| |
| |||||||
Log-Analyse und Auswertung: Avira Antivir meldet "EXP/CVE-2010-0840.AC' [exploit]"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.09.2011, 14:46
| #1 |
| | ![Avira Antivir meldet "EXP/CVE-2010-0840.AC' [exploit]" - Standard](images/icons/icon1.gif){kind=icon} Avira Antivir meldet "EXP/CVE-2010-0840.AC' [exploit]" Hallo zusammen, mein Avira hat gestern "EXP/CVE-2010-0840.AC" entdeckt (und zwar in 'C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\212c77e4-70573399'). Ich hab den Fund darauf in Quarantäne verschoben wie es mit Avira empfohlen hat, danach Java deinstalliert, die neuste Version installiert (V.6 update 27) und CCleaner laufen lassen. Jetzt habe ich allerdings nach etwas googlen (noch mehr) Sorge, dass es sich hierbei doch um eine ernstere Sache handelt (Passwörter usw.) und weiss nicht recht, wie ich mich weiter verhalten soll. Ich habe meine wichtigsten Passwörter (PayPal Ebay usw.) schon mal von einem sauberen Rechner aus geändert, aber die Frage ist, ob ich mein System neu aufsetzen bzw. was ich überhaupt tun muss/soll. Ich habe ansonsten keinerlei Probleme mit dem Rechner, lediglich meine WLAN-Verbindung ist häufig unterbrochen (trotz guter Signalstärke) bzw. mein Netzwerk ist für eine ca. eine Minute aus der Liste der verfügbaren verschwunden und taucht dann wieder mit voller Signalstärke auf (falls das relevant ist); sonst läuft alles normal. Vielen Dank schonmal im Voraus! (ich hoffe die Logfiles und meine Infos stimmen alle so, ist das erste Mal, dass ich hier um Rat frage  ) OTL: OTL logfile created on: 29.09.2011 13:40:17 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Sebastian\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,93 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 66,70% Memory free 6,06 Gb Paging File | 5,15 Gb Available in Paging File | 84,93% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 220,88 Gb Total Space | 109,62 Gb Free Space | 49,63% Space Free | Partition Type: NTFS Computer Name: SEBASTIAN-PC | User Name: Sebastian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.29 13:39:29 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Downloads\OTL.exe PRC - [2011.07.01 08:24:40 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.05.25 22:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2011.05.04 10:32:57 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.05 15:39:32 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.02.06 18:02:14 | 000,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2008.08.04 11:16:46 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (GoogleDesktopManager-071508-051939) SRV - File not found [On_Demand | Stopped] -- -- (FLEXnet Licensing Service) SRV - [2011.07.01 08:24:40 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.05.04 10:32:57 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.04.25 23:34:00 | 003,709,992 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.02.06 18:02:14 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets) ========== Driver Services (SafeList) ========== DRV - [2011.07.01 08:24:42 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.01 08:24:42 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.05.17 13:45:35 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2010.01.13 17:37:41 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2009.11.16 14:05:42 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009.07.30 12:01:09 | 000,386,560 | ---- | M] (TASCAM) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tascusb2.sys -- (TASCAM_US122144) DRV - [2009.07.30 12:01:09 | 000,033,792 | ---- | M] (TASCAM) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tscusb2a.sys -- (TASCAM_US122L_MK2_WDM) DRV - [2009.07.30 12:01:09 | 000,020,992 | ---- | M] (TASCAM) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tscusb2m.sys -- (TASCAM_US122L_MK2_MIDI) DRV - [2009.05.11 10:19:11 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\Haspnt.sys -- (Haspnt) DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.01.08 08:04:02 | 000,015,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Users\SEBAST~1\AppData\Local\Temp\ddxgb.sys -- (ddxgb) DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2008.08.06 10:26:08 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.11.08 07:10:00 | 000,288,768 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B) DRV - [2007.01.18 18:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.11.22 10:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\system32\drivers\hardlock.sys -- (Hardlock) DRV - [2006.11.17 10:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid) DRV - [2006.11.10 16:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.packardbell.com/?id=9283 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.08 11:25:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.18 11:54:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.14\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.07 14:50:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.14\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.02.07 17:52:27 | 000,000,000 | ---D | M] [2010.11.10 12:25:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian\AppData\Roaming\mozilla\Extensions [2010.11.10 12:25:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.09.29 13:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian\AppData\Roaming\mozilla\Firefox\Profiles\pjzbvqq3.default\extensions [2011.07.07 15:15:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sebastian\AppData\Roaming\mozilla\Firefox\Profiles\pjzbvqq3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.09.28 18:22:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\USERS\SEBASTIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJZBVQQ3.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI [2011.09.08 11:25:10 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.08.12 06:19:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.08.12 06:14:12 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.08.12 06:19:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.08.12 06:19:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.08.12 06:19:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.08.12 06:19:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.09.06 13:18:02 | 000,000,789 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No CLSID value found. O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found. O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found. O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Key error. File not found O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Key error. File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - Reg Error: Key error. File not found O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2431ADA2-8A6E-4AC2-A1F4-E4F6BE1CB880}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4C39CE3-743B-4CFA-A4CF-1F464E1C01AF}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{49663573-8134-11e0-81db-0017c4433667}\Shell - "" = AutoRun O33 - MountPoints2\{49663573-8134-11e0-81db-0017c4433667}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{5ff8329e-de64-11dd-b7ae-0017c4433667}\Shell\AutoRun\command - "" = E:\wdsync.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.3 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.3 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.09.19 17:24:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\AnvSoft [2011.09.19 17:17:58 | 000,000,000 | ---D | C] -- C:\Program Files\Emicsoft Studio [2011.09.09 11:08:59 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\dvdcss [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.29 13:37:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.09.29 13:37:24 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.09.29 13:37:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.09.29 13:36:58 | 3146,670,080 | -HS- | M] () -- C:\hiberfil.sys [2011.09.29 13:35:16 | 000,000,020 | ---- | M] () -- C:\Users\Sebastian\defogger_reenable [2011.09.29 13:32:26 | 000,050,477 | ---- | M] () -- C:\Users\Sebastian\Desktop\Defogger.exe [2011.09.29 13:29:59 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator-Sebastian.job [2011.09.29 13:29:59 | 000,000,348 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie-Sebastian.job [2011.09.27 15:21:27 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.09.27 15:21:27 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.09.27 15:21:27 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.09.27 15:21:27 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.09.22 18:42:31 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2011.09.16 15:00:20 | 000,360,303 | ---- | M] () -- C:\Users\Sebastian\Desktop\Semesterticket_NRW_VRR.pdf [2011.09.10 12:46:46 | 000,132,597 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende.bak [2011.09.10 12:31:45 | 000,127,447 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-02.bak [2011.09.10 12:16:45 | 000,126,761 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-03.bak [2011.09.10 11:54:16 | 000,126,273 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-04.bak [2011.09.10 11:39:16 | 000,061,312 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-05.bak [2011.09.10 11:24:15 | 000,043,156 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-06.bak [2011.09.10 11:09:15 | 000,042,937 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-07.bak [2011.09.10 10:54:15 | 000,030,855 | ---- | M] () -- C:\Users\Sebastian\KVM_mit ende-08.bak [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.08.31 11:10:02 | 000,000,177 | ---- | M] () -- C:\Users\Sebastian\Desktop\nike stefan.url [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.29 13:34:44 | 000,000,020 | ---- | C] () -- C:\Users\Sebastian\defogger_reenable [2011.09.29 13:32:25 | 000,050,477 | ---- | C] () -- C:\Users\Sebastian\Desktop\Defogger.exe [2011.09.16 15:00:18 | 000,360,303 | ---- | C] () -- C:\Users\Sebastian\Desktop\Semesterticket_NRW_VRR.pdf [2011.09.10 10:54:15 | 000,132,597 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende.bak [2011.09.10 10:54:15 | 000,127,447 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-02.bak [2011.09.10 10:54:15 | 000,126,761 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-03.bak [2011.09.10 10:54:15 | 000,126,273 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-04.bak [2011.09.10 10:54:15 | 000,061,312 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-05.bak [2011.09.10 10:54:15 | 000,043,156 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-06.bak [2011.09.10 10:54:15 | 000,042,937 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-07.bak [2011.09.10 10:54:15 | 000,030,855 | ---- | C] () -- C:\Users\Sebastian\KVM_mit ende-08.bak [2011.08.31 11:09:55 | 000,000,177 | ---- | C] () -- C:\Users\Sebastian\Desktop\nike stefan.url [2011.08.24 11:31:18 | 000,000,132 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.08.10 13:25:46 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe [2011.08.10 13:04:47 | 000,000,296 | ---- | C] () -- C:\Windows\pwc65.INI [2011.08.10 13:04:38 | 000,000,160 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\history.PDF.pwcdat [2011.03.04 13:59:19 | 000,002,892 | ---- | C] () -- C:\Windows\System32\audcon.sys [2011.03.04 13:40:10 | 000,000,045 | ---- | C] () -- C:\Windows\System32\SYNSOPOS.exe.cfg [2011.03.04 13:40:08 | 000,086,016 | ---- | C] () -- C:\Windows\System32\SYNSOPOS.exe [2011.02.24 21:15:30 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2010.12.24 21:57:49 | 000,000,036 | -H-- | C] () -- C:\Users\Sebastian\AppData\Roaming\swk.ini [2010.12.17 16:11:51 | 000,000,132 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\Adobe PNG Format CS5 Prefs [2010.06.11 12:59:26 | 000,000,012 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\qcopjv.dat [2010.03.29 14:39:21 | 000,000,067 | ---- | C] () -- C:\Windows\wininit.ini [2009.12.27 14:51:39 | 000,000,338 | ---- | C] () -- C:\Windows\d3xp.ini [2009.11.24 14:36:56 | 000,000,331 | ---- | C] () -- C:\Windows\doom3.ini [2009.11.16 14:06:01 | 000,271,360 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2009.11.16 14:05:42 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2009.10.27 13:23:45 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2009.10.27 13:23:44 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2009.10.27 13:23:44 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2009.10.27 13:19:58 | 000,000,720 | ---- | C] () -- C:\Windows\SIERRA.INI [2009.09.24 11:24:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.24 11:24:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.06.25 11:45:43 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini [2009.06.25 11:24:23 | 000,001,024 | ---- | C] () -- C:\ProgramData\imgpdf2.dll [2009.05.25 11:52:48 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI [2009.05.11 10:45:06 | 000,000,287 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\VersionChecker_14.xml [2009.05.11 10:19:11 | 000,000,383 | ---- | C] () -- C:\Windows\System32\haspdos.sys [2009.01.10 15:24:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2008.12.21 18:30:16 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.12.19 19:59:46 | 000,120,832 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.12.19 19:57:54 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008.12.18 14:17:22 | 000,010,826 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\wklnhst.dat [2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2008.05.23 13:06:41 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.05.23 13:06:41 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.05.23 13:06:41 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.05.23 13:06:41 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2008.05.23 13:00:22 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.05.23 12:59:21 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2008.05.23 12:59:21 | 000,495,376 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2008.05.23 12:59:21 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1527.dll [2008.05.23 12:59:21 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin [2008.05.23 03:49:16 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.05.23 03:41:24 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 003,675,512 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2002.11.01 11:51:31 | 000,905,290 | ---- | C] () -- C:\Windows\System32\libmmd.dll ========== LOP Check ========== [2010.05.30 15:03:53 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\7B582287F8B6B9BC4A0C0B93EC46A4A1 [2011.09.19 17:24:35 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\AnvSoft [2011.02.12 12:44:47 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Audacity [2010.12.17 16:18:04 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2009.10.12 14:23:31 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Command & Conquer 3 Tiberium Wars [2010.12.09 12:57:07 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Cool Record Edit Pro [2010.05.17 18:07:38 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\DAEMON Tools Lite [2011.09.29 13:38:09 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Dropbox [2010.08.03 10:47:16 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\DVDVideoSoftIEHelpers [2010.05.31 18:00:29 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\FOG Downloader [2010.12.09 12:55:53 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Free Sound Recorder 2010 [2011.05.02 21:12:05 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\FreeAudioPack [2010.03.31 12:46:58 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\FreeDoko [2011.08.10 13:36:57 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\GetRightToGo [2010.03.29 14:23:17 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\HDRsoft [2011.08.24 11:26:10 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\inkscape [2009.10.27 13:28:38 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\InterTrust [2010.12.26 15:43:44 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\KlebezettelNG [2009.05.11 10:43:57 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Nemetschek [2009.12.03 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\OpenOffice.org [2008.12.18 14:11:00 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Packard Bell [2010.05.30 18:27:02 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\PanoramaStudio2 [2011.08.10 13:47:07 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Passware [2011.08.10 13:18:25 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\PWC [2011.03.07 13:32:32 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Soundbytes [2010.12.17 13:22:03 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011.03.04 14:07:39 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Steinberg [2009.01.07 14:05:22 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Template [2010.11.10 12:25:07 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Thunderbird [2010.01.25 11:45:37 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\UDC Profiles [2011.03.04 14:07:39 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\VST3 Presets [2011.05.20 15:54:42 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Waves Audio [2011.03.07 15:21:26 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Yellow Tools [2011.09.29 13:29:59 | 000,000,348 | ---- | M] () -- C:\Windows\Tasks\Erweiterte Garantie-Sebastian.job [2011.09.29 13:29:59 | 000,000,348 | ---- | M] () -- C:\Windows\Tasks\Recovery DVD Creator-Sebastian.job [2011.09.29 13:36:13 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.09.29 13:20:56 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2010.03.22 17:43:14 | 000,000,000 | -HSD | M] -- C:\boot [2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2008.11.17 14:37:36 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2008.05.23 12:52:33 | 000,000,000 | ---D | M] -- C:\drivers [2008.05.23 03:39:38 | 000,000,000 | ---D | M] -- C:\Intel [2008.05.23 04:02:32 | 000,000,000 | RH-D | M] -- C:\MSOCache [2008.01.21 04:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.09.19 17:35:45 | 000,000,000 | R--D | M] -- C:\Program Files [2011.08.10 14:34:00 | 000,000,000 | -H-D | M] -- C:\ProgramData [2008.11.17 14:37:36 | 000,000,000 | -HSD | M] -- C:\Programme [2011.08.17 19:56:06 | 000,000,000 | ---D | M] -- C:\sebix [2011.09.29 13:44:25 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.03.29 15:49:08 | 000,000,000 | ---D | M] -- C:\The Place to be [2011.09.29 13:20:15 | 000,000,000 | R--D | M] -- C:\Users [2011.09.20 10:30:06 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: REGEDIT.EXE > [2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe [2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-09-28 16:31:20 < End of report > Anhang 22684 |
| Themen zu Avira Antivir meldet "EXP/CVE-2010-0840.AC' [exploit]" |
| adobe, antivir, autorun, avira, bho, browser, c:\windows\system32\rundll32.exe, defender, desktop, ebay, error, erste mal, firefox, format, frage, google, home, intranet, mozilla thunderbird, netzwerk, neu aufsetzen, realtek, registry, rundll, scan, senden, software, system, system neu, system neu aufsetzen, temp, vista |
![Avira Antivir meldet "EXP/CVE-2010-0840.AC' [exploit]"](iconimages/log-analyse-auswertung/avira-antivir-meldet-exp-cve-2010-0840-ac-exploit_ltr.gif)
Baum-Darstellung