---- | M] () -- C:\WINDOWS\Tasks\SchedLgU.Txt ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.09.25 08:05:45 | 000,000,000 | ---D | M] -- C:\3cdff266a4db5f8ebafc26e9f2 [2007.02.14 11:15:04 | 000,000,000 | ---D | M] -- C:\ATI [2011.08.03 07:42:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2007.02.13 13:56:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings [2007.05.06 12:58:39 | 000,000,000 | ---D | M] -- C:\IMSI [2009.04.02 16:39:41 | 000,000,000 | ---D | M] -- C:\OziExplorer [2010.06.30 14:21:45 | 000,000,000 | ---D | M] -- C:\PFiles [2011.08.03 07:50:42 | 000,000,000 | R--D | M] -- C:\Program Files [2011.07.07 21:19:28 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2010.10.07 07:10:13 | 000,000,000 | ---D | M] -- C:\Programme [2007.02.13 13:58:20 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2011.08.01 06:11:59 | 000,000,000 | ---D | M] -- C:\Schnelldownload [2007.02.12 12:11:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2007.11.23 11:19:05 | 000,000,000 | ---D | M] -- C:\Torrent [2011.08.02 12:09:29 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2005.03.25 14:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) MD5=4B93BB34AF478A0FD9765D9B73356DC9 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2007.02.18 11:05:28 | 001,053,184 | ---- | M] (Microsoft Corporation) MD5=A26C39540F8BE3729846E360E2C57344 -- C:\WINDOWS\SysWOW64\explorer.exe [2007.02.17 00:20:36 | 001,364,480 | ---- | M] (Microsoft Corporation) MD5=AE7A08C05F72A9242734C03230A5CD7F -- C:\WINDOWS\explorer.exe [2007.02.17 00:20:36 | 001,364,480 | ---- | M] (Microsoft Corporation) MD5=AE7A08C05F72A9242734C03230A5CD7F -- C:\WINDOWS\ServicePackFiles\amd64\explorer.exe < MD5 for: REGEDIT.EXE > [2007.02.18 10:59:54 | 000,224,768 | ---- | M] (Microsoft Corporation) MD5=0F4DB85E5FF5E203A94FDC5059E89297 -- C:\WINDOWS\regedit.exe [2007.02.18 11:05:48 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=0F4DB85E5FF5E203A94FDC5059E89297 -- C:\WINDOWS\SysWOW64\regedit.exe [2005.03.25 14:00:00 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=6F2259A2B311E402E30E4014AA34910B -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe [2007.02.18 10:59:54 | 000,224,768 | ---- | M] (Microsoft Corporation) MD5=872A60B75CE6A09033FBE2461D44E696 -- C:\WINDOWS\ServicePackFiles\amd64\regedit.exe < MD5 for: USERINIT.EXE > [2007.02.17 01:00:56 | 000,039,424 | ---- | M] (Microsoft Corporation) MD5=438393CC0B5122B5D988BD7BA05FE3C9 -- C:\WINDOWS\ServicePackFiles\amd64\userinit.exe [2005.03.25 14:00:00 | 000,039,424 | ---- | M] (Microsoft Corporation) MD5=5EF907A339CAF229F3CE38909C93F53B -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe [2007.02.18 11:05:56 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=B5FEB3B971A8B8C81CE9DE65031A87E5 -- C:\WINDOWS\SysWOW64\userinit.exe < MD5 for: WINLOGON.EXE > [2005.03.25 14:00:00 | 000,922,624 | ---- | M] (Microsoft Corporation) MD5=2412D710F07F527E99D5FCBD8D6E5B89 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2007.02.17 01:02:56 | 000,944,128 | ---- | M] (Microsoft Corporation) MD5=901C7E44D11C00CA9D48BA1A866FDC4B -- C:\WINDOWS\ServicePackFiles\amd64\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ========== @Alternate Data Stream - 24 bytes -> C:\WINDOWS:EB903A9FBF05D8CC < End of report > Da arbeite ich nicht selbst dran, daher keine echte Kontrolle was da so getrieben und installiert wird. Ich schau halt hin und wieder das ein Backup gemacht wird und die Software einigermaßen aktuell ist. Code:
ATTFilter OTL logfile created on: 03.08.2011 08:39:15 - Run 1 OTL by OldTimer - Version 3.2.26.1 Folder = C:\Dokumente und Einstellungen\W*\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,75 Gb Total Physical Memory | 1,26 Gb Available Physical Memory | 71,95% Memory free 3,60 Gb Paging File | 3,23 Gb Available in Paging File | 89,87% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 60,00 Gb Total Space | 46,55 Gb Free Space | 77,58% Space Free | Partition Type: NTFS Drive D: | 89,04 Gb Total Space | 71,88 Gb Free Space | 80,73% Space Free | Partition Type: NTFS Computer Name: B* | User Name: W* | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.03 08:36:28 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Willy\Desktop\OTL.exe PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2011.06.14 17:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe PRC - [2011.03.31 14:32:14 | 000,134,144 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe PRC - [2011.03.21 13:19:36 | 000,120,832 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe PRC - [2010.10.16 01:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.11.13 19:38:28 | 002,510,848 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.bin PRC - [2007.11.13 19:38:26 | 002,359,296 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.exe ========== Modules (SafeList) ========== MOD - [2011.08.03 08:36:28 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Willy\Desktop\OTL.exe MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011.07.04 13:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2010.10.16 01:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) ========== Driver Services (SafeList) ========== DRV - [2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011.07.04 13:35:12 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011.07.04 13:32:13 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009.03.04 17:58:34 | 005,045,760 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008.10.30 21:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2008.09.11 11:08:12 | 003,331,072 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.08.05 20:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2007.10.12 09:40:12 | 000,009,096 | R--- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdide.sys -- (amdide) DRV - [2006.01.04 15:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) DRV - [2005.03.09 16:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.08.03 07:34:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.08.03 07:34:53 | 000,000,000 | ---D | M] O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O4 - HKLM..\Run: [avast] C:\Programme\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [NokiaOviSuite2] C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia) O4 - Startup: C:\Dokumente und Einstellungen\Willy\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk = C:\Programme\OpenOffice.org 2.3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261043306705 (WUWebControl Class) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Willy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Willy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.12.14 22:17:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE ActiveX: Microsoft Base Smart Card Crypto Provider Package - NetSvcs: 6to4 - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.08.03 08:36:26 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Willy\Desktop\OTL.exe [2011.08.03 07:36:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Willy\Lokale Einstellungen\Anwendungsdaten\Nokia [2011.08.03 07:36:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nokia [2011.08.03 07:34:41 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution [2011.08.03 07:33:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF [2011.08.03 07:33:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles [2011.08.03 07:32:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\VideoLAN [2011.08.03 07:31:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2011.08.03 07:30:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.08.03 08:37:08 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Willy\defogger_reenable [2011.08.03 08:36:28 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Willy\Desktop\OTL.exe [2011.08.03 08:36:16 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Willy\Desktop\Defogger.exe [2011.08.03 08:10:56 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.08.03 08:08:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.08.03 08:08:51 | 000,054,376 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2011.08.03 07:36:24 | 000,001,760 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Ovi Suite.lnk [2011.08.03 07:33:02 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.08.03 07:33:02 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.08.03 07:32:11 | 000,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2011.08.03 07:30:04 | 000,003,001 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2011.07.18 18:41:21 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011.07.17 19:09:25 | 000,103,824 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.07.04 13:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2011.07.04 13:43:51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe [2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys [2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2011.07.04 13:35:12 | 000,102,616 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2011.07.04 13:35:09 | 000,096,344 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2011.07.04 13:32:13 | 000,030,808 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.08.03 08:37:08 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Willy\defogger_reenable [2011.08.03 08:36:16 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Willy\Desktop\Defogger.exe [2011.08.03 07:36:24 | 000,001,760 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Ovi Suite.lnk [2011.08.03 07:33:02 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf [2011.08.03 07:32:11 | 000,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2010.11.09 11:06:42 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009.12.17 13:33:04 | 000,179,212 | ---- | C] () -- C:\WINDOWS\hpoins28.dat [2009.12.17 13:33:04 | 000,000,932 | ---- | C] () -- C:\WINDOWS\hpomdl28.dat [2009.12.15 13:34:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2009.12.15 13:28:14 | 000,887,724 | R--- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2009.12.15 13:28:13 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat [2009.12.15 13:28:13 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2009.12.15 13:28:13 | 000,176,216 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2009.12.14 22:19:42 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2009.12.14 22:15:26 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2009.12.14 21:49:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009.12.14 21:48:35 | 000,103,824 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008.07.31 01:00:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\atibrtmon.exe [2007.08.22 05:51:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe [2007.08.22 03:36:12 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe [2004.08.04 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004.08.04 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004.08.04 14:00:00 | 000,448,892 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2004.08.04 14:00:00 | 000,432,778 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004.08.04 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004.08.04 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2004.08.04 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004.08.04 14:00:00 | 000,080,332 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2004.08.04 14:00:00 | 000,067,734 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004.08.04 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004.08.04 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2004.08.04 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004.08.04 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004.08.04 14:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004.08.04 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004.08.04 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat ========== LOP Check ========== [2011.05.16 14:18:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software [2010.06.20 12:19:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2011.08.03 07:31:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2010.07.28 06:09:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2011.01.07 19:52:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010.06.20 12:41:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Willy\Anwendungsdaten\Nokia [2009.12.15 13:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Willy\Anwendungsdaten\Opera [2010.06.20 12:24:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Willy\Anwendungsdaten\PC Suite [2009.12.17 11:53:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Willy\Anwendungsdaten\SumatraPDF [2011.08.01 19:53:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Willy\Anwendungsdaten\The Bat! ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.08.03 07:36:42 | 000,000,000 | -H-D | M] -- C:\Config.Msi [2009.12.14 23:30:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2011.08.03 07:34:41 | 000,000,000 | R--D | M] -- C:\Programme [2009.12.15 19:02:26 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2009.12.14 23:29:26 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.08.03 08:10:57 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2004.08.04 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe < MD5 for: REGEDIT.EXE > [2004.08.04 14:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe [2008.04.14 08:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe [2008.04.14 08:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 08:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 08:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-16 04:55:14 < > < End of report > mfg JAU |
|
03.08.2011, 15:44
| #2 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™   | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dllZitat:
Zitat:
 Nein, HJT scannt viel zu oberflächlich und ein angeblich unauffälliges HJT-Log hat im Grunde keine Aussagekraft mehr. Desweiteren will ich in einem Strang nicht Logs von unterschiedlichen Rechnern sehen. Pro PC einen Strang eröffnen! Wenn behandel ich hier PC1 und für PC2 machst du am besten einen neuen Strang auf.
__________________ |
|
03.08.2011, 17:49
| #3 | |||
| | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dllZitat:
Zitat:
 Zitat:
mfg JAU |
|
03.08.2011, 20:02
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll Wie gesagt hier nur PC1 bitte. Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
04.08.2011, 12:17
| #5 | |
| | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll Mahlzeit, Zitat:
Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Datenbank Version: 7372
Windows 5.2.3790 Service Pack 2
Internet Explorer 8.0.6001.18702
04.08.2011 12:33:57
mbam-log-2011-08-04 (12-33-57).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 496382
Laufzeit: 1 Stunde(n), 14 Minute(n), 15 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\system volume information\_restore{0cbb9aad-c364-47eb-bd8a-055ee715be6e}\RP304\A0139736.dll (Trojan.Agent) -> Quarantined and deleted successfully.
d:\software\video\bearbeiten\authoring\DVD-lab\1.53\Crack\dvdlabpro_crk.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
d:\software\video\bearbeiten\bitrate\divx_bitcalc.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
d:\spiele\bf1942\KeyGen's\ea games multi keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
Die Anwendungen die er gefunden hat hab ich seit der letzten Neuinstallation glaub nicht genutzt, wobei es mich schokiert das bitcalc mit Spyware verseucht sein soll.  mfg JAU |
|
04.08.2011, 13:06
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dllZitat:
 Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!! Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!
__________________ --> Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll |
|
04.08.2011, 15:36
| #7 | |
| | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dllZitat:
 Jedenfalls danke für die Unterstützung.  Ich hoff mal das ich das soweit hinbekomme das ich mir mitm Backup nix ins neue System mit rüberziehe. mfg JAU |
|
04.08.2011, 16:11
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll Ok, danke fürs Verständnis. Es gibt durchaus andere Leute, die nicht so gelassen reagieren und den Mist mit den Cracks einfach nicht einsehen wollen, dann die Illegalität abstreiten bzw. in Frage stellen mit dem Ziel den Anspruch auf Support zu erzwingen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Avast meldet Sinowal-IM in c:\Windows\SysWOW64\prodorom_0.dll |
| 0x00000001, alternate, bho, bluescreen, c:\windows\system32\rundll32.exe, crypto, flash player, ftp, homepage, logfile, plug-in, problem, riskware.tool.ck, rundll, security update, spyware.passwords, start menu, system, trojan.agent, trojaner, webcheck, windows, windows xp |
Linear-Darstellung
