| |
| |||||||
Log-Analyse und Auswertung: Log-Analyse nach Trojaner/Malware befall (Malware.Trace / Trojan.BHO)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.09.2011, 10:27
| #16 |
 |  Log-Analyse nach Trojaner/Malware befall (Malware.Trace / Trojan.BHO) Okay, hier nochmal ein OTL Log nach Deinstallation. Ist das System nun wieder clean? OTL Logfile: Code:
ATTFilter OTL logfile created on: 25.09.2011 11:01:14 - Run 2 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 478,17 Mb Total Physical Memory | 159,11 Mb Available Physical Memory | 33,28% Memory free 1,10 Gb Paging File | 0,79 Gb Available in Paging File | 72,27% Paging File free Paging file location(s): C:\pagefile.sys 720 1440 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 55,88 Gb Total Space | 38,42 Gb Free Space | 68,74% Space Free | Partition Type: NTFS Computer Name: WOLFGANGLG | User Name: Wolfgang | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.23 07:47:17 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\Downloads\OTL.exe PRC - [2011.09.18 10:57:35 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.05.27 16:23:00 | 004,999,976 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\Scrybe\scrybe.exe PRC - [2011.05.27 16:23:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\Scrybe\Service\ScrybeUpdater.exe PRC - [2011.04.27 18:13:24 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.04 19:34:31 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.05.12 22:00:48 | 000,102,400 | ---- | M] () -- C:\Programme\Clarus\Samsung SecretZone\MSSvc.exe PRC - [2008.12.16 21:59:50 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.06.15 13:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\bgsvcgen.exe PRC - [2006.10.05 18:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe PRC - [2006.06.01 18:54:34 | 000,335,872 | ---- | M] (LG Electronics Inc.) -- C:\Programme\LG Software\Battery Miser 2005\batterymiser.exe ========== Modules (No Company Name) ========== MOD - [2011.03.31 19:31:02 | 000,066,856 | ---- | M] () -- C:\Programme\Synaptics\SynTP\SynTPEnhPS.dll MOD - [2010.01.28 13:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009.05.12 22:00:48 | 000,282,624 | ---- | M] () -- C:\Programme\Clarus\Samsung SecretZone\MSMgrSDK.dll MOD - [2009.05.12 22:00:48 | 000,102,400 | ---- | M] () -- C:\Programme\Clarus\Samsung SecretZone\MSSvc.exe MOD - [2009.05.11 21:39:24 | 000,532,480 | ---- | M] () -- C:\Programme\Clarus\Samsung SecretZone\MSMgrSDK.GE MOD - [2009.05.11 21:39:20 | 000,106,496 | ---- | M] () -- C:\Programme\Clarus\Samsung SecretZone\MSUtilSDK.dll MOD - [2008.04.14 04:22:16 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll MOD - [2007.06.24 17:04:14 | 002,314,240 | ---- | M] () -- C:\Programme\K-Lite Codec Pack\ffdshow\ffdshow.ax MOD - [2006.06.01 18:54:40 | 000,114,688 | ---- | M] () -- C:\WINDOWS\system32\bmpsap.dll MOD - [2004.09.08 13:45:58 | 000,368,128 | ---- | M] () -- C:\Programme\Filzip\fzshext.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (vsmon) SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011.09.18 10:57:35 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.05.27 16:23:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) [Auto | Running] -- C:\Programme\Synaptics\Scrybe\Service\ScrybeUpdater.exe -- (ScrybeUpdater) SRV - [2011.04.27 18:13:24 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009.05.12 22:00:48 | 000,102,400 | ---- | M] () [Auto | Running] -- C:\Programme\Clarus\Samsung SecretZone\MSSvc.exe -- (MSR Service) SRV - [2008.12.16 21:59:50 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2007.06.15 13:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\WINDOWS\System32\bgsvcgen.exe -- (bgsvcgen) SRV - [2006.10.05 18:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2004.10.22 02:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.07.28 14:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.03.09 06:31:02 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | Unknown | Running] -- -- (mvd20) DRV - [2011.09.18 18:59:34 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.09.18 18:59:34 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.07.15 16:07:51 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K) DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.21 14:25:30 | 000,012,800 | ---- | M] () [Kernel | System | Running] -- C:\Programme\Clarus\Samsung SecretZone\mdf15.sys -- (mdf15) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.12.17 08:02:06 | 000,023,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService) DRV - [2008.12.17 08:01:42 | 006,364,440 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam E3500(UVC) DRV - [2008.12.17 08:01:20 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2008.12.17 08:00:12 | 000,768,024 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS) DRV - [2008.12.16 21:58:54 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2007.09.10 09:50:56 | 000,457,984 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PAC7302.SYS -- (PAC7302) DRV - [2007.05.02 04:52:00 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2006.11.28 21:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.06.02 15:37:58 | 000,236,800 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RT2500.sys -- (RT2500) DRV - [2005.09.07 09:35:00 | 000,240,384 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2005.08.24 10:37:02 | 000,007,552 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgsnd_filter.sys -- (lgsnd_filter) DRV - [2005.07.20 09:26:34 | 000,015,232 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Ndisipo.sys -- (Ndisipo) DRV - [2005.06.19 22:53:24 | 000,966,272 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) DRV - [2005.06.07 22:44:36 | 001,235,968 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2004.03.24 04:22:26 | 000,138,396 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pfc027.sys -- (SoC PC-Camera Service) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2105: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2163: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1212: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.10 21:14:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.05.15 19:20:03 | 000,000,000 | ---D | M] [2009.03.11 08:46:25 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Mozilla\Extensions [2011.05.15 18:42:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Mozilla\Firefox\Profiles\ghko0df0.default\extensions [2010.05.28 09:37:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Mozilla\Firefox\Profiles\ghko0df0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.05.15 18:42:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.05.13 13:31:27 | 000,000,000 | ---D | M] (Long Titles) -- C:\PROGRAMME\HAUFE\IDESK\IDESKBROWSER\EXTENSIONS\{C24AECC7-7C95-507F-D71F-155CB86656DF} [2011.09.10 21:14:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.05.15 19:19:46 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.15 19:19:47 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.05.15 19:19:47 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.05.15 19:19:47 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.15 19:19:48 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.15 19:19:48 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.02.09 19:11:42 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [batterymiser] C:\Programme\LG Software\Battery Miser 2005\batterymiser.exe (LG Electronics Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Scrybe.lnk = C:\WINDOWS\Installer\{147DFAD8-34C3-4DE1-9FCA-ACEFDE9EF810}\NewShortcut11_8ACB210B42E44145A8C31F8E3DD765A3.exe (Acresso Software Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129140124823 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab (Java Plug-in 1.5.0_05) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20CA7327-51B5-47B7-B0EA-0EDAD073D35D}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.) O18 - Protocol\Handler\haufereader - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Wolfgang\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Wolfgang\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {26F5978F-6493-4ee3-B114-C0C3ACCF9D4D} - C:\WINDOWS\system32\bmpsap.dll () O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005.08.16 11:42:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell\AutoRun\command - "" = E:\autoplay.exe lgcenter.ini O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^hp psc 1000 series.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe - (Hewlett-Packard Co.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^hpoddt01.exe.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe - (Hewlett-Packard) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Logitech Desktop Messenger.lnk - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe - (Logitech Inc.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PHOTOfunSTUDIO 5.1 HD Edition.lnk - C:\Programme\Gemeinsame Dateien\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe - (Panasonic Corporation) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Franziska^Startmenü^Programme^Autostart^Microsoft Office Outlook starten.lnk - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE - (Microsoft Corporation) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Wolfgang^Startmenü^Programme^Autostart^Samsung Auto Backup Guage.lnk - C:\Programme\Clarus\Samsung Auto Backup\ISFGuage.exe - (Clarus, Inc.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Wolfgang^Startmenü^Programme^Autostart^Samsung Auto Backup Real-Time Daemon.lnk - C:\Programme\Clarus\Samsung Auto Backup\ISFRealTimeD.exe - (Clarus, Inc.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Wolfgang^Startmenü^Programme^Autostart^Samsung Auto Backup Scheduler.lnk - C:\Programme\Clarus\Samsung Auto Backup\ISFTimerD.exe - (Clarus, Inc.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Wolfgang^Startmenü^Programme^Autostart^siszyd32.exe - - File not found MsConfig - StartUpReg: AGRSMMSG - hkey= - key= - C:\WINDOWS\AGRSMMSG.exe (Agere Systems) MsConfig - StartUpReg: ATIPTA - hkey= - key= - C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.) MsConfig - StartUpReg: CNAP2 Launcher - hkey= - key= - File not found MsConfig - StartUpReg: COMODO Firewall Pro - hkey= - key= - File not found MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found MsConfig - StartUpReg: HP Component Manager - hkey= - key= - File not found MsConfig - StartUpReg: HP Software Update - hkey= - key= - File not found MsConfig - StartUpReg: HPDJ Taskbar Utility - hkey= - key= - File not found MsConfig - StartUpReg: ICQ - hkey= - key= - File not found MsConfig - StartUpReg: iTunesHelper - hkey= - key= - File not found MsConfig - StartUpReg: KeybdUtility - hkey= - key= - C:\Archivos de programa\LG Software\On Screen Display\Hotkey.exe (LG Electronics) MsConfig - StartUpReg: LexwareInfoService - hkey= - key= - C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG) MsConfig - StartUpReg: LG Intelligent Update - hkey= - key= - C:\Programme\lg_swupdate\autoupdate.exe (CST) MsConfig - StartUpReg: LogitechQuickCamRibbon - hkey= - key= - C:\Programme\Logitech\QuickCam\Quickcam.exe () MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation) MsConfig - StartUpReg: PAC7302_Monitor - hkey= - key= - C:\WINDOWS\PixArt\PAC7302\Monitor.exe (PixArt Imaging Incorporation) MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Inc.) MsConfig - StartUpReg: Skype - hkey= - key= - C:\Programme\Skype\Phone\Skype.exe (Skype Technologies S.A.) MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) MsConfig - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) MsConfig - StartUpReg: SynTPLpr - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: AppMgmt - File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm () Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.) Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll () Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll () Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.09.24 19:38:04 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Wolfgang\Recent [2011.09.24 15:47:23 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Wolfgang\Startmenü\Programme\Verwaltung [2011.09.20 07:41:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Synaptics [2011.09.20 07:35:46 | 000,120,104 | ---- | C] (Synaptics Incorporated) -- C:\WINDOWS\System32\SynTPCo9.dll [2011.09.20 07:33:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Scrybe [2011.09.20 07:33:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Synaptics [2011.09.19 18:24:37 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2011.09.18 19:06:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Malwarebytes [2011.09.18 19:06:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2011.09.18 19:06:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2011.09.18 19:05:20 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.09.18 19:05:13 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.09.04 15:28:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Wolfgang\Desktop\ebay-Verkauf [316 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [159 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.24 19:48:51 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.09.24 19:48:50 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.09.24 19:43:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.09.24 19:41:41 | 000,000,206 | ---- | M] () -- C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\cc_20110924_194136.reg [2011.09.24 19:41:25 | 000,021,966 | ---- | M] () -- C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\cc_20110924_194119.reg [2011.09.24 19:35:01 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.09.24 19:29:51 | 000,002,293 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Scrybe.lnk [2011.09.23 08:22:01 | 000,000,041 | ---- | M] () -- C:\WINDOWS\Filzip.ini [2011.09.20 07:36:58 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf [2011.09.20 07:36:51 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf [2011.09.18 19:06:11 | 000,000,794 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.09.18 18:59:34 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2011.09.18 18:59:34 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2011.09.10 22:03:31 | 000,008,455 | ---- | M] () -- C:\Dokumente und Einstellungen\Wolfgang\Desktop\-snm-0177507459-1314002575-0132c00005-0000004972-1315684942-enm-Antrag.pdf [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [316 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [159 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.24 19:41:38 | 000,000,206 | ---- | C] () -- C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\cc_20110924_194136.reg [2011.09.24 19:41:22 | 000,021,966 | ---- | C] () -- C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\cc_20110924_194119.reg [2011.09.20 07:36:58 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_SynTP_01009.Wdf [2011.09.20 07:36:51 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf [2011.09.20 07:33:56 | 000,002,293 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Scrybe.lnk [2011.09.18 19:06:11 | 000,000,794 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2011.09.10 22:03:31 | 000,008,455 | ---- | C] () -- C:\Dokumente und Einstellungen\Wolfgang\Desktop\-snm-0177507459-1314002575-0132c00005-0000004972-1315684942-enm-Antrag.pdf [2010.12.27 14:10:42 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini [2010.12.27 14:10:41 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat [2010.12.27 14:10:41 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat [2010.12.27 14:10:41 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat [2010.12.27 14:10:41 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat [2010.12.27 14:10:41 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat [2010.12.27 14:10:41 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat [2010.12.27 14:10:41 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat [2010.12.27 14:10:41 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat [2010.12.27 14:10:41 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat [2010.12.27 14:10:41 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat [2010.12.27 14:10:41 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat [2010.12.27 14:10:41 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat [2010.12.27 14:10:41 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat [2010.12.27 14:10:41 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat [2010.12.27 14:10:41 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat [2010.12.27 14:10:41 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat [2010.12.27 14:10:40 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat [2010.12.27 14:10:40 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat [2010.01.01 20:06:08 | 000,000,120 | ---- | C] () -- C:\WINDOWS\CIS_Setup_3.13.119746.572_XP_Vista_x32.INI [2009.07.15 15:56:32 | 000,020,369 | ---- | C] () -- C:\WINDOWS\hpoins01.dat.temp [2009.07.15 15:56:32 | 000,016,622 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat.temp [2009.04.08 21:29:53 | 000,005,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Wolfgang\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.03.25 15:47:06 | 000,081,110 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2009.03.24 16:26:14 | 000,000,354 | ---- | C] () -- C:\WINDOWS\System32\Remover.ini [2009.03.22 20:13:18 | 000,138,396 | ---- | C] () -- C:\WINDOWS\System32\drivers\pfc027.sys [2009.03.22 20:13:18 | 000,011,170 | ---- | C] () -- C:\WINDOWS\System32\PA207Usd.dll [2009.03.15 19:59:58 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll [2009.03.15 19:51:33 | 000,020,454 | ---- | C] () -- C:\WINDOWS\hpoins01.dat [2009.03.15 19:51:33 | 000,016,622 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat [2009.03.13 09:40:48 | 000,319,488 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe [2009.03.13 09:40:48 | 000,295,018 | ---- | C] () -- C:\WINDOWS\System32\Install6x.dll [2008.12.16 21:58:54 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2008.12.16 21:50:56 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLgFT.dll [2008.11.30 17:37:51 | 000,000,041 | ---- | C] () -- C:\WINDOWS\System32\Filzip.ini [2008.10.08 17:50:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini [2008.10.08 17:50:14 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2008.10.08 17:50:14 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2008.06.28 09:49:29 | 000,007,239 | ---- | C] () -- C:\WINDOWS\lg_up.ini [2007.06.30 19:38:47 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2007.06.30 19:38:47 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2007.06.30 19:38:46 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007.06.30 19:38:43 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2007.03.20 17:44:02 | 000,000,566 | ---- | C] () -- C:\WINDOWS\System32\SP7302.ini [2006.09.18 13:22:00 | 000,004,586 | ---- | C] () -- C:\WINDOWS\hpdj3500.ini [2006.02.09 19:16:12 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.01.23 22:09:44 | 000,004,212 | ---- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2005.11.04 18:30:07 | 000,000,025 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2005.10.13 01:52:40 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005.10.13 01:45:49 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI [2005.10.12 22:14:03 | 000,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini [2005.10.12 20:09:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2005.10.12 20:08:49 | 000,099,970 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe [2005.10.12 20:08:33 | 000,003,542 | ---- | C] () -- C:\WINDOWS\mozver.dat [2005.08.16 15:27:06 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005.08.16 14:08:24 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\lgsnd_filter.sys [2005.08.16 13:37:40 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\bmpsap.dll [2005.08.16 13:34:02 | 000,094,574 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2005.08.16 13:33:30 | 000,001,403 | ---- | C] () -- C:\WINDOWS\LG Image.ini [2005.08.16 12:34:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2005.08.16 12:33:51 | 000,124,520 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2005.08.16 11:56:46 | 000,000,702 | ---- | C] () -- C:\WINDOWS\lgcenter.ini [2005.08.16 11:44:37 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2005.08.16 11:40:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2005.08.16 11:27:49 | 000,001,076 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2005.08.16 11:27:35 | 000,452,966 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2005.08.16 11:27:35 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2005.08.16 11:27:35 | 000,081,746 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2005.08.16 11:27:35 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2005.08.16 11:27:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2005.08.16 11:27:18 | 000,436,016 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2005.08.16 11:27:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2005.08.16 11:27:18 | 000,068,912 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2005.08.16 11:27:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2005.08.16 11:27:17 | 000,004,502 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2005.08.16 11:27:16 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2005.08.16 11:27:14 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2005.08.16 11:27:10 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2005.08.16 11:27:10 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2005.08.16 11:27:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2005.08.16 11:26:58 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2005.02.17 12:31:58 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll [2005.02.17 12:31:58 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2005.02.17 12:31:58 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2005.02.17 12:31:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2004.01.13 19:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll [2003.02.20 15:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI ========== LOP Check ========== [2010.05.13 13:32:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve [2010.08.05 16:05:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canon [2009.12.28 14:29:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Clarus [2010.05.13 13:31:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe [2008.07.01 19:02:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2010.05.13 13:40:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware [2010.12.27 14:20:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Panasonic [2011.09.20 07:56:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Synaptics [2008.12.25 13:00:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom [2009.03.11 09:07:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software [2009.03.11 09:04:07 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357} [2010.05.26 17:09:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Haufe [2009.03.25 15:45:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Leadertech [2010.05.13 13:39:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Lexware [2011.09.20 07:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Synaptics [2009.03.11 09:05:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\TuneUp Software [2009.03.15 16:59:00 | 000,000,112 | ---- | M] () -- C:\WINDOWS\Tasks\Critical Battery Alarm Program.job [2010.08.05 16:13:10 | 000,000,340 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1247666893.job [2009.03.15 16:59:00 | 000,000,112 | ---- | M] () -- C:\WINDOWS\Tasks\Low Battery Alarm Program.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.01.22 22:53:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Adobe [2010.01.22 22:57:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\AdobeUM [2009.03.11 08:58:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Apple Computer [2010.11.04 19:43:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Avira [2009.04.08 21:21:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\DivX [2010.06.01 22:36:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Google [2010.05.26 17:09:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Haufe [2005.08.16 13:41:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Help [2009.07.15 16:09:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Hewlett-Packard [2005.08.16 11:42:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Identities [2009.03.13 09:40:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\InstallShield [2009.03.25 15:45:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Leadertech [2010.05.13 13:39:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Lexware [2009.03.11 08:47:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Macromedia [2011.09.18 19:06:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Malwarebytes [2011.05.09 11:41:49 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Microsoft [2009.03.11 08:46:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Mozilla [2009.07.20 16:55:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Real [2011.05.15 19:23:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Skype [2009.06.27 16:21:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun [2005.08.16 13:38:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Symantec [2011.09.20 07:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Synaptics [2009.03.11 09:05:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\TuneUp Software < %APPDATA%\*.exe /s > [2009.06.22 19:09:41 | 001,915,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe < %SYSTEMDRIVE%\*.exe > [2009.12.25 19:45:49 | 031,079,672 | ---- | M] () -- C:\avira_antivir_personal_de.exe < MD5 for: AGP440.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008.07.09 23:02:13 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys [2008.07.09 23:02:13 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008.07.09 23:02:13 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004.08.04 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys [2008.07.09 23:02:13 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2010.01.18 12:15:22 | 000,043,520 | ---- | M] (Panasonic Corporation) MD5=43D4AAF044843D801F70861BF51C7DB2 -- C:\Programme\Panasonic\PHOTOfunSTUDIO 5.1 HD\Core\EventLog\EventLog.dll [2010.01.18 12:15:22 | 000,043,520 | ---- | M] (Panasonic Corporation) MD5=43D4AAF044843D801F70861BF51C7DB2 -- C:\Programme\Panasonic\PHOTOfunSTUDIO 5.1 HD\Core\Spec\AVCHD\BDCore\EventLog.dll < MD5 for: NETLOGON.DLL > [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll < MD5 for: USER32.DLL > [2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2004.08.04 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2005.08.16 13:33:17 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2005.08.16 13:33:17 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2005.08.16 13:33:17 | 000,425,984 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [316 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < > < End of report > [/CODE]
__________________ Gruß Dennis |
|
26.09.2011, 10:22
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Log-Analyse nach Trojaner/Malware befall (Malware.Trace / Trojan.BHO) Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Code:
ATTFilter :OTL
SRV - File not found [Auto | Stopped] -- -- (vsmon)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.08.16 11:42:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ece5ff82-0e48-11da-b1c3-806d6172696f}\Shell\AutoRun\command - "" = E:\autoplay.exe lgcenter.ini
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ |
|
| Themen zu Log-Analyse nach Trojaner/Malware befall (Malware.Trace / Trojan.BHO) |
| anti-malware, antimalware, befall, browser, code, dateien, dinge, ebanking, einstellungen, email, erhalte, explorer, helper, icq, link, logfile, malwarebytes, microsoft, notebook, onlinebanking, programme, service, software, start, trojan.bho, version |
Linear-Darstellung
