| |
| |||||||
Log-Analyse und Auswertung: Der Facebook- Virus scheint entfernt zu sein- ist dieser jedoch wirklich weg?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.10.2011, 15:26
| #1 |
 |  Der Facebook- Virus scheint entfernt zu sein- ist dieser jedoch wirklich weg? Hallo zusammen, leider war ich so naiv und klickte auf ein Link, den mir jemand auf Facebook zugeschickt hatte. Es waren nicht die Partybilder des letzten Wochenendes, sondern der Facebook- Virus. Richtig ist jedoch, dass es ein Wurm war/ist. Mein Microsoft Security Essential (werde dies hier mit MSE abkürzen) zeigte keine infizierten Objekte an. Mein MSN- Messanger öffnete sich daraufhin ständig. Des weiteren war zu dem Zeitpunkt mein USB- Stick angeschlossen. Alle Dateien wurden nun als Verknüpfung angezeigt- konnte sie jedoch nicht öffnen. Nachdem ich den Rechner rebootet hatte, kam eine Warnung vom MSE: Worm: Win32/Phorpiex.b und der Ordner mit einer exe- Datei: C:\Users\Martin\M-1-52-5782-8752-5245\winsvc.exe. Ich konnte zwar auf den Ordner manuell zugreifen durch einen Eintrag in der oberen Leiste des Explorer. Jedoch erschien dieser nicht als Ordner in meinem User- Ordner. Auch die Datei lag nicht in diesem Ordner (Habe alle versteckten Objekte anzeigen lassen). Über MSE klickte ich auf entfernen um den Wurm zu beseitigen. Beim Rebooten erschien die Meldung jedoch noch einmal. Nach einem weiteren "Entfernen"- Klick und einem weiteren Rebooten schien alles wieder zu funktionieren. Meinen USB- Stick hatte ich ja auch infiziert. MSE hat dies erkannt, sodass ich diesen daraufhin formatiert habe. Seitdem funktioniert dieser wieder einwandfrei. MSN- Messanger öffnet sich nicht mehr und sonst scheint alles stabil zu laufen. Jedoch bin ich mir sehr unsicher, ob dieser Wurm trotzallem noch in meinem System vorhanden ist. Ich habe Malwarebyte durchlaufen lassen: Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 7929
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
12.10.2011 20:36:54
mbam-log-2011-10-12 (20-36-54).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Durchsuchte Objekte: 425599
Laufzeit: 3 Stunde(n), 12 Minute(n), 5 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Weiter ließ ich OTL laufen: Code:
ATTFilter OTL logfile created on: 12.10.2011 16:39:55 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Martin\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,99 Gb Total Physical Memory | 1,18 Gb Available Physical Memory | 39,28% Memory free 5,99 Gb Paging File | 4,59 Gb Available in Paging File | 76,67% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,79 Gb Total Space | 79,92 Gb Free Space | 34,33% Space Free | Partition Type: NTFS Computer Name: MARTIN-PC | User Name: Martin | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.10.12 16:38:47 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe PRC - [2011.10.12 16:15:50 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.08.31 17:00:48 | 001,047,208 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe PRC - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.08.03 13:50:00 | 000,812,648 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2011.08.03 13:50:00 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011.02.01 00:29:20 | 000,232,104 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe PRC - [2010.11.30 14:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe PRC - [2010.11.11 13:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe PRC - [2010.11.11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe PRC - [2010.09.29 15:08:58 | 000,200,624 | ---- | M] (Telefónica I+D) -- C:\Programme\o2\Mobile Connection Manager\ImpWiFiSvc.exe PRC - [2009.10.18 13:18:42 | 003,438,592 | ---- | M] (Arachnoid Biometrics Identification Group Corp.) -- C:\Programme\Acer\Acer Bio Protection\CompPtcVUI.exe PRC - [2009.10.18 13:18:32 | 003,521,024 | ---- | M] () -- C:\Programme\Acer\Acer Bio Protection\BASVC.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.07.14 03:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.07 15:34:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Common Files\Pure Networks Shared\Platform\nmsrvc.exe PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.03.25 15:25:06 | 000,050,952 | ---- | M] (UPEK Inc.) -- C:\Programme\Common Files\SPBA\upeksvr.exe ========== Modules (No Company Name) ========== MOD - [2011.10.12 16:15:49 | 001,833,944 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2011.09.05 19:59:31 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (Tomcat6) SRV - File not found [Disabled | Stopped] -- -- (ICQ Service) SRV - File not found [Disabled | Stopped] -- -- (gupdatem) Google Update-Dienst (gupdatem) SRV - File not found [Disabled | Stopped] -- -- (gupdate) Google Update Service (gupdate) SRV - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.03.10 02:07:10 | 000,083,456 | ---- | M] () [Auto | Stopped] -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\extensions\startup.service@mozilla.com\svc.exe -- (Firefox Service) SRV - [2011.02.11 17:41:29 | 000,603,896 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent) SRV - [2010.11.11 13:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV - [2010.11.11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV - [2010.09.29 15:08:58 | 000,200,624 | ---- | M] (Telefónica I+D) [Auto | Running] -- C:\Programme\o2\Mobile Connection Manager\ImpWiFiSvc.exe -- (TGCM_ImportWiFiSvc) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.10.18 13:18:32 | 003,521,024 | ---- | M] () [Auto | Running] -- C:\Programme\Acer\Acer Bio Protection\BASVC.exe -- (IGBASVC) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.04.30 02:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService) SRV - [2009.04.07 15:34:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice) SRV - [2009.03.26 23:04:42 | 000,326,192 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Windows\System32\vmnetdhcp.exe -- (VMnetDHCP) SRV - [2009.03.26 23:04:22 | 000,399,920 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Windows\System32\vmnat.exe -- (VMware NAT Service) SRV - [2009.03.26 23:04:16 | 000,113,200 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Program Files\VMware\VMware Workstation\vmware-authd.exe -- (VMAuthdService) SRV - [2008.12.01 11:49:02 | 000,191,024 | ---- | M] (VMware, Inc.) [Disabled | Stopped] -- C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe -- (ufad-ws60) ========== Driver Services (SafeList) ========== DRV - [2011.10.12 16:36:13 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | Disabled | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2011.10.12 16:14:53 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA2553AC-144C-47A5-96A1-79D28329F12A}\MpKsle39e1365.sys -- (MpKsle39e1365) DRV - [2011.10.12 07:32:40 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA2553AC-144C-47A5-96A1-79D28329F12A}\MpKsl2786db03.sys -- (MpKsl2786db03) DRV - [2011.08.03 13:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2011.05.10 11:41:28 | 000,139,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA) DRV - [2011.05.02 10:03:15 | 000,073,176 | ---- | M] (Safend Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\system32\DRIVERS\Spfd.sys -- (Spfd) DRV - [2011.05.02 10:03:15 | 000,032,088 | ---- | M] (Safend Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\system32\DRIVERS\SpfdBus.sys -- (SpfdBus) DRV - [2011.02.11 17:27:37 | 000,019,680 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpnva.sys -- (vpnva) DRV - [2011.01.19 12:28:11 | 007,087,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETwNs32.sys -- (NETwNs32) ___ Intel(R) DRV - [2010.10.29 23:11:08 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV - [2010.10.24 22:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2010.10.24 22:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon) DRV - [2010.10.01 22:35:19 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri) DRV - [2010.10.01 22:34:47 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc) DRV - [2010.10.01 22:34:47 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt) DRV - [2010.04.09 09:24:12 | 000,063,616 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2010.03.29 11:15:36 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E) DRV - [2010.03.25 04:08:38 | 000,105,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2010.01.18 12:48:42 | 000,027,136 | ---- | M] (Huawei Tech. Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewdcsc.sys -- (Huawei) DRV - [2009.10.18 13:18:22 | 000,043,184 | ---- | M] (Alfa Corporation) [File_System | Boot | Running] -- C:\Windows\system32\Drivers\AlfaFF.sys -- (AlfaFF) DRV - [2009.10.18 12:25:56 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2009.09.15 19:40:18 | 006,114,816 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) Intel(R) DRV - [2009.08.31 12:41:50 | 000,044,544 | ---- | M] (Nuvoton Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nuvotoncir.sys -- (nuvotoncir) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc) DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R) DRV - [2009.05.21 18:24:44 | 000,021,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (HID) DRV - [2009.04.30 02:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio) DRV - [2009.04.07 15:33:08 | 000,026,416 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis) DRV - [2009.04.07 15:33:08 | 000,024,880 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp) DRV - [2009.03.26 23:05:36 | 000,054,960 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmci.sys -- (vmci) DRV - [2009.03.26 23:05:36 | 000,023,216 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMkbd.sys -- (vmkbd) DRV - [2009.03.26 23:05:34 | 000,857,520 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmx86.sys -- (vmx86) DRV - [2009.03.26 23:05:34 | 000,032,304 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hcmon.sys -- (hcmon) DRV - [2009.03.26 23:05:32 | 000,026,288 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetuserif.sys -- (VMnetuserif) DRV - [2009.03.26 17:31:12 | 000,031,280 | R--- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vmnetbridge.sys -- (VMnetBridge) DRV - [2009.03.26 17:31:12 | 000,031,280 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmusb.sys -- (vmusb) DRV - [2009.03.26 17:31:12 | 000,016,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmnetadapter.sys -- (VMnetAdapter) DRV - [2008.12.01 11:47:08 | 000,022,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Programme\VMware\VMware Workstation\vstor2-ws60.sys -- (vstor2-ws60) DRV - [2007.03.28 07:51:40 | 000,043,008 | ---- | M] (Winbond Electronics Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winbondcir.sys -- (winbondcir) DRV - [2007.01.26 08:32:18 | 000,069,632 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (Int15) DRV - [2004.03.24 04:12:34 | 000,017,280 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\nsndis5.sys -- (NSNDIS5) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://gbt.toolbarhome.com/?hp=df IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 91 05 1D E6 6F 69 CB 01 [binary data] IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\InprocServer32 File not found IE - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Web Search..." FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91 FF - prefs.js..keyword.URL: "hxxp://gbt.toolbarhome.com/search.aspx?srch=ku&q=" FF - prefs.js..network.proxy.backup.ftp: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.backup.ftp_port: 8051 FF - prefs.js..network.proxy.backup.gopher: "" FF - prefs.js..network.proxy.backup.gopher_port: 0 FF - prefs.js..network.proxy.backup.socks: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.backup.socks_port: 8051 FF - prefs.js..network.proxy.backup.ssl: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.backup.ssl_port: 8051 FF - prefs.js..network.proxy.ftp: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.ftp_port: 8051 FF - prefs.js..network.proxy.gopher: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.gopher_port: 8051 FF - prefs.js..network.proxy.http: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.http_port: 8051 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.socks_port: 8051 FF - prefs.js..network.proxy.ssl: "proxy.dhbw-heidenheim.de" FF - prefs.js..network.proxy.ssl_port: 8051 FF - prefs.js..network.proxy.type: 4 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll File not found FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.15 15:45:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.15 15:45:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2011.06.15 14:12:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.12 16:15:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.29 18:43:10 | 000,000,000 | ---D | M] [2010.05.02 21:27:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions [2010.05.02 21:27:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com [2011.10.05 19:20:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\xva6311x.default\extensions [2011.10.05 19:20:08 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\xva6311x.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.04.15 10:29:43 | 000,000,000 | ---D | M] (startup.service) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\xva6311x.default\extensions\startup.service@mozilla.com [2011.10.06 20:36:15 | 000,000,950 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\icqplugin-1.xml [2011.05.02 13:10:04 | 000,000,950 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\icqplugin-2.xml [2011.05.17 13:49:51 | 000,000,950 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\icqplugin-3.xml [2011.06.29 16:59:54 | 000,000,950 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\icqplugin-4.xml [2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\icqplugin.xml [2011.06.14 15:37:45 | 000,001,578 | ---- | M] () -- C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\xva6311x.default\searchplugins\web-search.xml [2011.06.14 13:36:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.12.15 23:59:00 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.05.14 21:43:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.07 19:41:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.11 22:48:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.28 19:48:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.04.26 13:40:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\{0545B830-F0AA-4D7E-8820-50A4629A56FE}.XPI () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}.XPI () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\EXTERNALIP@ERIK.MORLIN.XPI () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\NEWTABURL@SOGAME.CAT.XPI () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\SPEEDTEST@GOTOMYHELP.COM.XPI () (No name found) -- C:\USERS\MARTIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XVA6311X.DEFAULT\EXTENSIONS\STATUS4EVAR@CALIGONSTUDIOS.COM.XPI [2011.10.12 16:15:50 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.04.26 13:40:22 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.02.01 00:28:22 | 000,001,110 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\adaradar.xml [2011.10.12 16:15:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.12 16:15:44 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.10.12 16:15:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.12 16:15:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.12 16:15:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.12 16:15:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.06.15 14:35:29 | 000,002,084 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 3dns.adobe.com O1 - Hosts: 127.0.0.1 3dns-1.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-5.adobe.com O1 - Hosts: 127.0.0.1 hh-software.com O1 - Hosts: 18 more lines... O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (GameBox Toolbar) - {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files\GameBox\gamebox_toolbar.dll File not found O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (GameBox Toolbar) - {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files\GameBox\gamebox_toolbar.dll File not found O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\1105171349\ICQToolBar.dll File not found O3 - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\..\Toolbar\WebBrowser: (GameBox Toolbar) - {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files\GameBox\gamebox_toolbar.dll File not found O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security)) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [TaskTray] File not found O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-741742400-3053364637-1879691283-1008..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O7 - HKU\S-1-5-21-741742400-3053364637-1879691283-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe () O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4931F96-242E-470B-88F1-49A416556CE8}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\gameboxchrome {494D4E3B-FA53-4487-8AF6-3F50FE1167A9} - C:\Program Files\GameBox\gamebox_toolbar.dll File not found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Programme\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - (C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll) - C:\Programme\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.) O20 - Winlogon\Notify\spba: DllName - (C:\Program Files\Common Files\SPBA\homefus2.dll) - C:\Programme\Common Files\SPBA\homefus2.dll (UPEK Inc.) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{0989911e-8d08-11e0-acba-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{0989911e-8d08-11e0-acba-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{09eea040-ceb7-11de-8517-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{09eea040-ceb7-11de-8517-001e68ee3907}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{09eea045-ceb7-11de-8517-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{09eea045-ceb7-11de-8517-001e68ee3907}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{09eea076-ceb7-11de-8517-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{09eea076-ceb7-11de-8517-001e68ee3907}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{09eea07a-ceb7-11de-8517-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{09eea07a-ceb7-11de-8517-001e68ee3907}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{0b587ff4-9417-11df-80ab-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{0b587ff4-9417-11df-80ab-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{0b587ff6-9417-11df-80ab-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{0b587ff6-9417-11df-80ab-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{18652498-b695-11df-95e8-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{18652498-b695-11df-95e8-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2001cec6-b9e9-11df-95d4-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2001cec6-b9e9-11df-95d4-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{27973ddf-9844-11e0-9803-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{27973ddf-9844-11e0-9803-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2a3a6f73-8779-11e0-af35-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2a3a6f73-8779-11e0-af35-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2a3a6f74-8779-11e0-af35-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2a3a6f74-8779-11e0-af35-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2a3a6f81-8779-11e0-af35-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2a3a6f81-8779-11e0-af35-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2a3a6f83-8779-11e0-af35-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2a3a6f83-8779-11e0-af35-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2a3a6f85-8779-11e0-af35-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{2a3a6f85-8779-11e0-af35-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{3e826a67-8781-11e0-9594-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{3e826a67-8781-11e0-9594-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{3e826a77-8781-11e0-9594-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{3e826a77-8781-11e0-9594-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{429b5f46-94f1-11df-bd57-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{429b5f46-94f1-11df-bd57-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{429b5f49-94f1-11df-bd57-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{429b5f49-94f1-11df-bd57-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{429b5f4b-94f1-11df-bd57-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{429b5f4b-94f1-11df-bd57-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{429b5f4d-94f1-11df-bd57-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{429b5f4d-94f1-11df-bd57-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{429b5f9e-94f1-11df-bd57-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{429b5f9e-94f1-11df-bd57-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{47e043b7-5b6b-11df-bcc8-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{47e043b7-5b6b-11df-bcc8-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{47e043ba-5b6b-11df-bcc8-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{47e043ba-5b6b-11df-bcc8-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4a0f6685-6128-11e0-9628-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{4a0f6685-6128-11e0-9628-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4a0f6687-6128-11e0-9628-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{4a0f6687-6128-11e0-9628-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4a0f6689-6128-11e0-9628-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{4a0f6689-6128-11e0-9628-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4d01886a-13e6-11df-809d-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{4d01886a-13e6-11df-809d-001e68ee3907}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{84cfc920-613d-11e0-96ef-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{84cfc920-613d-11e0-96ef-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8690d100-e693-11de-bc73-001e68ee3907}\Shell - "" = AutoRun O33 - MountPoints2\{8690d100-e693-11de-bc73-001e68ee3907}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O33 - MountPoints2\{c418366d-98d1-11df-bc37-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{c418366d-98d1-11df-bc37-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{e6a7de2f-5f77-11df-ba1a-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{e6a7de2f-5f77-11df-ba1a-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{e6a7de3b-5f77-11df-ba1a-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{e6a7de3b-5f77-11df-ba1a-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{e6a7de53-5f77-11df-ba1a-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{e6a7de53-5f77-11df-ba1a-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{e6a7de63-5f77-11df-ba1a-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{e6a7de63-5f77-11df-ba1a-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{eba65976-98cd-11e0-ad1b-005056c00008}\Shell - "" = AutoRun O33 - MountPoints2\{eba65976-98cd-11e0-ad1b-005056c00008}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.10.12 16:38:33 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe [2011.10.12 16:36:06 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.10.12 16:35:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.10.12 16:35:38 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.10.12 16:32:32 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Martin\Desktop\mbam-setup-1.51.2.1300.exe [2011.10.11 22:53:13 | 000,000,000 | RHSD | C] -- C:\Users\Martin\M-1-52-5782-8752-5245 [2011.10.11 21:31:35 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Malwarebytes [2011.10.11 21:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.10.11 21:31:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.10.10 20:50:56 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\NVIDIA [2011.10.10 20:32:18 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Facebook ========== Files - Modified Within 30 Days ========== [2011.10.12 16:38:47 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\Martin\Desktop\OTL.exe [2011.10.12 16:36:13 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.10.12 16:35:45 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.12 16:32:53 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Martin\Desktop\mbam-setup-1.51.2.1300.exe [2011.10.12 16:19:59 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.10.12 16:19:59 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.10.12 16:16:10 | 000,002,566 | ---- | M] () -- C:\Users\Martin\Desktop\Faster Firefox.lnk [2011.10.12 16:15:02 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.10.12 16:14:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.10.12 16:14:35 | 2411,884,544 | -HS- | M] () -- C:\hiberfil.sys [2011.10.12 06:57:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.10.04 20:03:36 | 000,112,215 | ---- | M] () -- C:\Users\Martin\Documents\ausweise.jpg [2011.10.04 20:02:53 | 000,084,196 | ---- | M] () -- C:\Users\Martin\Documents\Studiennachweis_ws_2011.jpg [2011.10.04 18:18:25 | 000,699,826 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.10.04 18:18:25 | 000,655,194 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.10.04 18:18:25 | 000,148,318 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.10.04 18:18:25 | 000,121,690 | ---- | M] () -- C:\Windows\System32\perfc009.dat ========== Files Created - No Company Name ========== [2011.10.12 16:35:45 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.10.12 16:16:10 | 000,002,566 | ---- | C] () -- C:\Users\Martin\Desktop\Faster Firefox.lnk [2011.10.04 20:03:36 | 000,112,215 | ---- | C] () -- C:\Users\Martin\Documents\ausweise.jpg [2011.10.04 20:02:52 | 000,084,196 | ---- | C] () -- C:\Users\Martin\Documents\Studiennachweis_ws_2011.jpg [2011.08.18 20:03:21 | 000,000,032 | ---- | C] () -- C:\Windows\USB_Start.INI [2011.05.04 21:00:44 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2011.05.04 21:00:33 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2011.05.04 21:00:30 | 000,183,112 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2010.09.27 01:48:28 | 000,146,688 | ---- | C] () -- C:\Windows\hpoins44.dat [2010.09.27 01:48:28 | 000,000,512 | ---- | C] () -- C:\Windows\hpomdl44.dat [2010.09.24 21:54:22 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2010.07.22 22:14:32 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2010.04.30 19:36:11 | 000,000,331 | ---- | C] () -- C:\Windows\SIERRA.INI [2010.04.24 14:27:02 | 000,055,856 | ---- | C] () -- C:\Windows\System32\vnetinst.dll [2010.02.07 22:22:21 | 000,001,824 | ---- | C] () -- C:\Windows\disney.ini [2009.10.24 13:27:17 | 000,017,920 | ---- | C] () -- C:\Users\Martin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.10.18 13:18:49 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll [2009.10.18 13:08:53 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2009.10.18 13:08:53 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2009.10.18 13:08:53 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2009.10.18 12:49:21 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009.10.18 12:49:21 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2009.10.18 12:49:20 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009.10.18 12:49:20 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009.10.18 12:49:18 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2009.10.18 12:47:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2009.07.14 10:47:43 | 000,699,826 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 10:47:43 | 000,148,318 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 06:33:53 | 003,766,288 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 04:05:48 | 000,655,194 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 04:05:48 | 000,121,690 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2007.01.26 08:32:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys ========== LOP Check ========== [2010.07.08 18:24:27 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\AllDup [2009.10.18 13:02:09 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Ashampoo [2009.10.18 12:51:09 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\DAEMON Tools Lite [2010.09.26 19:49:10 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\gtk-2.0 [2010.07.30 08:56:58 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Helios [2011.05.17 18:40:45 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\ICQ [2010.12.08 18:12:44 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\JavaEditor [2011.04.15 13:02:07 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Juniper Networks [2011.05.04 20:50:56 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Leadertech [2010.10.13 19:09:17 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Mazaika [2010.05.02 21:27:54 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Philips-Songbird [2011.05.24 14:32:13 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\RadarSync [2010.05.14 19:37:04 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\Telefónica [2011.05.20 18:11:09 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Viele Grüße und großen Dank schon im Vorraus!!! |
| Themen zu Der Facebook- Virus scheint entfernt zu sein- ist dieser jedoch wirklich weg? |
| adobe, bho, defender, entfernen, excel.exe, facebook, firefox, google, google earth, helper, infiziert., infizierte, langs, logfile, microsoft security, mozilla, nvidia, nvlddmkm.sys, ordner, phorpiex, plug-in, programme, realtek, registry, scan, security, senden, software, speedtest, stick, system, updates, usb- stick, virus, warnung, webcheck, wurm |
Baum-Darstellung