| |
| |||||||
Log-Analyse und Auswertung: E-Mail Bundesamt für SicherheitWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.08.2011, 10:27
| #1 | ||
| |  E-Mail Bundesamt für Sicherheit Hallo, unsere Firma hat vor einigen tagen eine E-Mail vom Bundesamt für Sicherheit in der Informationstechnik erhalten, aus der folgendes hervor ging: Zitat:
Zitat:
Nun poste ich hiermit die OTL.txt Code:
ATTFilter OTL logfile created on: 29.08.2011 10:23:01 - Run 1 OTL by OldTimer - Version 3.2.26.6 Folder = C:\Users\****\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 59,52% Memory free 4,00 Gb Paging File | 3,06 Gb Available in Paging File | 76,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 148,95 Gb Total Space | 111,66 Gb Free Space | 74,97% Space Free | Partition Type: NTFS Drive E: | 983,72 Mb Total Space | 382,58 Mb Free Space | 38,89% Space Free | Partition Type: FAT Computer Name: DEAN-PC | User Name: Dean | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.08.29 10:21:00 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.05.21 06:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.05.21 06:01:00 | 000,839,272 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\NvXDSync.exe PRC - [2011.05.21 06:01:00 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe PRC - [2011.04.18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe PRC - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2011.04.14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2011.03.16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe PRC - [2011.02.08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.04.14 07:43:42 | 000,604,704 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE PRC - [2009.03.13 10:48:40 | 000,211,968 | ---- | M] () -- c:\Programme\GrassSoft\Macro Expert\MacroService.exe PRC - [2009.03.13 10:11:42 | 000,121,856 | ---- | M] () -- c:\Programme\GrassSoft\Macro Expert\MacroServiceWnd.exe PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe ========== Modules (No Company Name) ========== MOD - [2011.08.17 11:49:17 | 000,400,440 | ---- | M] () -- C:\Users\****\AppData\Local\Google\Chrome\Application\13.0.782.215\ppGoogleNaClPluginChrome.dll MOD - [2011.08.17 11:49:15 | 004,118,072 | ---- | M] () -- C:\Users\****\AppData\Local\Google\Chrome\Application\13.0.782.215\pdf.dll MOD - [2011.08.17 11:47:49 | 000,104,520 | ---- | M] () -- C:\Users\****\AppData\Local\Google\Chrome\Application\13.0.782.215\avutil-50.dll MOD - [2011.08.17 11:47:48 | 000,203,848 | ---- | M] () -- C:\Users\****\AppData\Local\Google\Chrome\Application\13.0.782.215\avformat-52.dll MOD - [2011.08.17 11:47:47 | 001,846,344 | ---- | M] () -- C:\Users\****\AppData\Local\Google\Chrome\Application\13.0.782.215\avcodec-52.dll MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.03.02 12:40:51 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe MOD - [2009.03.13 10:11:42 | 000,121,856 | ---- | M] () -- c:\Programme\GrassSoft\Macro Expert\MacroServiceWnd.exe MOD - [2009.03.13 10:11:22 | 000,073,728 | ---- | M] () -- c:\Programme\GrassSoft\Macro Expert\mk_nt.DLL ========== Win32 Services (SafeList) ========== SRV - [2011.07.08 08:54:50 | 002,428,968 | ---- | M] (mobile concepts GmbH) [On_Demand | Stopped] -- C:\Programme\S.A.D\CyberGhost VPN\CGVPNCliService.exe -- (CGVPNCliSrvc) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.05.30 11:33:54 | 001,025,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\AVG\AVG10\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service) SRV - [2011.05.21 06:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.05.06 01:27:28 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd) SRV - [2010.11.21 11:49:24 | 000,247,608 | ---- | M] () [Disabled | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.03.13 10:48:40 | 000,211,968 | ---- | M] () [Auto | Running] -- c:\Programme\GrassSoft\Macro Expert\MacroService.exe -- (Macro Expert) SRV - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) ========== Driver Services (SafeList) ========== DRV - [2011.05.21 06:01:00 | 010,589,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2011.05.10 08:06:14 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl) DRV - [2011.04.14 21:28:30 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver) DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86) DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2011.02.22 08:12:50 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH) DRV - [2011.02.10 07:53:42 | 000,021,968 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim) DRV - [2011.02.10 07:53:40 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter) DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.02.25 16:51:02 | 000,025,216 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901) DRV - [2009.07.14 00:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr73.sys -- (netr73) DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD) DRV - [2009.06.18 19:45:02 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2004.08.13 09:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 47 ED 2A 43 26 12 CC 01 [binary data] IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..keyword.URL: "hxxp://search.avg.com/route/?d=4e214698&v=7.007.026.001&i=23&tp=ab&iy=b&ychte=de&lng=de&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\****\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\****\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011.08.09 08:06:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011.08.10 21:59:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.21 18:22:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.06 16:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions [2011.08.01 20:18:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\heh14eyu.default\extensions [2011.08.01 20:18:03 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\heh14eyu.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2011.06.10 14:55:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.06.10 14:55:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.08.09 08:06:09 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4 [2011.08.10 21:59:33 | 000,000,000 | ---D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="7.007.026.001" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="hxxp://www.avg.com" >) -- C:\PROGRAM FILES\AVG\AVG10\TOOLBAR\FIREFOX\AVG@IGEARED [2011.06.10 14:55:45 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.07.11 16:27:30 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.07.11 16:27:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.07.11 16:27:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.07.11 16:27:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.05.17 17:04:31 | 000,002,048 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml [2011.07.11 16:27:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.07.11 16:27:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.07.11 16:27:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programme\FlashFXP\IEFlash.dll (IniCom Networks, Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Programme\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) MsConfig - StartUpReg: Macro Manager - hkey= - key= - C:\Program Files\GrassSoft\Macro Expert\MacroManager.exe (GrassSoftware) MsConfig - StartUpReg: Messenger (Yahoo!) - hkey= - key= - C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) MsConfig - StartUpReg: PDFPrint - hkey= - key= - C:\Programme\PDF24\pdf24.exe (Geek Software GmbH) MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) MsConfig - State: "services" - 2 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.08.29 10:21:21 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe [2011.08.29 10:00:08 | 000,000,000 | ---D | C] -- C:\Program Files\Trojancheck 6 [2011.08.29 08:26:56 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{57C92783-687F-4EE8-B961-DED11E01384C} [2011.08.29 08:26:38 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{1B0429EE-B532-4DC2-AC09-6E5A76649CAF} [2011.08.28 16:44:45 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\sakika [2011.08.28 12:24:24 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{568D4B8A-7002-4496-8E02-59E88B99F683} [2011.08.28 00:24:00 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{49310F25-E7C2-4A70-A8BB-72920FF81A27} [2011.08.27 12:23:36 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{85EF37AF-18DA-47B8-8C1E-DA2D5AA2D673} [2011.08.27 12:23:25 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{F4B1E6B2-44F7-4003-B132-94493DB6A20D} [2011.08.26 18:14:19 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{AC1A422E-1F1D-4B0A-92EC-4237FEA60D34} [2011.08.26 18:14:08 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{426AC4C8-4489-43BB-8767-164EDBAA3B08} [2011.08.23 15:28:13 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\ichich [2011.08.21 20:52:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.08.21 20:50:59 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{26D003C1-6F6C-480B-A2A2-5DEB8F8B4CB7} [2011.08.21 20:50:46 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{BB7E1ABB-75B6-4337-A1DF-EDF14E18D4F3} [2011.08.21 20:18:08 | 000,192,512 | ---- | C] ( ) -- C:\Users\****\Desktop\flfe.exe [2011.08.21 20:15:27 | 000,000,000 | ---D | C] -- C:\Program Files\BIE Inc [2011.08.21 20:14:42 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\Flife [2011.08.21 18:27:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.08.21 18:26:42 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2011.08.21 18:26:41 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011.08.21 18:22:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2011.08.21 18:22:01 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime [2011.08.21 18:19:01 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2011.08.20 20:32:46 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{19ED89DF-74F3-4D2A-A3FC-D72EC477F116} [2011.08.20 08:32:22 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{0C7AA43C-46A7-468F-A0E8-5683C48739FA} [2011.08.20 08:32:11 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{D0177BFD-B430-43C8-A1BA-A3139CB2FDC5} [2011.08.19 20:31:40 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{4866D0E7-22E1-4A9C-834D-F1E3F7A53CB1} [2011.08.19 20:31:29 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{CC446616-34D5-429E-ACD4-9D31AD295128} [2011.08.19 20:29:05 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{44B21BCC-3EC1-4C9C-9BBC-7FE43ABFD693} [2011.08.19 13:20:05 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\tester [2011.08.19 12:07:29 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{610151EC-284F-4085-BEEE-AD7E5B0CD07F} [2011.08.19 12:07:19 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{9793F95C-FF0B-4F86-91D8-6C1AF58DBFC5} [2011.08.18 17:32:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Macro Expert [2011.08.18 17:14:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{1AB16E7F-B7DD-4018-BE87-5B6CB1DBF295} [2011.08.18 17:14:23 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{14DC5465-052A-4FA2-994D-3AD4D98C2E8C} [2011.08.18 11:40:14 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{AC4E4D8F-6592-44BC-8F51-F1D1B26790B5} [2011.08.18 11:40:04 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{95A7231C-8C2F-4F8E-80E1-65A3241DEF0F} [2011.08.18 10:40:46 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{5B14A045-8659-46C5-9372-A6E1465184E2} [2011.08.18 10:40:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{70E54419-F962-4571-A773-61EA2CB7137C} [2011.08.17 17:49:20 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{52931557-1BB6-4B44-9461-D2DA42EBCE68} [2011.08.17 17:47:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{7CD79636-0170-49D5-A0CF-FDE1442300CA} [2011.08.16 18:44:24 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{79FACF3F-4A8D-4281-BE5D-0473357BE050} [2011.08.16 18:44:12 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{0CCF020F-6840-47D6-A5D7-67C28B0975CB} [2011.08.16 13:37:44 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{55DFFD1D-A3A1-4BFA-8EA5-00B1CD51084A} [2011.08.16 13:37:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{445672BD-5BC1-46A8-AF24-297D9297D765} [2011.08.16 09:03:48 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{D1C7B24C-AA09-4199-9ACC-6A7D6570CB8A} [2011.08.16 09:03:30 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{59592641-A021-4D78-A167-0A1E6F69790C} [2011.08.15 18:32:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3 [2011.08.15 18:32:09 | 000,000,000 | ---D | C] -- C:\Program Files\AutoIt3 [2011.08.14 09:17:17 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{418E4C97-CDE7-4E79-9973-F2D5B451739B} [2011.08.14 09:17:06 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{884CCCC8-FF1E-4952-8424-DE05F10CFA2E} [2011.08.13 16:42:58 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{AA9EB071-84D1-445B-AC59-01A6A88ECAA6} [2011.08.13 16:42:47 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{ED26B221-E2F3-4C88-92FD-F7FA8F0A26F3} [2011.08.12 17:29:44 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{331BD63D-B792-480B-A980-AE7881DE98BF} [2011.08.12 17:29:16 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{5F1599B2-3E72-42E1-BC15-F208852591EB} [2011.08.11 17:18:08 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{2479B22B-F7BA-4D3E-A492-A48A78C4E2E0} [2011.08.11 17:17:54 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{C118855E-A749-44D7-8EA8-6447AEB64E08} [2011.08.10 11:28:14 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{347E383B-2C09-4E21-8139-FE50A740B1E2} [2011.08.10 11:27:57 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{56F59793-D650-4C60-A50C-EAB69AF09491} [2011.08.06 14:32:52 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{FCEB60E3-89ED-4E39-B191-229B7E658CA7} [2011.08.06 14:32:39 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{A2071532-564B-4506-B88C-5717EF1E122C} [2011.08.06 13:13:23 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{FAA9B185-5880-4EC6-8142-7ED19050C6CF} [2011.08.06 13:13:12 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{DA4F0FC8-FCF8-43E0-8D08-DCF818F0B9A7} [2011.08.05 12:34:05 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{F767C482-2309-40DD-AE28-15D35BDBC777} [2011.08.05 12:33:48 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{A06B132C-BF75-4D7D-AD6D-F7FF145DFAE1} [2011.08.04 17:55:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{F62A089D-1AEF-4A96-9FF1-3F03D37A63E8} [2011.08.04 17:55:22 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{A37E2A4E-E940-4160-99B2-1100FC0ADB4F} [2011.08.04 14:43:12 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{F7D731E4-2F2A-41F4-9B18-0CE2713419E8} [2011.08.04 14:42:55 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{6BC74546-72BF-41DA-AB30-46C8F046DE97} [2011.08.03 14:12:33 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{F0992140-E343-44B2-A7C8-6BD6CA028CA4} [2011.08.03 14:11:42 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{360824D4-8736-4572-83E9-5C80F6844A1D} [2011.07.31 12:03:32 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{90CF9AF4-D1DC-4A24-BCF6-2A6667A64F34} [2011.07.31 12:03:20 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{9E65097B-73D8-4DC9-A6B5-30028EB9B28C} [2011.07.30 10:38:02 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\{C48E4A01-0471-47A7-8457-89452A10C622} ========== Files - Modified Within 30 Days ========== [2011.08.29 10:26:08 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.08.29 10:26:08 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.08.29 10:26:08 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.08.29 10:26:08 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.08.29 10:21:00 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe [2011.08.29 10:19:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.08.29 10:19:17 | 1610,260,480 | -HS- | M] () -- C:\hiberfil.sys [2011.08.29 10:16:20 | 000,000,000 | ---- | M] () -- C:\Users\****\defogger_reenable [2011.08.29 09:55:02 | 130,381,365 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm [2011.08.29 09:32:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2197650363-2181668402-3619714588-1000UA.job [2011.08.29 08:33:31 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.08.29 08:33:31 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.08.29 04:32:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2197650363-2181668402-3619714588-1000Core.job [2011.08.28 17:01:45 | 000,041,003 | ---- | M] () -- C:\Users\****\Desktop\blp.png [2011.08.28 17:01:09 | 000,091,833 | ---- | M] () -- C:\Users\****\Desktop\jadasistso.png [2011.08.28 15:14:38 | 000,012,745 | ---- | M] () -- C:\Users\****\Desktop\emails für heller.ods [2011.08.28 13:12:57 | 000,025,137 | ---- | M] () -- C:\Users\****\Desktop\1_22.jpg [2011.08.28 13:12:43 | 000,014,921 | ---- | M] () -- C:\Users\****\Desktop\1_153.jpg [2011.08.27 12:37:13 | 000,217,618 | ---- | M] () -- C:\Users\****\Desktop\sdfsdfsdf.jpg [2011.08.27 12:37:09 | 000,221,067 | ---- | M] () -- C:\Users\****\Desktop\ausweiss.jpg [2011.08.26 20:12:03 | 000,006,567 | ---- | M] () -- C:\Users\****\Desktop\mitstupsi.jpg [2011.08.22 14:28:02 | 000,406,581 | ---- | M] () -- C:\Users\****\Desktop\piapiaaa.png [2011.08.21 18:28:53 | 000,002,479 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk [2011.08.21 18:27:25 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.08.21 18:22:17 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2011.08.21 00:25:33 | 000,036,284 | ---- | M] () -- C:\Users\****\Desktop\a.jpg [2011.08.20 21:46:27 | 000,043,054 | ---- | M] () -- C:\Users\****\Desktop\1_10.jpg [2011.08.20 21:45:29 | 000,030,906 | ---- | M] () -- C:\Users\****\Desktop\1_15.jpg [2011.08.18 17:32:51 | 000,001,155 | ---- | M] () -- C:\Users\Public\Desktop\Macro Expert.lnk [2011.08.15 23:48:02 | 000,065,996 | ---- | M] () -- C:\Users\****\Desktop\img059.jpg [2011.08.15 18:55:57 | 000,000,247 | ---- | M] () -- C:\Users\****\SciTE.session [2011.08.15 18:46:48 | 000,029,669 | ---- | M] () -- C:\Users\****\abbrev.properties [2011.08.15 18:33:47 | 000,015,167 | ---- | M] () -- C:\Users\****\abbrev.properties.bak [2011.08.11 20:07:52 | 000,000,000 | -H-- | M] () -- C:\Users\****\Documents\Default.rdp [2011.08.08 17:20:10 | 000,016,372 | ---- | M] () -- C:\Users\****\Desktop\Img67.jpg [2011.08.05 12:29:01 | 000,663,675 | -H-- | M] () -- C:\Users\****\AppData\Roaming\****log.dat ========== Files Created - No Company Name ========== [2011.08.29 10:16:20 | 000,000,000 | ---- | C] () -- C:\Users\****\defogger_reenable [2011.08.28 17:01:50 | 000,041,003 | ---- | C] () -- C:\Users\****\Desktop\blp.png [2011.08.28 17:01:16 | 000,091,833 | ---- | C] () -- C:\Users\****\Desktop\jadasistso.png [2011.08.28 15:14:36 | 000,012,745 | ---- | C] () -- C:\Users\****\Desktop\emails für heller.ods [2011.08.28 13:12:59 | 000,025,137 | ---- | C] () -- C:\Users\****\Desktop\1_22.jpg [2011.08.28 13:12:52 | 000,014,921 | ---- | C] () -- C:\Users\****\Desktop\1_153.jpg [2011.08.26 20:38:09 | 000,217,618 | ---- | C] () -- C:\Users\****\Desktop\sdfsdfsdf.jpg [2011.08.26 20:35:26 | 000,221,067 | ---- | C] () -- C:\Users\****\Desktop\ausweiss.jpg [2011.08.26 20:12:14 | 000,006,567 | ---- | C] () -- C:\Users\****\Desktop\mitstupsi.jpg [2011.08.22 14:28:02 | 000,406,581 | ---- | C] () -- C:\Users\****\Desktop\piapiaaa.png [2011.08.21 20:10:52 | 000,179,904 | ---- | C] () -- C:\Users\****\Desktop\Flife.rar [2011.08.21 18:28:53 | 000,002,479 | ---- | C] () -- C:\Users\Public\Desktop\Safari.lnk [2011.08.21 18:27:25 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.08.21 18:22:17 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2011.08.21 00:24:51 | 000,036,284 | ---- | C] () -- C:\Users\****\Desktop\a.jpg [2011.08.20 21:45:02 | 000,030,906 | ---- | C] () -- C:\Users\****\Desktop\1_15.jpg [2011.08.20 21:44:51 | 000,043,054 | ---- | C] () -- C:\Users\****\Desktop\1_10.jpg [2011.08.19 14:23:17 | 000,016,372 | ---- | C] () -- C:\Users\****\Desktop\Img67.jpg [2011.08.19 14:23:12 | 000,065,996 | ---- | C] () -- C:\Users\****\Desktop\img059.jpg [2011.08.18 17:32:51 | 000,001,155 | ---- | C] () -- C:\Users\Public\Desktop\Macro Expert.lnk [2011.08.15 18:46:48 | 000,015,167 | ---- | C] () -- C:\Users\****\abbrev.properties.bak [2011.08.15 18:38:35 | 000,000,247 | ---- | C] () -- C:\Users\****\SciTE.session [2011.08.15 18:33:47 | 000,029,669 | ---- | C] () -- C:\Users\****\abbrev.properties [2011.08.11 20:07:52 | 000,000,000 | -H-- | C] () -- C:\Users\****\Documents\Default.rdp [2011.07.21 04:04:21 | 000,264,192 | ---- | C] () -- C:\Users\****\AppData\Roaming\Svchost.bat [2011.06.08 23:01:32 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.06.08 23:00:02 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.05.06 13:57:16 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.05.06 01:24:24 | 001,589,248 | ---- | C] () -- C:\Windows\System32\libmysql_d.dll [2011.05.06 01:21:12 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.05.06 00:46:08 | 000,007,602 | ---- | C] () -- C:\Users\****\AppData\Local\Resmon.ResmonCfg [2009.07.14 10:47:43 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 10:47:43 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 06:33:53 | 000,410,064 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 04:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 04:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2009.04.14 07:43:32 | 000,154,144 | ---- | C] () -- C:\Windows\System32\RTLCPAPI.dll [2005.04.08 04:16:43 | 000,663,675 | -H-- | C] () -- C:\Users\****\AppData\Roaming\****log.dat [2004.08.13 09:56:20 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys ========== LOP Check ========== [2011.07.16 10:17:35 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\AVG10 [2011.07.30 10:16:16 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\FireFoxAdd0n [2011.05.06 01:43:07 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\FlashFXP [2011.05.27 12:32:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\GetRightToGo [2011.06.16 16:48:57 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Grasssoft [2011.08.28 13:35:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ICQ [2011.05.16 16:07:18 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\S.A.D [2011.05.11 14:07:41 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\TeamViewer [2009.07.14 06:53:46 | 000,023,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.07.18 04:54:41 | 000,000,000 | -H-D | M] -- C:\$AVG [2011.07.16 09:43:30 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.08.21 20:52:30 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.05.06 00:19:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.05.06 01:35:45 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.05.06 19:36:34 | 000,000,000 | ---D | M] -- C:\PFiles [2011.08.29 10:00:08 | 000,000,000 | R--D | M] -- C:\Program Files [2011.07.16 10:06:58 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.05.06 00:19:47 | 000,000,000 | -HSD | M] -- C:\Programme [2011.05.06 00:19:47 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.08.29 10:25:16 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.07.30 10:32:31 | 000,000,000 | R--D | M] -- C:\Users [2011.08.27 12:22:38 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe [2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-08-25 01:01:00 < End of report > Vielen Dank für Ihre Hilfe im voraus. Mit freundlichen Gruß Maik Behrent |
|
29.08.2011, 10:57
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  E-Mail Bundesamt für SicherheitZitat:
Wenn ja und es wurden Kundendaten gestohlen, dann glaub ich eher, dass der Server oder eine laufende Software (Webserver, SQL, ...) irgendwie angegriffen werden konnte. Was genau läuft auf diesem Server? Welches OS, welcher weiteren Komponenten und in welcher Version?
__________________ |
|
29.08.2011, 11:11
| #3 | |||
| | E-Mail Bundesamt für SicherheitZitat:
Zitat:
Es wurde auf unser Portal "zugegriffen" (Admin) bereich. Weites gehend alles gelöscht/umgeleitet. Es trudeln immer mehr "Kundenbeschwerden" ein so das wir gezwungen waren das Portal z.Z. zu deaktivieren. Das Bundesamt vermutete daher ein "Tastatur-Trojaner" Welches die Tastatur eingaben "mit schreibt" Zitat:
 |
|
29.08.2011, 11:30
| #4 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | E-Mail Bundesamt für SicherheitZitat:
Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu E-Mail Bundesamt für Sicherheit |
| adobe, autorun, avg, avg secure search, avg security toolbar, bho, bonjour, bundesamt, bundesamt für sicherheit, bundesamt für sicherheit in der informationstechnik, c:\windows\system32\rundll32.exe, computer, cyberghost, defender, e-mail, error, excel.exe, explorer, extras.txt, firefox, google, helper, hinweis, kunde, langs, logfile, nvlddmkm.sys, object, plug-in, realtek, registry, rundll, scan, secure search, security, senden, sicherheit, start menu, trojaner, version=1.0, webcheck, windows |
Linear-Darstellung
