| |
| |||||||
Log-Analyse und Auswertung: Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.11.2011, 11:37
| #1 |
 |  Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Hallo an alle, ich habe heute einen Avira-Scan machen lassen, der nichts Auffälliges gefunden hat. Mit Malwarebytes wurde jedoch eine infizierte File gefunden: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8066 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 02.11.2011 09:42:17 mbam-log-2011-11-02 (09-42-09).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 247648 Laufzeit: 21 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Public\Desktop\control center.lnk (Rogue.ControlCenter) -> No action taken. Ich weiß weder was das ist, noch wie es in den öffentlichen Benutzer reingekommen ist. Der PC ist recht neu und alles wurde neu installiert, lediglich 2-3 Freeware-Sachen (Adobe, Flash-Player & Thunderbird) wurden von Chip aus dem Netzt geladen. Ich habe die file jetzt in Quarantäne verschoben. Soll es gelöscht werden? Ist dann alles okay oder muss das System neu installiert werden? Wie soll ich vorgehen - ich kenne mich leider mit Computern nicht wirklich aus. Schonmal vielen Dank für eure Hilfe, Lady |
|
02.11.2011, 12:32
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________
__________________ |
|
02.11.2011, 12:52
| #3 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Hallo Arne,
__________________ich habe nur noch das gefunden. Das Logfile kam, nachdem ich den Fund entfernt habe. Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8066 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 02.11.2011 10:12:33 mbam-log-2011-11-02 (10-12-33).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 247648 Laufzeit: 21 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Public\Desktop\control center.lnk (Rogue.ControlCenter) -> Quarantined and deleted successfully. Jetzt findet Malwarebytes nichts mehr, aber ist dadurch die "Gefahr" gebannt? Oder doch lieber neu installieren? Danke für die Hilfe! |
|
02.11.2011, 13:23
| #4 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Ich habe auch noch zwei Logfiles von RSIT. Vielleicht kann man damit mehr anfangen... RSIT Logfile: Code:
ATTFilter Logfile of random's system information tool 1.09 (written by random/random) Run by Franziska at 2011-11-02 13:12:06 Microsoft Windows 7 Home Premium Service Pack 1 System drive C: has 444 GB (94%) free of 472 GB Total RAM: 1981 MB (68% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:12:24, on 02.11.2011 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v8.00 (8.00.7601.17514) Boot mode: Normal Running processes: C:\windows\system32\taskhost.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\windows\system32\SearchFilterHost.exe C:\Users\Franziska\Downloads\RSIT.exe C:\Program Files\trend micro\Franziska.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini" O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST') O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MIF5BA~1\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MIF5BA~1\Office14\EXCEL.EXE/3000 O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Avira Email Schutz (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira Browser Schutz (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- End of file - 6450 bytes =========Mozilla firefox========= ProfilePath - C:\Users\Franziska\AppData\Roaming\Mozilla\Firefox\Profiles\i8m7iaox.default prefs.js - "browser.startup.homepage" - "hxxp://www.google.de/" "{27182e60-b5f3-411c-b545-b44205977502}"=C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer] "Description"=Adobe® Flash® Player 10.1 Plugin "Path"=C:\windows\system32\Macromed\Flash\NPSWF32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE] "Description"= "Path"=disabled [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0] "Description"=Ag Player Plugin "Path"=c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0] "Description"=Office Authorization plug-in for NPAPI browsers "Path"=C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0] "Description"=Microsoft SharePoint Plug-in for Firefox "Path"=C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709] "Description"=WLPG Install MIME type "Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader] "Description"=Handles PDFs in-place in Firefox "Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll C:\Program Files\Mozilla Firefox\extensions\ {972ce4c6-7e08-4474-a285-3208198ce6fd} C:\Program Files\Mozilla Firefox\components\ binary.manifest browsercomps.dll C:\Program Files\Mozilla Firefox\searchplugins\ amazondotcom-de.xml bing.xml eBay-de.xml google.xml leo_ende_de.xml wikipedia-de.xml yahoo-de.xml ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27 191792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}] Office Document Cache Handler - C:\PROGRA~1\MIF5BA~1\Office14\URLREDIR.DLL [2010-02-28 561552] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2010-07-06 9394792] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-07-28 136216] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-07-28 171032] "Persistence"=C:\Windows\system32\igfxpers.exe [2010-07-28 170520] "MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408] "SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472] "PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2008-07-09 29984] "IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2008-07-09 46368] "PPort11reminder"=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-08-31 328992] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2009-05-26 1159168] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2008-12-24 114688] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2011-10-26 258512] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920] "Malwarebytes' Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2011-08-31 1047208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\windows\system32\igfxdev.dll [2010-07-28 228864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"=credssp.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=5 "ConsentPromptBehaviorUser"=3 "EnableUIADesktopToggle"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] "vidc.mrle"=msrle32.dll "vidc.msvc"=msvidc32.dll "msacm.imaadpcm"=imaadp32.acm "msacm.msg711"=msg711.acm "msacm.msgsm610"=msgsm32.acm "msacm.msadpcm"=msadp32.acm "midimapper"=midimap.dll "wavemapper"=msacm32.drv "vidc.uyvy"=msyuv.dll "vidc.yuy2"=msyuv.dll "vidc.yvyu"=msyuv.dll "vidc.iyuv"=iyuv_32.dll "vidc.i420"=iyuv_32.dll "vidc.yvu9"=tsbyuv.dll "msacm.l3acm"=C:\Windows\System32\l3codeca.acm "vidc.cvid"=iccvid.dll "wave1"=wdmaud.drv "midi1"=wdmaud.drv "mixer1"=wdmaud.drv "aux1"=wdmaud.drv "wave"=wdmaud.drv "midi"=wdmaud.drv "mixer"=wdmaud.drv "aux"=wdmaud.drv "msacm.siren"=sirenacm.dll ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 month====== 2011-11-02 13:12:06 ----D---- C:\rsit 2011-11-02 13:12:06 ----D---- C:\Program Files\trend micro 2011-11-02 09:04:30 ----D---- C:\Users\Franziska\AppData\Roaming\Malwarebytes 2011-11-02 09:04:24 ----D---- C:\ProgramData\Malwarebytes 2011-11-02 09:04:20 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2011-11-02 09:04:20 ----A---- C:\windows\system32\drivers\mbam.sys 2011-11-01 16:12:58 ----D---- C:\Users\Franziska\AppData\Roaming\Macromedia 2011-11-01 16:12:41 ----D---- C:\windows\system32\Macromed 2011-11-01 14:24:58 ----D---- C:\Users\Franziska\AppData\Roaming\Adobe 2011-11-01 14:15:50 ----D---- C:\Program Files\Common Files\Adobe 2011-11-01 14:15:50 ----D---- C:\Program Files\Adobe 2011-11-01 14:14:46 ----D---- C:\ProgramData\Adobe 2011-10-31 07:58:01 ----D---- C:\windows\system32\EventProviders 2011-10-31 07:10:46 ----RD---- C:\Users\Franziska\AppData\Roaming\Brother 2011-10-31 06:58:59 ----D---- C:\windows\system32\SPReview 2011-10-27 19:36:20 ----A---- C:\windows\system32\dfshim.dll 2011-10-27 19:36:18 ----A---- C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-10-27 19:36:18 ----A---- C:\windows\system32\drivers\TsUsbFlt.sys 2011-10-27 19:36:17 ----A---- C:\windows\system32\mstscax.dll 2011-10-27 19:36:15 ----A---- C:\windows\system32\mfc40u.dll 2011-10-27 19:36:15 ----A---- C:\windows\system32\mfc40.dll 2011-10-27 19:36:15 ----A---- C:\windows\system32\d3d10warp.dll 2011-10-27 19:36:14 ----A---- C:\windows\system32\sysmain.dll 2011-10-27 19:36:13 ----A---- C:\windows\system32\shell32.dll 2011-10-27 19:36:13 ----A---- C:\windows\system32\secproc_isv.dll 2011-10-27 19:36:13 ----A---- C:\windows\system32\d2d1.dll 2011-10-27 19:36:12 ----A---- C:\windows\system32\secproc.dll 2011-10-27 19:36:12 ----A---- C:\windows\system32\RMActivate_isv.exe 2011-10-27 19:36:11 ----A---- C:\windows\system32\RMActivate.exe 2011-10-27 19:36:10 ----A---- C:\windows\system32\spwizui.dll 2011-10-27 19:36:10 ----A---- C:\windows\system32\mscoree.dll 2011-10-27 19:36:09 ----A---- C:\windows\system32\mf.dll 2011-10-27 19:36:09 ----A---- C:\windows\system32\mcupdate_GenuineIntel.dll 2011-10-27 19:36:09 ----A---- C:\windows\system32\CertEnroll.dll 2011-10-27 19:36:08 ----A---- C:\windows\system32\wmp.dll 2011-10-27 19:36:08 ----A---- C:\windows\system32\PresentationHostProxy.dll 2011-10-27 19:36:08 ----A---- C:\windows\system32\PresentationHost.exe 2011-10-27 19:36:07 ----A---- C:\windows\system32\drivers\msiscsi.sys 2011-10-27 19:36:07 ----A---- C:\windows\system32\drivers\hwpolicy.sys 2011-10-27 19:36:06 ----A---- C:\windows\system32\schedsvc.dll 2011-10-27 19:36:06 ----A---- C:\windows\system32\RacEngn.dll 2011-10-27 19:36:05 ----A---- C:\windows\system32\rdpdd.dll 2011-10-27 19:36:05 ----A---- C:\windows\system32\ntdll.dll 2011-10-27 19:36:05 ----A---- C:\windows\system32\AuthFWSnapin.dll 2011-10-27 19:36:04 ----A---- C:\windows\system32\qmgr.dll 2011-10-27 19:36:04 ----A---- C:\windows\system32\ole32.dll 2011-10-27 19:36:04 ----A---- C:\windows\system32\ExplorerFrame.dll 2011-10-27 19:36:03 ----A---- C:\windows\system32\wevtsvc.dll 2011-10-27 19:36:02 ----A---- C:\windows\system32\vssapi.dll 2011-10-27 19:36:02 ----A---- C:\windows\system32\SearchFolder.dll 2011-10-27 19:36:02 ----A---- C:\windows\system32\DWrite.dll 2011-10-27 19:36:02 ----A---- C:\windows\system32\d3d9.dll 2011-10-27 19:36:01 ----A---- C:\windows\system32\taskschd.dll 2011-10-27 19:36:01 ----A---- C:\windows\system32\IKEEXT.DLL 2011-10-27 19:36:00 ----A---- C:\windows\system32\wer.dll 2011-10-27 19:36:00 ----A---- C:\windows\system32\termsrv.dll 2011-10-27 19:36:00 ----A---- C:\windows\system32\spreview.exe 2011-10-27 19:36:00 ----A---- C:\windows\system32\spinstall.exe 2011-10-27 19:36:00 ----A---- C:\windows\system32\mstsc.exe 2011-10-27 19:36:00 ----A---- C:\windows\system32\FntCache.dll 2011-10-27 19:36:00 ----A---- C:\windows\system32\crypt32.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\rpcrt4.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\msxml6.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\lsasrv.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\gpsvc.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\dwmcore.dll 2011-10-27 19:35:59 ----A---- C:\windows\system32\certcli.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\WinSAT.exe 2011-10-27 19:35:58 ----A---- C:\windows\system32\wbengine.exe 2011-10-27 19:35:58 ----A---- C:\windows\system32\scavengeui.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\quartz.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\odbc32.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\mstime.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\MPSSVC.dll 2011-10-27 19:35:58 ----A---- C:\windows\system32\diagperf.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\winhttp.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\TSWorkspace.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\tsmf.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\setupapi.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\localspl.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\iedkcs32.dll 2011-10-27 19:35:57 ----A---- C:\windows\system32\dot3api.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\WindowsCodecs.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\VSSVC.exe 2011-10-27 19:35:56 ----A---- C:\windows\system32\user32.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\netlogon.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\netcfgx.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\MSVidCtl.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\dbgeng.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\d3d11.dll 2011-10-27 19:35:56 ----A---- C:\windows\system32\apphelp.dll 2011-10-27 19:35:55 ----A---- C:\windows\system32\WsmSvc.dll 2011-10-27 19:35:55 ----A---- C:\windows\system32\WMVDECOD.DLL 2011-10-27 19:35:55 ----A---- C:\windows\system32\winlogon.exe 2011-10-27 19:35:55 ----A---- C:\windows\system32\webio.dll 2011-10-27 19:35:55 ----A---- C:\windows\system32\Query.dll 2011-10-27 19:35:55 ----A---- C:\windows\system32\drivers\rdpwd.sys 2011-10-27 19:35:55 ----A---- C:\windows\system32\advapi32.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\upnp.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\schannel.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\netfxperf.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\msv1_0.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\msdrm.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\mmcndmgr.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\lsm.exe 2011-10-27 19:35:54 ----A---- C:\windows\system32\imapi2fs.dll 2011-10-27 19:35:54 ----A---- C:\windows\system32\DShowRdpFilter.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\usp10.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\sppobjs.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\shlwapi.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\SessEnv.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\PortableDeviceApi.dll 2011-10-27 19:35:53 ----A---- C:\windows\system32\mcbuilder.exe 2011-10-27 19:35:53 ----A---- C:\windows\system32\authui.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\xpsservices.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\winload.exe 2011-10-27 19:35:52 ----A---- C:\windows\system32\WebClnt.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\userenv.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\drvstore.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\comdlg32.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\certmgr.dll 2011-10-27 19:35:52 ----A---- C:\windows\system32\audiosrv.dll 2011-10-27 19:35:51 ----A---- C:\windows\system32\sppwinob.dll 2011-10-27 19:35:51 ----A---- C:\windows\system32\rpcss.dll 2011-10-27 19:35:51 ----A---- C:\windows\system32\iphlpsvc.dll 2011-10-27 19:35:51 ----A---- C:\windows\system32\cmd.exe 2011-10-27 19:35:51 ----A---- C:\windows\system32\BFE.DLL 2011-10-27 19:35:50 ----A---- C:\windows\system32\wucltux.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\wuaueng.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\wmicmiplugin.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\Wldap32.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\winresume.exe 2011-10-27 19:35:50 ----A---- C:\windows\system32\win32spl.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\samsrv.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\propsys.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\profsvc.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\nlasvc.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\mfds.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\framedynos.dll 2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\volsnap.sys 2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\netio.sys 2011-10-27 19:35:50 ----A---- C:\windows\system32\drivers\ndis.sys 2011-10-27 19:35:49 ----A---- C:\windows\system32\werconcpl.dll 2011-10-27 19:35:49 ----A---- C:\windows\system32\ncsi.dll 2011-10-27 19:35:49 ----A---- C:\windows\system32\azroles.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\wintrust.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\themeui.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\taskeng.exe 2011-10-27 19:35:48 ----A---- C:\windows\system32\spp.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\msxml3.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\mswsock.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\mfreadwrite.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\dxgi.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\drivers\http.sys 2011-10-27 19:35:48 ----A---- C:\windows\system32\dhcpcore.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\dbghelp.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\credui.dll 2011-10-27 19:35:48 ----A---- C:\windows\system32\basecsp.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\WinSATAPI.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\taskcomp.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\spoolsv.exe 2011-10-27 19:35:47 ----A---- C:\windows\system32\NaturalLanguage6.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\gdi32.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\evr.dll 2011-10-27 19:35:47 ----A---- C:\windows\system32\drivers\mrxdav.sys 2011-10-27 19:35:47 ----A---- C:\windows\system32\drivers\1394ohci.sys 2011-10-27 19:35:47 ----A---- C:\windows\system32\calc.exe 2011-10-27 19:35:46 ----A---- C:\windows\system32\vpnike.dll 2011-10-27 19:35:46 ----A---- C:\windows\system32\UIRibbon.dll 2011-10-27 19:35:46 ----A---- C:\windows\system32\srvsvc.dll 2011-10-27 19:35:46 ----A---- C:\windows\system32\sqlsrv32.dll 2011-10-27 19:35:46 ----A---- C:\windows\system32\QAGENTRT.DLL 2011-10-27 19:35:46 ----A---- C:\windows\system32\lpksetup.exe 2011-10-27 19:35:46 ----A---- C:\windows\system32\fveapi.dll 2011-10-27 19:35:46 ----A---- C:\windows\system32\cryptsvc.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\ws2_32.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\sxs.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\stobject.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\netshell.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\inetpp.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\ie4uinit.exe 2011-10-27 19:35:45 ----A---- C:\windows\system32\hgprint.dll 2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\rdbss.sys 2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\msdsm.sys 2011-10-27 19:35:45 ----A---- C:\windows\system32\drivers\fvevol.sys 2011-10-27 19:35:45 ----A---- C:\windows\system32\comctl32.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\WSDApi.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\wmpeffects.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\rpchttp.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\prncache.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\printui.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\net1.exe 2011-10-27 19:35:44 ----A---- C:\windows\system32\msi.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\dps.dll 2011-10-27 19:35:44 ----A---- C:\windows\system32\ci.dll 2011-10-27 19:35:43 ----A---- C:\windows\system32\vds.exe 2011-10-27 19:35:43 ----A---- C:\windows\system32\scansetting.dll 2011-10-27 19:35:43 ----A---- C:\windows\system32\FXSSVC.exe 2011-10-27 19:35:43 ----A---- C:\windows\system32\drivers\pci.sys 2011-10-27 19:35:43 ----A---- C:\windows\system32\aitagent.exe 2011-10-27 19:35:43 ----A---- C:\windows\system32\aepdu.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\wpdshext.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\WMVCORE.DLL 2011-10-27 19:35:42 ----A---- C:\windows\system32\wlangpui.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\t2embed.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\QSHVHOST.DLL 2011-10-27 19:35:42 ----A---- C:\windows\system32\pnidui.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\MMDevAPI.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\IPSECSVC.DLL 2011-10-27 19:35:42 ----A---- C:\windows\system32\davclnt.dll 2011-10-27 19:35:42 ----A---- C:\windows\system32\consent.exe 2011-10-27 19:35:42 ----A---- C:\windows\system32\aaclient.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\wuapi.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\wscapi.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\webservices.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\TsUsbGDCoInstaller.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\SyncCenter.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\sdengin2.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\netdiagfx.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\fde.dll 2011-10-27 19:35:41 ----A---- C:\windows\system32\drivers\termdd.sys 2011-10-27 19:35:41 ----A---- C:\windows\system32\drivers\sbp2port.sys 2011-10-27 19:35:40 ----A---- C:\windows\system32\wisptis.exe 2011-10-27 19:35:40 ----A---- C:\windows\system32\winsta.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\WinSCard.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\rdpcore.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\pla.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\MSMPEG2ENC.DLL 2011-10-27 19:35:40 ----A---- C:\windows\system32\msasn1.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\mcmde.dll 2011-10-27 19:35:40 ----A---- C:\windows\system32\drivers\vhdmp.sys 2011-10-27 19:35:39 ----A---- C:\windows\system32\WUDFSvc.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\wiaservc.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\setupcl.exe 2011-10-27 19:35:39 ----A---- C:\windows\system32\ntshrui.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\imapi2.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\iepeers.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\DXPTaskRingtone.dll 2011-10-27 19:35:39 ----A---- C:\windows\system32\drivers\msahci.sys 2011-10-27 19:35:39 ----A---- C:\windows\system32\aeinv.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\WMPEncEn.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\winmm.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\TabSvc.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\shsvcs.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\rasmans.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\onex.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\gameux.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\dwmredir.dll 2011-10-27 19:35:38 ----A---- C:\windows\system32\drivers\udfs.sys 2011-10-27 19:35:38 ----A---- C:\windows\system32\drivers\acpi.sys 2011-10-27 19:35:37 ----A---- C:\windows\system32\vaultsvc.dll 2011-10-27 19:35:37 ----A---- C:\windows\system32\netiohlp.dll 2011-10-27 19:35:37 ----A---- C:\windows\system32\Narrator.exe 2011-10-27 19:35:37 ----A---- C:\windows\system32\hbaapi.dll 2011-10-27 19:35:37 ----A---- C:\windows\system32\bootres.dll 2011-10-27 19:35:37 ----A---- C:\windows\system32\autofmt.exe 2011-10-27 19:35:36 ----A---- C:\windows\system32\thumbcache.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\samcli.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\regapi.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\proquota.exe 2011-10-27 19:35:36 ----A---- C:\windows\system32\msutb.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\msinfo32.exe 2011-10-27 19:35:36 ----A---- C:\windows\system32\mimefilt.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\ipsmsnap.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\IPHLPAPI.DLL 2011-10-27 19:35:36 ----A---- C:\windows\system32\halmacpi.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\hal.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\autoconv.exe 2011-10-27 19:35:36 ----A---- C:\windows\system32\autochk.exe 2011-10-27 19:35:36 ----A---- C:\windows\system32\AudioSes.dll 2011-10-27 19:35:36 ----A---- C:\windows\system32\audiodg.exe 2011-10-27 19:35:35 ----A---- C:\windows\system32\wcncsvc.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\tcpipcfg.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\sspicli.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\srchadmin.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\schtasks.exe 2011-10-27 19:35:35 ----A---- C:\windows\system32\QAGENT.DLL 2011-10-27 19:35:35 ----A---- C:\windows\system32\powercpl.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\netid.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\msihnd.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\mscorier.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\framedyn.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\eapphost.dll 2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\volmgr.sys 2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\partmgr.sys 2011-10-27 19:35:35 ----A---- C:\windows\system32\drivers\netbt.sys 2011-10-27 19:35:35 ----A---- C:\windows\system32\AuxiliaryDisplayCpl.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\wdc.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\untfs.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\umpo.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\StructuredQuery.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\scesrv.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\DXP.dll 2011-10-27 19:35:34 ----A---- C:\windows\system32\actxprxy.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\WMNetMgr.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\wlanpref.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\Vault.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\sppsvc.exe 2011-10-27 19:35:33 ----A---- C:\windows\system32\sdclt.exe 2011-10-27 19:35:33 ----A---- C:\windows\system32\RpcRtRemote.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\Robocopy.exe 2011-10-27 19:35:33 ----A---- C:\windows\system32\rastls.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\nci.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\ListSvc.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\licmgr10.dll 2011-10-27 19:35:33 ----A---- C:\windows\system32\drivers\ataport.sys 2011-10-27 19:35:32 ----A---- C:\windows\system32\XpsRasterService.dll 2011-10-27 19:35:32 ----A---- C:\windows\system32\userinit.exe 2011-10-27 19:35:32 ----A---- C:\windows\system32\taskmgr.exe 2011-10-27 19:35:32 ----A---- C:\windows\system32\sharemediacpl.dll 2011-10-27 19:35:32 ----A---- C:\windows\system32\mtxclu.dll 2011-10-27 19:35:32 ----A---- C:\windows\system32\msdri.dll 2011-10-27 19:35:32 ----A---- C:\windows\system32\DxpTaskSync.dll 2011-10-27 19:35:32 ----A---- C:\windows\system32\drivers\mpio.sys 2011-10-27 19:35:32 ----A---- C:\windows\system32\drivers\mountmgr.sys 2011-10-27 19:35:32 ----A---- C:\windows\system32\Display.dll 2011-10-27 19:35:31 ----A---- C:\windows\system32\termmgr.dll 2011-10-27 19:35:31 ----A---- C:\windows\system32\puiobj.dll 2011-10-27 19:35:31 ----A---- C:\windows\system32\eudcedit.exe 2011-10-27 19:35:31 ----A---- C:\windows\system32\drivers\scsiport.sys 2011-10-27 19:35:31 ----A---- C:\windows\system32\DiagCpl.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\wpccpl.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\wiadefui.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\themecpl.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\sppcomapi.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\shsetup.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\SensorsCpl.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\rasppp.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\msdtctm.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\msconfig.exe 2011-10-27 19:35:30 ----A---- C:\windows\system32\logoncli.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\FWPUCLNT.DLL 2011-10-27 19:35:30 ----A---- C:\windows\system32\FirewallControlPanel.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\cabview.dll 2011-10-27 19:35:30 ----A---- C:\windows\system32\biocpl.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\tapisrv.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\scecli.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\PhotoScreensaver.scr 2011-10-27 19:35:29 ----A---- C:\windows\system32\mscories.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\mscms.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\localsec.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\hgcpl.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\fontext.dll 2011-10-27 19:35:29 ----A---- C:\windows\system32\drivers\rdyboost.sys 2011-10-27 19:35:29 ----A---- C:\windows\system32\drivers\ksecdd.sys 2011-10-27 19:35:29 ----A---- C:\windows\system32\dnscmmc.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\wpdbusenum.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\wlanui.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\wkssvc.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\wksprt.exe 2011-10-27 19:35:28 ----A---- C:\windows\system32\w32tm.exe 2011-10-27 19:35:28 ----A---- C:\windows\system32\VAN.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\usercpl.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\srcore.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\SndVolSSO.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\SndVol.exe 2011-10-27 19:35:28 ----A---- C:\windows\system32\qedit.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\qdvd.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\prntvpt.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\PerfCenterCPL.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\netcenter.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\mprddm.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\mblctr.exe 2011-10-27 19:35:28 ----A---- C:\windows\system32\KMSVC.DLL 2011-10-27 19:35:28 ----A---- C:\windows\system32\iasacct.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\bcdsrv.dll 2011-10-27 19:35:28 ----A---- C:\windows\system32\batmeter.dll 2011-10-27 19:35:27 ----A---- C:\windows\system32\zipfldr.dll 2011-10-27 19:35:27 ----A---- C:\windows\system32\spwizeng.dll 2011-10-27 19:35:27 ----A---- C:\windows\system32\MSAC3ENC.DLL 2011-10-27 19:35:27 ----A---- C:\windows\system32\fdeploy.dll 2011-10-27 19:35:27 ----A---- C:\windows\system32\drivers\ks.sys 2011-10-27 19:35:27 ----A---- C:\windows\system32\azroleui.dll 2011-10-27 19:35:27 ----A---- C:\windows\system32\accessibilitycpl.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\wusa.exe 2011-10-27 19:35:26 ----A---- C:\windows\system32\sud.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\prnfldr.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\OnLineIDCpl.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\networkmap.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\netjoin.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\mspbda.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\MCEWMDRMNDBootstrap.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\Faultrep.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\cryptui.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\adsldp.dll 2011-10-27 19:35:26 ----A---- C:\windows\system32\ActionCenter.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\taskhost.exe 2011-10-27 19:35:25 ----A---- C:\windows\system32\taskbarcpl.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\slui.exe 2011-10-27 19:35:25 ----A---- C:\windows\system32\rdpcorekmts.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\photowiz.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\msieftp.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\MediaMetadataHandler.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\iprtrmgr.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\iasrad.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\drivers\hidclass.sys 2011-10-27 19:35:25 ----A---- C:\windows\system32\dot3cfg.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\defaultlocationcpl.dll 2011-10-27 19:35:25 ----A---- C:\windows\system32\credssp.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\wpd_ci.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\syncui.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\sisbkup.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\shwebsvc.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\sdcpl.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\recovery.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\ifsutil.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\ieUnatt.exe 2011-10-27 19:35:24 ----A---- C:\windows\system32\iesysprep.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\halacpi.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\ftp.exe 2011-10-27 19:35:24 ----A---- C:\windows\system32\efscore.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\autoplay.dll 2011-10-27 19:35:24 ----A---- C:\windows\system32\ActionCenterCPL.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\wmpmde.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\vdsutil.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\systemcpl.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\sppnp.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\SmartcardCredentialProvider.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\rtutils.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\recdisc.exe 2011-10-27 19:35:23 ----A---- C:\windows\system32\rdpwsx.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\OobeFldr.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\ntprint.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\ntlanman.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\dskquoui.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\DeviceCenter.dll 2011-10-27 19:35:23 ----A---- C:\windows\system32\bcdedit.exe 2011-10-27 19:35:22 ----A---- C:\windows\system32\wmpsrcwp.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\sethc.exe 2011-10-27 19:35:22 ----A---- C:\windows\system32\rstrui.exe 2011-10-27 19:35:22 ----A---- C:\windows\system32\riched20.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\nshwfp.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\netplwiz.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\NAPHLPR.DLL 2011-10-27 19:35:22 ----A---- C:\windows\system32\migisol.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\fms.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\drivers\tdx.sys 2011-10-27 19:35:22 ----A---- C:\windows\system32\dpx.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\blackbox.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\bcdboot.exe 2011-10-27 19:35:22 ----A---- C:\windows\system32\AxInstSv.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\AuxiliaryDisplayServices.dll 2011-10-27 19:35:22 ----A---- C:\windows\system32\activeds.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\nshipsec.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\nlaapi.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\httpapi.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\drivers\tssecsrv.sys 2011-10-27 19:35:21 ----A---- C:\windows\system32\dot3svc.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\cdosys.dll 2011-10-27 19:35:21 ----A---- C:\windows\system32\asycfilt.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wvc.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wuwebv.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wtsapi32.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wsqmcons.exe 2011-10-27 19:35:20 ----A---- C:\windows\system32\wlanmsm.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wimgapi.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\wavemsp.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\tzutil.exe 2011-10-27 19:35:20 ----A---- C:\windows\system32\sysclass.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\ReAgent.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\provsvc.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\ocsetup.exe 2011-10-27 19:35:20 ----A---- C:\windows\system32\msftedit.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\isoburn.exe 2011-10-27 19:35:20 ----A---- C:\windows\system32\dsuiext.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\drivers\ndproxy.sys 2011-10-27 19:35:20 ----A---- C:\windows\system32\dot3ui.dll 2011-10-27 19:35:20 ----A---- C:\windows\system32\dfrgui.exe 2011-10-27 19:35:20 ----A---- C:\windows\system32\appinfo.dll 2011-10-27 19:35:19 ----A---- C:\windows\twain_32.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\webcheck.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\twext.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\shdocvw.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\setupugc.exe 2011-10-27 19:35:19 ----A---- C:\windows\system32\qcap.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\qasf.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\PkgMgr.exe 2011-10-27 19:35:19 ----A---- C:\windows\system32\occache.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\mstask.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\msfeedsbs.dll 2011-10-27 19:35:19 ----A---- C:\windows\system32\certprop.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\wwanconn.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\wmdrmsdk.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\uxlib.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\ssText3d.scr 2011-10-27 19:35:18 ----A---- C:\windows\system32\srrstr.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\SmiEngine.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\slwga.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\nslookup.exe 2011-10-27 19:35:18 ----A---- C:\windows\system32\msvfw32.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\msrating.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\mciavi32.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\imm32.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\imgutil.dll 2011-10-27 19:35:18 ----A---- C:\windows\system32\audiodev.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\WPDShServiceObj.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\wimserv.exe 2011-10-27 19:35:17 ----A---- C:\windows\system32\TSpkg.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\sdrsvc.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\remotepg.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\rdpencom.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\raschap.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\QUTIL.DLL 2011-10-27 19:35:17 ----A---- C:\windows\system32\perfmon.exe 2011-10-27 19:35:17 ----A---- C:\windows\system32\NAPCRYPT.DLL 2011-10-27 19:35:17 ----A---- C:\windows\system32\msscp.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\input.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\drmmgrtn.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\diskraid.exe 2011-10-27 19:35:17 ----A---- C:\windows\system32\DevicePairingFolder.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\clusapi.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\browser.dll 2011-10-27 19:35:17 ----A---- C:\windows\system32\acppage.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\wpdwcn.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\wmpdxm.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\WindowsAnytimeUpgradeResults.exe 2011-10-27 19:35:16 ----A---- C:\windows\system32\vpnikeapi.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\vdsbas.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\UserAccountControlSettings.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\runonce.exe 2011-10-27 19:35:16 ----A---- C:\windows\system32\RegisterIEPKEYs.exe 2011-10-27 19:35:16 ----A---- C:\windows\system32\onexui.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\olepro32.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\ocsetapi.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\nltest.exe 2011-10-27 19:35:16 ----A---- C:\windows\system32\networkexplorer.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\Mcx2Svc.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\logagent.exe 2011-10-27 19:35:16 ----A---- C:\windows\system32\iTVData.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\inseng.dll 2011-10-27 19:35:16 ----A---- C:\windows\system32\dxdiagn.dll 2011-10-27 19:35:16 ----A---- C:\windows\bfsvc.exe 2011-10-27 19:35:15 ----A---- C:\windows\system32\sspisrv.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\wudriver.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\wmpshell.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\wmdrmdev.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\shacct.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\PnPUnattend.exe 2011-10-27 19:35:14 ----A---- C:\windows\system32\msvidc32.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\msiexec.exe 2011-10-27 19:35:14 ----A---- C:\windows\system32\MFPlay.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\lsmproxy.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\eapp3hst.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\drivers\rmcast.sys 2011-10-27 19:35:14 ----A---- C:\windows\system32\d3d10level9.dll 2011-10-27 19:35:14 ----A---- C:\windows\system32\bitsadmin.exe 2011-10-27 19:35:13 ----A---- C:\windows\system32\WUDFPlatform.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\WPDSp.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\unimdmat.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\tabcal.exe 2011-10-27 19:35:13 ----A---- C:\windows\system32\srvcli.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\sqlcese30.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\rdpd3d.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\PortableDeviceSyncProvider.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\pdh.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\OpcServices.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\ncryptui.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\mprapi.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\logman.exe 2011-10-27 19:35:13 ----A---- C:\windows\system32\iscsium.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\djoin.exe 2011-10-27 19:35:13 ----A---- C:\windows\system32\cscapi.dll 2011-10-27 19:35:13 ----A---- C:\windows\system32\Bubbles.scr 2011-10-27 19:35:12 ----A---- C:\windows\system32\wwanprotdim.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\WMPhoto.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\WMADMOD.DLL 2011-10-27 19:35:12 ----A---- C:\windows\system32\WindowsAnytimeUpgrade.exe 2011-10-27 19:35:12 ----A---- C:\windows\system32\wiavideo.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\utildll.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2011-10-27 19:35:12 ----A---- C:\windows\system32\tsgqec.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\takeown.exe 2011-10-27 19:35:12 ----A---- C:\windows\system32\Ribbons.scr 2011-10-27 19:35:12 ----A---- C:\windows\system32\QSVRMGMT.DLL 2011-10-27 19:35:12 ----A---- C:\windows\system32\PortableDeviceStatus.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\olethk32.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\Mystify.scr 2011-10-27 19:35:12 ----A---- C:\windows\system32\MdSched.exe 2011-10-27 19:35:12 ----A---- C:\windows\system32\mapistub.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\mapi32.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\lpremove.exe 2011-10-27 19:35:12 ----A---- C:\windows\system32\fphc.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\dot3msm.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\avifil32.dll 2011-10-27 19:35:12 ----A---- C:\windows\system32\ActionQueue.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\WUDFx.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\WMVSDECD.DLL 2011-10-27 19:35:11 ----A---- C:\windows\system32\wmdrmnet.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\unattend.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\sppinst.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\qdv.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\QCLIPROV.DLL 2011-10-27 19:35:11 ----A---- C:\windows\system32\msyuv.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\msrle32.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\msnetobj.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\iyuv_32.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\imagehlp.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\EhStorAPI.dll 2011-10-27 19:35:11 ----A---- C:\windows\system32\cmstp.exe 2011-10-27 19:35:11 ----A---- C:\windows\system32\cca.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\WUDFHost.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\wuauclt.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\wsnmp32.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\WMSPDMOD.DLL 2011-10-27 19:35:10 ----A---- C:\windows\system32\vfwwdm32.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\umb.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\tsbyuv.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\setupcln.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\RelPost.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\relog.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\PrintIsolationProxy.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\pdhui.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\netiougc.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\MuiUnattend.exe 2011-10-27 19:35:10 ----A---- C:\windows\system32\msorcl32.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\iasrecst.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\drivers\tcpipreg.sys 2011-10-27 19:35:10 ----A---- C:\windows\system32\drivers\ndisuio.sys 2011-10-27 19:35:10 ----A---- C:\windows\system32\basesrv.dll 2011-10-27 19:35:10 ----A---- C:\windows\system32\AzSqlExt.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\wkscli.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\WavDest.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\syssetup.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\sppuinotify.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\spbcd.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\setbcdlocale.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\secproc_ssp_isv.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\secproc_ssp.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\resutils.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\rastapi.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\nrpsrv.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\netbtugc.exe 2011-10-27 19:35:09 ----A---- C:\windows\system32\mydocs.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\MultiDigiMon.exe 2011-10-27 19:35:09 ----A---- C:\windows\system32\itircl.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\iscsicli.exe 2011-10-27 19:35:09 ----A---- C:\windows\system32\diskpart.exe 2011-10-27 19:35:09 ----A---- C:\windows\system32\CertPolEng.dll 2011-10-27 19:35:09 ----A---- C:\windows\system32\amstream.dll 2011-10-27 19:35:08 ----A---- C:\windows\system32\wuapp.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\wmpps.dll 2011-10-27 19:35:08 ----A---- C:\windows\system32\WerFaultSecure.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\tlscsp.dll 2011-10-27 19:35:08 ----A---- C:\windows\system32\secur32.dll 2011-10-27 19:35:08 ----A---- C:\windows\system32\RMActivate_ssp_isv.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\RMActivate_ssp.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\ReAgentc.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\FXSTIFF.dll 2011-10-27 19:35:08 ----A---- C:\windows\system32\findstr.exe 2011-10-27 19:35:08 ----A---- C:\windows\system32\eappgnui.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\wiarpc.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\sppc.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\netutils.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\netapi32.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\muifontsetup.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\mobsync.exe 2011-10-27 19:35:07 ----A---- C:\windows\system32\mciqtz32.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\iccvid.dll 2011-10-27 19:35:07 ----A---- C:\windows\system32\cabinet.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\wdiasqmmodule.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\unlodctr.exe 2011-10-27 19:35:06 ----A---- C:\windows\system32\spopk.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\shimgvw.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\repair-bde.exe 2011-10-27 19:35:06 ----A---- C:\windows\system32\rdprefdrvapi.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\netcfg.exe 2011-10-27 19:35:06 ----A---- C:\windows\system32\msdmo.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\manage-bde.exe 2011-10-27 19:35:06 ----A---- C:\windows\system32\luainstall.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\inetmib1.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\HotStartUserAgent.dll 2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\usbrpm.sys 2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\tdi.sys 2011-10-27 19:35:06 ----A---- C:\windows\system32\drivers\CompositeBus.sys 2011-10-27 19:35:06 ----A---- C:\windows\system32\dosx.exe 2011-10-27 19:35:05 ----A---- C:\windows\system32\wups.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\WUDFCoinstaller.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\UIRibbonRes.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\profprov.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\perfts.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\odbcconf.dll 2011-10-27 19:35:05 ----A---- C:\windows\system32\drivers\cdrom.sys 2011-10-27 19:35:05 ----A---- C:\windows\system32\browcli.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\wshbth.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\TRAPI.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\schedcli.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\RDPENCDD.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\napdsnap.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\msfeedssync.exe 2011-10-27 19:35:04 ----A---- C:\windows\system32\icaapi.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\FXSMON.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\elsTrans.dll 2011-10-27 19:35:04 ----A---- C:\windows\system32\drivers\tunnel.sys 2011-10-27 19:35:04 ----A---- C:\windows\system32\drivers\dfsc.sys 2011-10-27 19:35:04 ----A---- C:\windows\system32\bitsperf.dll 2011-10-27 19:35:03 ----A---- C:\windows\system32\wsdchngr.dll 2011-10-27 19:35:03 ----A---- C:\windows\system32\sscore.dll 2011-10-27 19:35:03 ----A---- C:\windows\system32\LogonUI.exe 2011-10-27 19:35:03 ----A---- C:\windows\system32\dsauth.dll 2011-10-27 19:35:03 ----A---- C:\windows\system32\drivers\acpipmi.sys 2011-10-27 19:35:03 ----A---- C:\windows\system32\cscdll.dll 2011-10-27 19:35:02 ----A---- C:\windows\system32\wups2.dll 2011-10-27 19:35:02 ----A---- C:\windows\system32\shgina.dll 2011-10-27 19:35:02 ----A---- C:\windows\system32\riched32.dll 2011-10-27 19:35:02 ----A---- C:\windows\system32\rdpcfgex.dll 2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\WUDFRd.sys 2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\ndiswan.sys 2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\hidusb.sys 2011-10-27 19:35:02 ----A---- C:\windows\system32\drivers\appid.sys 2011-10-27 19:35:01 ----A---- C:\windows\system32\wshirda.dll 2011-10-27 19:35:01 ----A---- C:\windows\system32\drivers\IPMIDrv.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\spwmp.dll 2011-10-27 19:35:00 ----A---- C:\windows\system32\RDPREFDD.dll 2011-10-27 19:35:00 ----A---- C:\windows\system32\dxmasf.dll 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\WUDFPf.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\wanarp.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\USBCAMD2.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\USBCAMD.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\umbus.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\tdtcp.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\tdpipe.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\sffp_sd.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\scfilter.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\RDPCDD.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\kbdhid.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\HdAudio.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\drivers\hdaudbus.sys 2011-10-27 19:35:00 ----A---- C:\windows\system32\C_ISCII.DLL 2011-10-27 19:35:00 ----A---- C:\windows\system32\browseui.dll 2011-10-27 19:34:59 ----A---- C:\windows\system32\wmploc.DLL 2011-10-27 19:34:59 ----A---- C:\windows\system32\shunimpl.dll 2011-10-27 19:34:58 ----A---- C:\windows\system32\pifmgr.dll 2011-10-27 19:34:58 ----A---- C:\windows\system32\nlsbres.dll 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDUS.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDUGHR1.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTURME.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTUQ.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTUF.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDTAJIK.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDSG.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDSF.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDPO.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDNEPR.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDMON.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDMAORI.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDLT1.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\kbdlk41a.dll 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINTEL.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINTAM.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINORI.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINMAR.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINKAN.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINHIN.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDINBEN.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGR1.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGKL.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDGEO.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDCZ1.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBULG.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBLR.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\KBDBASH.DLL 2011-10-27 19:34:58 ----A---- C:\windows\system32\dpnaddr.dll 2011-10-27 19:34:58 ----A---- C:\windows\system32\BlbEvents.dll 2011-10-27 19:34:57 ----A---- C:\windows\system32\spwizres.dll 2011-10-27 19:34:46 ----A---- C:\windows\system32\wdscore.dll 2011-10-27 19:34:38 ----A---- C:\windows\system32\wbemcomn.dll 2011-10-27 19:34:28 ----A---- C:\windows\system32\sqmapi.dll 2011-10-27 19:11:02 ----A---- C:\windows\system32\drivers\usbport.sys 2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbuhci.sys 2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbhub.sys 2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbehci.sys 2011-10-27 19:11:01 ----A---- C:\windows\system32\drivers\usbccgp.sys 2011-10-27 19:11:00 ----A---- C:\windows\system32\drivers\usbohci.sys 2011-10-27 19:11:00 ----A---- C:\windows\system32\drivers\usbd.sys 2011-10-27 19:10:56 ----A---- C:\windows\system32\esent.dll 2011-10-27 19:10:56 ----A---- C:\windows\system32\drivers\nvstor.sys 2011-10-27 19:10:56 ----A---- C:\windows\system32\drivers\ntfs.sys 2011-10-27 19:10:55 ----A---- C:\windows\system32\fsutil.exe 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\USBSTOR.SYS 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\storport.sys 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\nvraid.sys 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\iaStorV.sys 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\amdxata.sys 2011-10-27 19:10:55 ----A---- C:\windows\system32\drivers\amdsata.sys 2011-10-26 16:22:54 ----D---- C:\Program Files\Common Files\DESIGNER 2011-10-26 16:20:48 ----D---- C:\Program Files\Microsoft Analysis Services 2011-10-26 16:19:07 ----D---- C:\ProgramData\Microsoft Help 2011-10-26 16:18:40 ----RHD---- C:\MSOCache 2011-10-26 14:19:07 ----D---- C:\Program Files\MSXML 4.0 2011-10-26 14:15:53 ----A---- C:\windows\system32\prevhost.exe 2011-10-26 14:15:38 ----A---- C:\windows\system32\ieframe.dll 2011-10-26 14:15:37 ----A---- C:\windows\system32\mshtml.dll 2011-10-26 14:15:35 ----A---- C:\windows\system32\wininet.dll 2011-10-26 14:15:35 ----A---- C:\windows\system32\iertutil.dll 2011-10-26 14:15:34 ----A---- C:\windows\system32\urlmon.dll 2011-10-26 14:15:34 ----A---- C:\windows\system32\mshtmled.dll 2011-10-26 14:15:34 ----A---- C:\windows\system32\msfeeds.dll 2011-10-26 14:15:34 ----A---- C:\windows\system32\ieui.dll 2011-10-26 14:15:33 ----A---- C:\windows\system32\url.dll 2011-10-26 14:15:33 ----A---- C:\windows\system32\jsproxy.dll 2011-10-26 14:15:25 ----A---- C:\windows\system32\xmllite.dll 2011-10-26 14:15:16 ----A---- C:\windows\system32\win32k.sys 2011-10-26 14:15:12 ----A---- C:\windows\system32\tquery.dll 2011-10-26 14:15:12 ----A---- C:\windows\system32\SearchProtocolHost.exe 2011-10-26 14:15:12 ----A---- C:\windows\system32\SearchIndexer.exe 2011-10-26 14:15:12 ----A---- C:\windows\system32\mssvp.dll 2011-10-26 14:15:12 ----A---- C:\windows\system32\mssrch.dll 2011-10-26 14:15:12 ----A---- C:\windows\system32\mssph.dll 2011-10-26 14:15:11 ----A---- C:\windows\system32\SearchFilterHost.exe 2011-10-26 14:15:11 ----A---- C:\windows\system32\mssphtb.dll 2011-10-26 14:15:11 ----A---- C:\windows\system32\msscntrs.dll 2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srvnet.sys 2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srv2.sys 2011-10-26 14:15:07 ----A---- C:\windows\system32\drivers\srv.sys 2011-10-26 14:15:05 ----A---- C:\windows\system32\drivers\tcpip.sys 2011-10-26 14:15:05 ----A---- C:\windows\system32\drivers\FWPKCLNT.SYS 2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb20.sys 2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb10.sys 2011-10-26 14:15:03 ----A---- C:\windows\system32\drivers\mrxsmb.sys 2011-10-26 14:15:02 ----AH---- C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2011-10-26 14:15:02 ----AH---- C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2011-10-26 14:15:02 ----A---- C:\windows\system32\winsrv.dll 2011-10-26 14:15:02 ----A---- C:\windows\system32\KernelBase.dll 2011-10-26 14:15:02 ----A---- C:\windows\system32\kernel32.dll 2011-10-26 14:15:02 ----A---- C:\windows\system32\conhost.exe 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2011-10-26 14:15:01 ----AH---- C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2011-10-26 14:15:00 ----AH---- C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2011-10-26 14:14:59 ----A---- C:\windows\system32\drivers\afd.sys 2011-10-26 14:14:58 ----A---- C:\windows\system32\psisdecd.dll 2011-10-26 14:14:57 ----A---- C:\windows\system32\kerberos.dll 2011-10-26 14:14:56 ----A---- C:\windows\system32\WFS.exe 2011-10-26 14:14:56 ----A---- C:\windows\system32\FXSCOVER.exe 2011-10-26 14:14:55 ----A---- C:\windows\system32\vbscript.dll 2011-10-26 14:14:55 ----A---- C:\windows\system32\jscript.dll 2011-10-26 14:14:54 ----A---- C:\windows\system32\inetcomm.dll 2011-10-26 14:14:51 ----A---- C:\windows\system32\tzres.dll 2011-10-26 14:14:45 ----A---- C:\windows\system32\oleaut32.dll 2011-10-26 14:14:45 ----A---- C:\windows\system32\oleacc.dll 2011-10-26 14:14:38 ----A---- C:\windows\system32\CPFilters.dll 2011-10-26 14:14:37 ----A---- C:\windows\system32\sbe.dll 2011-10-26 14:14:37 ----A---- C:\windows\system32\EncDec.dll 2011-10-26 14:14:35 ----A---- C:\windows\system32\ntoskrnl.exe 2011-10-26 14:14:34 ----A---- C:\windows\system32\ntkrnlpa.exe 2011-10-26 14:14:25 ----A---- C:\windows\system32\odbctrac.dll 2011-10-26 14:14:25 ----A---- C:\windows\system32\odbcjt32.dll 2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccu32.dll 2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccr32.dll 2011-10-26 14:14:25 ----A---- C:\windows\system32\odbccp32.dll 2011-10-26 14:14:24 ----A---- C:\windows\system32\atmfd.dll 2011-10-26 14:14:23 ----A---- C:\windows\system32\fontsub.dll 2011-10-26 14:14:23 ----A---- C:\windows\system32\dnsrslvr.dll 2011-10-26 14:14:23 ----A---- C:\windows\system32\dnscacheugc.exe 2011-10-26 14:14:23 ----A---- C:\windows\system32\dnsapi.dll 2011-10-26 14:14:23 ----A---- C:\windows\system32\atmlib.dll 2011-10-26 14:14:22 ----A---- C:\windows\system32\XpsGdiConverter.dll 2011-10-26 14:14:20 ----A---- C:\windows\system32\umpnpmgr.dll 2011-10-26 14:14:20 ----A---- C:\windows\system32\cfgmgr32.dll 2011-10-26 14:14:12 ----A---- C:\windows\system32\drivers\bowser.sys 2011-10-26 14:13:53 ----A---- C:\windows\system32\XpsPrint.dll 2011-10-26 14:13:49 ----A---- C:\windows\system32\poqexec.exe 2011-10-26 14:13:49 ----A---- C:\windows\system32\mfc42.dll 2011-10-26 14:13:48 ----A---- C:\windows\system32\mfc42u.dll 2011-10-26 14:13:47 ----A---- C:\windows\explorer.exe 2011-10-26 14:13:45 ----A---- C:\windows\system32\d3d10_1core.dll 2011-10-26 14:13:45 ----A---- C:\windows\system32\d3d10_1.dll 2011-10-26 14:10:55 ----A---- C:\windows\system32\drivers\Diskdump.sys 2011-10-26 14:09:18 ----A---- C:\windows\system32\drivers\dxgmms1.sys 2011-10-26 14:09:18 ----A---- C:\windows\system32\drivers\dxgkrnl.sys 2011-10-26 14:09:18 ----A---- C:\windows\system32\cdd.dll 2011-10-26 13:07:59 ----D---- C:\Users\Franziska\AppData\Roaming\Avira 2011-10-26 13:07:33 ----A---- C:\windows\system32\drivers\ssmdrv.sys 2011-10-26 13:07:32 ----D---- C:\ProgramData\Avira 2011-10-26 13:07:32 ----D---- C:\Program Files\Avira 2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avkmgr.sys 2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avipbb.sys 2011-10-26 13:07:32 ----A---- C:\windows\system32\drivers\avgntflt.sys 2011-10-26 12:24:29 ----A---- C:\windows\BRWMARK.INI 2011-10-26 12:22:59 ----A---- C:\windows\system32\bd7030.dat 2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2S.dll 2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2L.dll 2011-10-26 12:22:24 ----N---- C:\windows\system32\BrDctF2.dll 2011-10-26 12:22:23 ----A---- C:\windows\system32\BrWia09b.dll 2011-10-26 12:22:23 ----A---- C:\windows\system32\BrUsi09a.dll 2011-10-26 12:22:22 ----A---- C:\windows\system32\BRTCPCON.DLL 2011-10-26 12:22:22 ----A---- C:\windows\system32\BRRBTOOL.EXE 2011-10-26 12:22:22 ----A---- C:\windows\system32\BRLMW03A.DLL 2011-10-26 12:22:21 ----N---- C:\windows\system32\NSSearch.dll 2011-10-26 12:22:21 ----D---- C:\Program Files\Brother 2011-10-26 12:22:21 ----A---- C:\windows\system32\BROSNMP.DLL 2011-10-26 12:22:19 ----A---- C:\windows\system32\BRLM03A.DLL 2011-10-26 12:22:18 ----A---- C:\windows\system32\BRLMW03A.INI 2011-10-26 12:21:55 ----D---- C:\Users\Franziska\AppData\Roaming\InstallShield 2011-10-26 12:21:10 ----D---- C:\Program Files\Nuance 2011-10-26 12:20:43 ----A---- C:\windows\maxlink.ini 2011-10-26 12:20:41 ----D---- C:\ProgramData\InstallShield 2011-10-26 12:20:15 ----D---- C:\Program Files\Common Files\ScanSoft Shared 2011-10-26 12:20:10 ----D---- C:\ProgramData\ScanSoft 2011-10-26 12:20:10 ----D---- C:\Program Files\ScanSoft 2011-10-26 12:19:39 ----D---- C:\Program Files\Microsoft Security Client 2011-10-26 12:19:31 ----D---- C:\ProgramData\Brother 2011-10-26 12:06:09 ----D---- C:\Users\Franziska\AppData\Roaming\Thunderbird 2011-10-26 12:05:14 ----D---- C:\Program Files\CCleaner 2011-10-26 11:32:19 ----D---- C:\Users\Franziska\AppData\Roaming\Identities 2011-10-26 11:32:11 ----SD---- C:\Users\Franziska\AppData\Roaming\Microsoft 2011-10-26 11:32:11 ----D---- C:\Users\Franziska\AppData\Roaming\Media Center Programs 2011-10-26 11:32:01 ----SHD---- C:\Programme 2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Vorlagen 2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Startmenü 2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Favoriten 2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Dokumente 2011-10-26 11:32:01 ----SHD---- C:\ProgramData\Anwendungsdaten 2011-10-26 11:32:01 ----SHD---- C:\Program Files\Gemeinsame Dateien 2011-10-26 11:32:01 ----SHD---- C:\Dokumente und Einstellungen 2011-10-26 10:43:21 ----D---- C:\Users\Franziska\AppData\Roaming\Mozilla 2011-10-26 10:43:14 ----D---- C:\Program Files\Mozilla Firefox 2011-10-26 10:41:48 ----D---- C:\Program Files\Mozilla Thunderbird 2011-10-26 10:26:29 ----ASH---- C:\pagefile.sys 2011-10-26 10:26:28 ----SHD---- C:\System Volume Information 2011-10-26 10:26:28 ----ASH---- C:\hiberfil.sys ======List of files/folders modified in the last 1 month====== 2011-11-02 13:12:24 ----D---- C:\windows\Temp 2011-11-02 13:12:06 ----RD---- C:\Program Files 2011-11-02 12:48:45 ----D---- C:\windows\system32\config 2011-11-02 12:48:18 ----D---- C:\windows\System32 2011-11-02 12:48:18 ----D---- C:\windows\inf 2011-11-02 12:48:18 ----A---- C:\windows\system32\PerfStringBackup.INI 2011-11-02 12:48:05 ----D---- C:\windows\system32\drivers 2011-11-02 12:45:11 ----D---- C:\Windows 2011-11-02 11:28:42 ----D---- C:\windows\Prefetch 2011-11-02 10:29:51 ----SHD---- C:\windows\Installer 2011-11-02 10:16:21 ----D---- C:\windows\system32\catroot2 2011-11-02 10:15:18 ----RSD---- C:\windows\Media 2011-11-02 09:36:48 ----D---- C:\windows\Microsoft.NET 2011-11-02 09:36:21 ----RSD---- C:\windows\assembly 2011-11-02 09:04:24 ----HD---- C:\ProgramData 2011-11-01 19:11:00 ----D---- C:\windows\winsxs 2011-11-01 14:15:50 ----D---- C:\Program Files\Common Files 2011-11-01 14:00:56 ----D---- C:\windows\system32\catroot 2011-10-31 11:42:33 ----D---- C:\windows\Panther 2011-10-31 11:42:32 ----D---- C:\windows\Logs 2011-10-31 07:18:45 ----D---- C:\windows\system32\DriverStore 2011-10-31 07:15:00 ----D---- C:\Program Files\Windows Sidebar 2011-10-31 07:15:00 ----D---- C:\Program Files\Windows Mail 2011-10-31 07:15:00 ----D---- C:\Program Files\DVD Maker 2011-10-31 07:14:59 ----D---- C:\Program Files\Windows Portable Devices 2011-10-31 07:14:59 ----D---- C:\Program Files\Internet Explorer 2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Photo Viewer 2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Media Player 2011-10-31 07:14:58 ----D---- C:\Program Files\Windows Journal 2011-10-31 07:14:53 ----D---- C:\Program Files\Windows Defender 2011-10-31 07:14:52 ----D---- C:\windows\servicing 2011-10-31 07:14:52 ----D---- C:\windows\ehome 2011-10-31 07:14:52 ----D---- C:\windows\de-DE 2011-10-31 07:14:38 ----D---- C:\windows\system32\da-DK 2011-10-31 07:14:38 ----D---- C:\windows\PolicyDefinitions 2011-10-31 07:14:37 ----D---- C:\windows\system32\de-DE 2011-10-31 07:14:34 ----D---- C:\windows\system32\oobe 2011-10-31 07:14:33 ----D---- C:\windows\system32\sysprep 2011-10-31 07:14:33 ----D---- C:\windows\system32\migration 2011-10-31 07:14:32 ----D---- C:\windows\system32\sppui 2011-10-31 07:14:32 ----D---- C:\windows\system32\Setup 2011-10-31 07:14:32 ----D---- C:\windows\system32\manifeststore 2011-10-31 07:14:32 ----D---- C:\windows\system32\es-ES 2011-10-31 07:14:32 ----D---- C:\windows\system32\cs-CZ 2011-10-31 07:14:32 ----D---- C:\windows\system32\AdvancedInstallers 2011-10-31 07:14:31 ----D---- C:\windows\system32\drivers\de-DE 2011-10-31 07:14:30 ----D---- C:\windows\system32\wbem 2011-10-31 07:14:29 ----D---- C:\windows\system32\migwiz 2011-10-31 07:14:29 ----D---- C:\windows\system32\Dism 2011-10-31 07:13:48 ----RSD---- C:\windows\Fonts 2011-10-31 07:13:46 ----D---- C:\windows\AppPatch 2011-10-31 07:13:37 ----D---- C:\windows\system32\Boot 2011-10-31 07:07:07 ----A---- C:\windows\system32\msclmd.dll 2011-10-30 23:26:30 ----D---- C:\windows\system32\wdi 2011-10-26 18:36:58 ----D---- C:\windows\debug 2011-10-26 16:37:43 ----SD---- C:\ProgramData\Microsoft 2011-10-26 16:37:43 ----D---- C:\Program Files\Microsoft Office 2011-10-26 16:23:47 ----D---- C:\windows\system32\Tasks 2011-10-26 16:23:12 ----D---- C:\Program Files\Common Files\microsoft shared 2011-10-26 16:22:45 ----D---- C:\Program Files\Microsoft.NET 2011-10-26 16:20:49 ----D---- C:\windows\ShellNew 2011-10-26 14:36:13 ----D---- C:\Program Files\Microsoft Silverlight 2011-10-26 13:02:48 ----D---- C:\windows\system32\LogFiles 2011-10-26 12:24:24 ----D---- C:\windows\twain_32 2011-10-26 12:22:13 ----HD---- C:\Program Files\InstallShield Installation Information 2011-10-26 12:20:15 ----D---- C:\windows\SoftwareDistribution 2011-10-26 12:20:15 ----D---- C:\windows\Downloaded Program Files 2011-10-26 12:20:15 ----D---- C:\Program Files\Common Files\InstallShield 2011-10-26 12:19:40 ----D---- C:\Program Files\Microsoft Security Essentials 2011-10-26 11:54:54 ----D---- C:\windows\system32\restore 2011-10-26 11:32:17 ----SHD---- C:\$Recycle.Bin 2011-10-26 11:32:09 ----RD---- C:\Users 2011-10-26 11:32:01 ----D---- C:\Program Files\Windows NT 2011-10-26 11:29:45 ----D---- C:\windows\rescache 2011-10-05 10:09:48 ----A---- C:\windows\system32\MRT.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 173440] R1 avipbb;avipbb; C:\windows\system32\DRIVERS\avipbb.sys [2011-10-11 134344] R1 avkmgr;avkmgr; C:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 36000] R1 MpFilter;Microsoft Malware Protection Driver; C:\windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216] R1 ssmdrv;ssmdrv; C:\windows\system32\DRIVERS\ssmdrv.sys [2010-06-17 28520] R2 avgntflt;avgntflt; C:\windows\system32\DRIVERS\avgntflt.sys [2011-10-11 74640] R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2010-07-28 9023488] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2010-07-06 3132712] R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI; C:\windows\system32\drivers\IntcHdmi.sys [2010-03-15 127488] R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\windows\system32\DRIVERS\L1E62x86.sys [2010-03-29 55848] R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368] S2 Parvdm;Parvdm; C:\windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704] S3 aic78xx;aic78xx; C:\windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720] S3 amdagp;AMD AGP-Bus-Filtertreiber; C:\windows\system32\drivers\amdagp.sys [2009-07-14 53312] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888] S3 fssfltr;FssFltr; C:\windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632] S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12368] S3 sisagp;SIS AGP-Bus-Filter; C:\windows\system32\drivers\sisagp.sys [2009-07-14 52304] S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\windows\System32\drivers\tsusbflt.sys [2010-11-20 52224] S3 usbscan;USB-Scannertreiber; C:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840] S3 viaagp;VIA AGP-Bus-Filter; C:\windows\system32\drivers\viaagp.sys [2009-07-14 53328] S3 ViaC7;VIA C7-Prozessortreiber; C:\windows\system32\DRIVERS\viac7.sys [2009-07-14 52736] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] R2 AntiVirMailService;Avira Email Schutz; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [2011-10-26 342480] R2 AntiVirSchedulerService;Avira Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2011-10-26 86224] R2 AntiVirService;Avira Echtzeit Scanner; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2011-10-26 110032] R2 AntiVirWebService;Avira Browser Schutz; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-10-26 463824] R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-07-27 249136] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] S2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25 17904] S3 fsssvc;Windows Live Family Safety-Dienst; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352] S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000] S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2010-10-15 1343400] -----------------EOF----------------- |
|
02.11.2011, 13:24
| #5 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! info.txtRSIT Logfile: Code:
ATTFilter logfile of random's system information tool 1.09 2011-11-02 13:12:27
======Uninstall list======
Adobe Flash Player 11 Plugin-->C:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe -maintain plugin
Adobe Reader X (10.1.1) - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-AA1000000001}
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\setup.exe" -runfromtemp -l0x0007 -removeonly
Avira Antivirus Premium 2012-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Brother MFL-Pro Suite DCP-7030-->"C:\Program Files\InstallShield Installation Information\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}\Setup.exe" -runfromtemp -l0x0007 UNINSTALL Reg=ALL2FB -removeonly
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{28857979-5507-4C10-A922-FF709A19D38C}" "1031" "0"
Intel(R) Graphics Media Accelerator Driver-->C:\Program Files\Intel\Intel(R) Graphics Media Accelerator Driver\Uninstall\setup.exe -uninstall
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Malwarebytes' Anti-Malware Version 1.51.2.1300-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Antimalware Service DE-DE Language Pack-->MsiExec.exe /X{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}
Microsoft Antimalware-->MsiExec.exe /X{E62A1F01-07B7-4541-A835-EE5B0BF064C2}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Access MUI (German) 2010-->MsiExec.exe /X{90140000-0015-0407-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2010-->MsiExec.exe /X{90140000-0016-0407-0000-0000000FF1CE}
Microsoft Office Home and Student 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall SINGLEIMAGE /dll OSETUP.DLL
Microsoft Office OneNote MUI (German) 2010-->MsiExec.exe /X{90140000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2010-->MsiExec.exe /X{90140000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2010-->MsiExec.exe /X{90140000-0018-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2010-->MsiExec.exe /X{90140000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2010-->MsiExec.exe /X{90140000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2010-->MsiExec.exe /X{90140000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2010-->MsiExec.exe /X{90140000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2010-->MsiExec.exe /X{90140000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2010-->MsiExec.exe /X{90140000-006E-0407-0000-0000000FF1CE}
Microsoft Office Single Image 2010-->MsiExec.exe /X{90140000-003D-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2010-->MsiExec.exe /X{90140000-001B-0407-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{928B06E4-DDAA-476A-926A-641620326327}
Microsoft Security Client DE-DE Language Pack-->MsiExec.exe /I{859B9BCA-5376-4566-9F88-C6C9DAA7A925}
Microsoft Security Client-->MsiExec.exe /I{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-->MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
Mozilla Firefox 7.0.1 (x86 de)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (7.0.1)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
PaperPort Image Printer-->MsiExec.exe /X{2BC2781A-F7F6-452E-95EB-018A522F1B2C}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
ScanSoft PaperPort 11-->MsiExec.exe /I{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {728D9A6A-2206-31E8-9F65-C3EABEFCF53E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7E97AB83-C1FE-38DE-B848-877E0A4BD81E} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DB31DEDD-BF95-31E7-A9B7-5480561CEFF3} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\setup.exe /uninstallpatch {728D9A6A-2206-31E8-9F65-C3EABEFCF53E} /parameterfolder ClientLP
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\setup.exe /uninstallpatch {2CE2EB39-45C8-32D4-8A99-5529C38F1B99} /parameterfolder ClientLP
Security Update for Microsoft Excel 2010 (KB2553070)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{294BAA9E-9209-497F-A71F-7E52EFB194D4}" "1031" "0"
Security Update for Microsoft Office 2010 (KB2289078)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{1D1A4F08-2F17-475B-BA72-476CE5992FEE}" "1031" "0"
Security Update for Microsoft Office 2010 (KB2553091)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{07CA44F3-F5B3-4D12-8C91-EDC5FE91D45C}" "1031" "0"
Security Update for Microsoft Office 2010 (KB2553096)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{10802A6D-EDBF-4383-BCBD-9D5B32F56D35}" "1031" "0"
Security Update for Microsoft Office 2010 (KB2584066)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EEB4DDD0-08EA-4787-BDAB-D38D67A35CD5}" "1031" "0"
Security Update for Microsoft PowerPoint 2010 (KB2519975)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{45D7C5CD-B967-44AF-9DAB-E5C8545558AD}" "1031" "0"
Security Update for Microsoft Publisher 2010 (KB2409055)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{C3C277D5-36E3-4B1A-926A-175B2BC019CF}" "1031" "0"
Security Update for Microsoft Word 2010 (KB2345000)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{A6D422EE-1196-45EE-B9AE-6B5B64975E8B}" "1031" "0"
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5E9CF3A4-ADB3-3080-A8BF-976A28340758} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->c:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {81EBB9D7-173C-32E3-B477-149C8DE075E4} /parameterfolder Client
Update for Microsoft Office 2010 (KB2202188)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{86B7A074-265D-420C-9E1E-7A920EF0ECA7}" "1031" "0"
Update for Microsoft Office 2010 (KB2494150)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}" "1031" "0"
Update for Microsoft Office 2010 (KB2523113)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{C0FF04BF-A05E-408B-81CA-B7FACDA508A3}" "1031" "0"
Update for Microsoft Office 2010 (KB2553065)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{A8686D24-1E89-43A1-973E-05A258D2B3F8}" "1031" "0"
Update for Microsoft Office 2010 (KB2566458)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EFB525A0-E1C0-4E32-9968-FE401BC87363}" "1031" "0"
Update for Microsoft OneNote 2010 (KB2493983)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{309EEC22-83CE-4109-B019-BA9392FAA322}" "1031" "0"
Update for Microsoft Outlook Social Connector (KB2583935)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0407-0000-0000000FF1CE}" "{EDED840F-DD92-47ED-A2E4-63F6AC745B92}" "1031" "0"
Update for Microsoft Outlook Social Connector (KB2583935)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-003D-0000-0000-0000000FF1CE}" "{EDF9874C-9E37-4110-9FC3-094247E114DF}" "1031" "0"
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Family Safety-->MsiExec.exe /X{994223F3-A99B-4DDD-9E1D-0190A17C6860}
Windows Live Fotogalerie-->MsiExec.exe /X{2BA722D1-48D1-406E-9123-8AE5431D63EF}
Windows Live Mail-->MsiExec.exe /I{C4D738F7-996A-4C81-B8FA-C4E26D767E41}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Live Movie Maker-->MsiExec.exe /X{3EFEF049-23D4-4B46-8903-4592FEA51018}
Windows Live Sync-->MsiExec.exe /X{76618402-179D-4699-A66B-D351C59436BC}
Windows Live Toolbar-->MsiExec.exe /X{70B7A167-0B88-445D-A3EA-97C73AA88CAC}
Windows Live Writer-->MsiExec.exe /X{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
======System event log======
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 7036
Message: Dienst "Windows Search" befindet sich jetzt im Status "Beendet".
Record Number: 1958
Source Name: Service Control Manager
Time Written: 20101015105913.372667-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 7040
Message: Der Starttyp des Diensts "Windows Search" wurde von Automatisch starten in Deaktiviert geändert.
Record Number: 1957
Source Name: Service Control Manager
Time Written: 20101015105912.561465-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 104
Message: Die Protokolldatei "Setup" wurde gelöscht.
Record Number: 1956
Source Name: Microsoft-Windows-Eventlog
Time Written: 20101015105900.674244-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 104
Message: Die Protokolldatei "Application" wurde gelöscht.
Record Number: 1955
Source Name: Microsoft-Windows-Eventlog
Time Written: 20101015105900.487044-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 104
Message: Die Protokolldatei "System" wurde gelöscht.
Record Number: 1954
Source Name: Microsoft-Windows-Eventlog
Time Written: 20101015105900.440244-000
Event Type: Informationen
User:
=====Application event log=====
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 1
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.
Record Number: 541
Source Name: SecurityCenter
Time Written: 20101015110132.000000-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 900
Message: Der Softwareschutzdienst wird gestartet.
Record Number: 540
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20101015110101.000000-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 1003
Message: Windows Search wurde gestartet.
Record Number: 539
Source Name: Microsoft-Windows-Search
Time Written: 20101015105913.000000-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 1013
Message: Windows Search wurde normal beendet.
Record Number: 538
Source Name: Microsoft-Windows-Search
Time Written: 20101015105913.000000-000
Event Type: Informationen
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 103
Message: Windows (1696) Windows: Das Datenbankmodul hat die Instanz (0) beendet.
Record Number: 537
Source Name: ESENT
Time Written: 20101015105913.000000-000
Event Type: Informationen
User:
=====Security event log=====
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.
Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: WIN-Q5NRK5FKD4T$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7
Anmeldetyp: 5
Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}
Prozessinformationen:
Prozess-ID: 0x1ec
Prozessname: C:\Windows\System32\services.exe
Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -
Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0
Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 507
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101015105916.040271-000
Event Type: Überwachung erfolgreich
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.
Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Berechtigungen: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 506
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101015105913.887467-000
Event Type: Überwachung erfolgreich
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.
Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: WIN-Q5NRK5FKD4T$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7
Anmeldetyp: 5
Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}
Prozessinformationen:
Prozess-ID: 0x1ec
Prozessname: C:\Windows\System32\services.exe
Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -
Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0
Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 505
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101015105913.887467-000
Event Type: Überwachung erfolgreich
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 4738
Message: Ein Benutzerkonto wurde geändert.
Antragsteller:
Sicherheits-ID: S-1-5-21-4132121745-112448264-3429239847-500
Kontoname: Administrator
Kontodomäne: WIN-Q5NRK5FKD4T
Anmelde-ID: 0x1faa2
Zielkonto:
Sicherheits-ID: S-1-5-21-4132121745-112448264-3429239847-500
Kontoname: Administrator
Kontodomäne: WIN-Q5NRK5FKD4T
Geänderte Attribute:
SAM-Kontoname: -
Anzeigename: -
Benutzerprinzipalname: -
Stammverzeichnis: -
Stammlaufwerk: -
Skriptpfad: -
Profilpfad: -
Benutzerarbeitsstationen: -
Letzte Kennwortänderung: -
Konto gültig bis: -
Primäre Gruppen-ID: -
Darf delegieren an: -
Alter Benutzerkontensteuerungswert: 0x211
Neuer Benutzerkontensteuerungswert: 0x211
Benutzerkontensteuerung: -
Benutzerparameter: -
SID-Verlauf: -
Anmeldezeiten: -
Weitere Informationen:
Berechtigungen: -
Record Number: 504
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20101015105900.892645-000
Event Type: Überwachung erfolgreich
User:
Computer Name: WIN-Q5NRK5FKD4T
Event Code: 1102
Message: Das Überwachungsprotokoll wurde gelöscht.
Subjekt:
Sicherheits-ID: S-1-5-21-4132121745-112448264-3429239847-500
Kontoname: Administrator
Domänenname: WIN-Q5NRK5FKD4T
Anmelde-ID: 0x1faa2
Record Number: 503
Source Name: Microsoft-Windows-Eventlog
Time Written: 20101015105900.596244-000
Event Type: Überwachung erfolgreich
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=2
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=170a
"configsetroot"=%SystemRoot%\ConfigSetRoot
-----------------EOF-----------------
|
|
02.11.2011, 13:28
| #6 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! EDIT: sorry, Doppelpost... Geändert von Lady Curious (02.11.2011 um 13:36 Uhr) |
|
02.11.2011, 14:36
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Führ bitte auch ESET aus, danach sehen wir weiter: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
02.11.2011, 17:23
| #8 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Das ist das logfile von ESET: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=aca1b3df0d30994491502ffc8c7c5538 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-02 04:14:25 # local_time=2011-11-02 05:14:25 (+0100, Mitteleuropäische Zeit ) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=512 16777215 100 0 12162 12162 0 0 # compatibility_mode=1792 16777215 100 0 617254 617254 0 0 # compatibility_mode=5893 16776574 100 94 258 72714497 0 0 # compatibility_mode=8192 67108863 100 0 6413 6413 0 0 # scanned=148946 # found=0 # cleaned=0 # scan_time=2369 |
|
02.11.2011, 17:26
| #9 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=aca1b3df0d30994491502ffc8c7c5538 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-02 04:14:25 # local_time=2011-11-02 05:14:25 (+0100, Mitteleuropäische Zeit ) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=512 16777215 100 0 12162 12162 0 0 # compatibility_mode=1792 16777215 100 0 617254 617254 0 0 # compatibility_mode=5893 16776574 100 94 258 72714497 0 0 # compatibility_mode=8192 67108863 100 0 6413 6413 0 0 # scanned=148946 # found=0 # cleaned=0 # scan_time=2369 |
|
02.11.2011, 20:16
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.11.2011, 07:37
| #11 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! falscher post Geändert von Lady Curious (03.11.2011 um 07:56 Uhr) |
|
03.11.2011, 07:53
| #12 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! OTL Logfile: Code:
ATTFilter OTL logfile created on: 03.11.2011 07:26:10 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Franziska\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,93 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 69,26% Memory free 3,87 Gb Paging File | 3,03 Gb Available in Paging File | 78,43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 460,78 Gb Total Space | 433,65 Gb Free Space | 94,11% Space Free | Partition Type: NTFS Drive F: | 596,17 Gb Total Space | 374,83 Gb Free Space | 62,87% Space Free | Partition Type: NTFS Drive G: | 1,87 Gb Total Space | 0,84 Gb Free Space | 45,06% Space Free | Partition Type: FAT32 Computer Name: FRANZISKA-PC | User Name: Franziska | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe PRC - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2011.10.26 16:46:26 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe PRC - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.26 16:46:15 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.07.27 13:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe PRC - [2009.03.30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe ========== Modules (No Company Name) ========== MOD - [2009.02.27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Programme\Brother\BrUtilities\BrLogAPI.dll ========== Win32 Services (SafeList) ========== SRV - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.10.15 10:41:51 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.03.29 10:15:37 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E) DRV - [2010.03.25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon) DRV - [2010.03.15 20:14:48 | 000,127,488 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E FA 70 DB 65 99 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.10.15 10:00:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.26 10:43:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.26 10:41:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.10.26 10:43:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Franziska\AppData\Roaming\mozilla\Extensions [2011.10.26 10:43:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4AAC6283-3DB7-45A9-8046-DF1FED708EE9}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.03 07:22:44 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe [2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro [2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\rsit [2011.11.02 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes [2011.11.02 09:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.02 09:04:20 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2011.11.02 09:04:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.11.01 16:12:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Macromedia [2011.11.01 16:12:41 | 000,000,000 | ---D | C] -- C:\windows\System32\Macromed [2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Adobe [2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Adobe [2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2011.11.01 14:14:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2011.10.31 07:58:01 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders [2011.10.31 07:10:46 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Brother [2011.10.31 06:58:59 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview [2011.10.27 19:35:22 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\System32\fms.dll [2011.10.26 16:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.10.26 16:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2011.10.26 16:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2011.10.26 16:20:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services [2011.10.26 16:19:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft Help [2011.10.26 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.10.26 16:18:40 | 000,000,000 | RH-D | C] -- C:\MSOCache [2011.10.26 14:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2011.10.26 13:07:59 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Avira [2011.10.26 13:07:33 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys [2011.10.26 13:07:32 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys [2011.10.26 13:07:32 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys [2011.10.26 13:07:32 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys [2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.10.26 12:34:01 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Diagnostics [2011.10.26 12:27:04 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Scansoft [2011.10.26 12:24:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother [2011.10.26 12:22:24 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2.dll [2011.10.26 12:22:24 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2L.dll [2011.10.26 12:22:24 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2S.dll [2011.10.26 12:22:23 | 001,534,464 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrWia09b.dll [2011.10.26 12:22:23 | 000,053,760 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrUsi09a.dll [2011.10.26 12:22:22 | 000,111,928 | ---- | C] (Brother Industries Ltd) -- C:\windows\System32\BRRBTOOL.EXE [2011.10.26 12:22:22 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BRLMW03A.DLL [2011.10.26 12:22:21 | 000,176,128 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BROSNMP.DLL [2011.10.26 12:22:21 | 000,167,936 | ---- | C] (brother) -- C:\windows\System32\NSSearch.dll [2011.10.26 12:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Brother [2011.10.26 12:22:19 | 000,024,223 | ---- | C] (Brother Industries, Ltd) -- C:\windows\System32\BRLM03A.DLL [2011.10.26 12:21:55 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\InstallShield [2011.10.26 12:21:10 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance [2011.10.26 12:20:41 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield [2011.10.26 12:20:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft PaperPort 11 [2011.10.26 12:20:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared [2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft [2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\Program Files\ScanSoft [2011.10.26 12:19:39 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2011.10.26 12:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother [2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Thunderbird [2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Thunderbird [2011.10.26 12:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.10.26 12:05:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Searches [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.10.26 11:32:19 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Identities [2011.10.26 11:32:17 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Contacts [2011.10.26 11:32:13 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\VirtualStore [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Vorlagen [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Verlauf [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Temporary Internet Files [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Startmenü [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\SendTo [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Recent [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Netzwerkumgebung [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Lokale Einstellungen [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Videos [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Musik [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Eigene Dateien [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Bilder [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Druckumgebung [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Cookies [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Anwendungsdaten [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Anwendungsdaten [2011.10.26 11:32:11 | 000,000,000 | --SD | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Videos [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Saved Games [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Pictures [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Music [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Links [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Favorites [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Downloads [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Documents [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Desktop [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.10.26 11:32:11 | 000,000,000 | -H-D | C] -- C:\Users\Franziska\AppData [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Temp [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Programme [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Mozilla [2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Mozilla [2011.10.26 10:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2011.10.26 10:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2011.10.26 10:26:28 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2010.07.28 19:20:56 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll ========== Files - Modified Within 30 Days ========== [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe [2011.11.03 07:06:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2011.11.03 07:05:58 | 1558,159,360 | -HS- | M] () -- C:\hiberfil.sys [2011.11.03 07:05:18 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.03 07:05:17 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.02 14:43:52 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat [2011.11.02 14:43:52 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat [2011.11.02 14:43:52 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat [2011.11.02 14:43:52 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat [2011.11.01 14:16:28 | 000,001,997 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.10.31 16:53:54 | 000,000,432 | ---- | M] () -- C:\windows\BRWMARK.INI [2011.10.31 12:30:38 | 000,341,504 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2011.10.26 13:43:22 | 000,006,012 | ---- | M] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx [2011.10.26 12:24:29 | 000,000,065 | ---- | M] () -- C:\windows\System32\bd7030.dat [2011.10.26 12:20:15 | 000,002,153 | ---- | M] () -- C:\windows\epplauncher.mif [2011.10.26 12:05:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.10.26 11:31:23 | 000,052,953 | ---- | M] () -- C:\windows\System32\license.rtf [2011.10.26 10:43:15 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\Firefox.lnk [2011.10.26 10:41:49 | 000,002,040 | ---- | M] () -- C:\Users\Public\Desktop\Thunderbird.lnk [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys ========== Files Created - No Company Name ========== [2011.11.01 14:16:28 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.11.01 14:16:28 | 000,001,997 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.10.27 19:36:05 | 000,146,852 | ---- | C] () -- C:\windows\System32\systemsf.ebd [2011.10.27 19:35:04 | 000,010,429 | ---- | C] () -- C:\windows\System32\ScavengeSpace.xml [2011.10.27 19:34:57 | 000,105,559 | ---- | C] () -- C:\windows\System32\RacRules.xml [2011.10.26 13:43:20 | 000,006,012 | ---- | C] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx [2011.10.26 12:24:29 | 000,000,432 | ---- | C] () -- C:\windows\BRWMARK.INI [2011.10.26 12:22:59 | 000,000,065 | ---- | C] () -- C:\windows\System32\bd7030.dat [2011.10.26 12:22:22 | 000,045,056 | ---- | C] () -- C:\windows\System32\BRTCPCON.DLL [2011.10.26 12:22:18 | 000,000,114 | ---- | C] () -- C:\windows\System32\BRLMW03A.INI [2011.10.26 12:20:43 | 000,031,864 | ---- | C] () -- C:\windows\maxlink.ini [2011.10.26 12:20:15 | 000,002,153 | ---- | C] () -- C:\windows\epplauncher.mif [2011.10.26 12:05:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.10.26 11:33:03 | 000,001,413 | ---- | C] () -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.10.26 10:43:15 | 000,001,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.10.26 10:43:15 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\Firefox.lnk [2011.10.26 10:41:49 | 000,002,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk [2011.10.26 10:41:49 | 000,002,040 | ---- | C] () -- C:\Users\Public\Desktop\Thunderbird.lnk [2011.10.26 10:26:28 | 1558,159,360 | -HS- | C] () -- C:\hiberfil.sys [2010.06.02 21:05:28 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin [2010.06.02 21:05:24 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin [2010.06.02 21:05:24 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin [2010.06.02 20:19:12 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config [2010.06.02 20:15:30 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll [2010.06.02 20:15:28 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll [2010.03.15 20:14:34 | 000,005,120 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll [2009.07.14 09:47:43 | 000,653,928 | ---- | C] () -- C:\windows\System32\perfh007.dat [2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat [2009.07.14 09:47:43 | 000,129,800 | ---- | C] () -- C:\windows\System32\perfc007.dat [2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat [2009.07.14 05:33:53 | 000,341,504 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll [2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\windows\System32\igfcg500.bin [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat ========== LOP Check ========== [2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird [2009.07.14 05:53:46 | 000,009,700 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.11.01 14:24:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Adobe [2011.10.26 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Avira [2011.10.31 07:10:46 | 000,000,000 | R--D | M] -- C:\Users\Franziska\AppData\Roaming\Brother [2011.10.26 11:32:19 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Identities [2011.10.26 12:21:55 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\InstallShield [2011.11.01 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Macromedia [2011.11.02 09:04:30 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes [2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs [2011.11.02 16:28:10 | 000,000,000 | --SD | M] -- C:\Users\Franziska\AppData\Roaming\Microsoft [2011.10.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Mozilla [2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < End of report > |
|
03.11.2011, 07:54
| #13 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! OTL Logfile: Code:
ATTFilter OTL logfile created on: 03.11.2011 07:26:10 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Franziska\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,93 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 69,26% Memory free 3,87 Gb Paging File | 3,03 Gb Available in Paging File | 78,43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 460,78 Gb Total Space | 433,65 Gb Free Space | 94,11% Space Free | Partition Type: NTFS Drive F: | 596,17 Gb Total Space | 374,83 Gb Free Space | 62,87% Space Free | Partition Type: NTFS Drive G: | 1,87 Gb Total Space | 0,84 Gb Free Space | 45,06% Space Free | Partition Type: FAT32 Computer Name: FRANZISKA-PC | User Name: Franziska | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe PRC - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2011.10.26 16:46:26 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe PRC - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.26 16:46:15 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.07.27 13:46:08 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe PRC - [2009.03.30 15:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe ========== Modules (No Company Name) ========== MOD - [2009.02.27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Programme\Brother\BrUtilities\BrLogAPI.dll ========== Win32 Services (SafeList) ========== SRV - [2011.10.26 16:47:15 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.26 16:46:28 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.10.26 16:46:18 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2011.10.26 16:46:16 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.10.15 10:41:51 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.03.29 10:15:37 | 000,055,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E62x86.sys -- (L1E) DRV - [2010.03.25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon) DRV - [2010.03.15 20:14:48 | 000,127,488 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E FA 70 DB 65 99 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.10.15 10:00:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.26 10:43:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.10.26 10:41:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.10.26 10:43:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Franziska\AppData\Roaming\mozilla\Extensions [2011.10.26 10:43:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4AAC6283-3DB7-45A9-8046-DF1FED708EE9}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.03 07:22:44 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe [2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro [2011.11.02 13:12:06 | 000,000,000 | ---D | C] -- C:\rsit [2011.11.02 09:04:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes [2011.11.02 09:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.02 09:04:20 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2011.11.02 09:04:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.11.01 16:12:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Macromedia [2011.11.01 16:12:41 | 000,000,000 | ---D | C] -- C:\windows\System32\Macromed [2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Adobe [2011.11.01 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Adobe [2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2011.11.01 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2011.11.01 14:14:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2011.10.31 07:58:01 | 000,000,000 | ---D | C] -- C:\windows\System32\EventProviders [2011.10.31 07:10:46 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Brother [2011.10.31 06:58:59 | 000,000,000 | ---D | C] -- C:\windows\System32\SPReview [2011.10.27 19:35:22 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\System32\fms.dll [2011.10.26 16:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.10.26 16:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2011.10.26 16:22:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2011.10.26 16:20:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Analysis Services [2011.10.26 16:19:30 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft Help [2011.10.26 16:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2011.10.26 16:18:40 | 000,000,000 | RH-D | C] -- C:\MSOCache [2011.10.26 14:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2011.10.26 13:07:59 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Avira [2011.10.26 13:07:33 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys [2011.10.26 13:07:32 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys [2011.10.26 13:07:32 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys [2011.10.26 13:07:32 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys [2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.10.26 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.10.26 12:34:01 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Diagnostics [2011.10.26 12:27:04 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Scansoft [2011.10.26 12:24:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother [2011.10.26 12:22:24 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2.dll [2011.10.26 12:22:24 | 000,005,632 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2L.dll [2011.10.26 12:22:24 | 000,003,072 | ---- | C] (Brother Industries Ltd.) -- C:\windows\System32\BrDctF2S.dll [2011.10.26 12:22:23 | 001,534,464 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrWia09b.dll [2011.10.26 12:22:23 | 000,053,760 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BrUsi09a.dll [2011.10.26 12:22:22 | 000,111,928 | ---- | C] (Brother Industries Ltd) -- C:\windows\System32\BRRBTOOL.EXE [2011.10.26 12:22:22 | 000,077,824 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BRLMW03A.DLL [2011.10.26 12:22:21 | 000,176,128 | ---- | C] (Brother Industries, Ltd.) -- C:\windows\System32\BROSNMP.DLL [2011.10.26 12:22:21 | 000,167,936 | ---- | C] (brother) -- C:\windows\System32\NSSearch.dll [2011.10.26 12:22:21 | 000,000,000 | ---D | C] -- C:\Program Files\Brother [2011.10.26 12:22:19 | 000,024,223 | ---- | C] (Brother Industries, Ltd) -- C:\windows\System32\BRLM03A.DLL [2011.10.26 12:21:55 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\InstallShield [2011.10.26 12:21:10 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance [2011.10.26 12:20:41 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield [2011.10.26 12:20:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft PaperPort 11 [2011.10.26 12:20:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ScanSoft Shared [2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft [2011.10.26 12:20:10 | 000,000,000 | ---D | C] -- C:\Program Files\ScanSoft [2011.10.26 12:19:39 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2011.10.26 12:19:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother [2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Thunderbird [2011.10.26 12:06:09 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Thunderbird [2011.10.26 12:05:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.10.26 12:05:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Searches [2011.10.26 11:32:27 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.10.26 11:32:19 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Identities [2011.10.26 11:32:17 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Contacts [2011.10.26 11:32:13 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\VirtualStore [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Vorlagen [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Verlauf [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Temporary Internet Files [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Startmenü [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\SendTo [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Recent [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Netzwerkumgebung [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Lokale Einstellungen [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Videos [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Musik [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Eigene Dateien [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Documents\Eigene Bilder [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Druckumgebung [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Cookies [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\AppData\Local\Anwendungsdaten [2011.10.26 11:32:12 | 000,000,000 | -HSD | C] -- C:\Users\Franziska\Anwendungsdaten [2011.10.26 11:32:11 | 000,000,000 | --SD | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Videos [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Saved Games [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Pictures [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Music [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Links [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Favorites [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Downloads [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Documents [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\Desktop [2011.10.26 11:32:11 | 000,000,000 | R--D | C] -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.10.26 11:32:11 | 000,000,000 | -H-D | C] -- C:\Users\Franziska\AppData [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Temp [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Microsoft [2011.10.26 11:32:11 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Programme [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.10.26 11:32:01 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Roaming\Mozilla [2011.10.26 10:43:21 | 000,000,000 | ---D | C] -- C:\Users\Franziska\AppData\Local\Mozilla [2011.10.26 10:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2011.10.26 10:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird [2011.10.26 10:26:28 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2010.07.28 19:20:56 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll ========== Files - Modified Within 30 Days ========== [2011.11.03 07:22:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Franziska\Desktop\OTL.exe [2011.11.03 07:06:07 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2011.11.03 07:05:58 | 1558,159,360 | -HS- | M] () -- C:\hiberfil.sys [2011.11.03 07:05:18 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.03 07:05:17 | 000,012,544 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.02 14:43:52 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat [2011.11.02 14:43:52 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat [2011.11.02 14:43:52 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat [2011.11.02 14:43:52 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat [2011.11.01 14:16:28 | 000,001,997 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.10.31 16:53:54 | 000,000,432 | ---- | M] () -- C:\windows\BRWMARK.INI [2011.10.31 12:30:38 | 000,341,504 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2011.10.26 13:43:22 | 000,006,012 | ---- | M] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx [2011.10.26 12:24:29 | 000,000,065 | ---- | M] () -- C:\windows\System32\bd7030.dat [2011.10.26 12:20:15 | 000,002,153 | ---- | M] () -- C:\windows\epplauncher.mif [2011.10.26 12:05:15 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.10.26 11:31:23 | 000,052,953 | ---- | M] () -- C:\windows\System32\license.rtf [2011.10.26 10:43:15 | 000,001,100 | ---- | M] () -- C:\Users\Public\Desktop\Firefox.lnk [2011.10.26 10:41:49 | 000,002,040 | ---- | M] () -- C:\Users\Public\Desktop\Thunderbird.lnk [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avkmgr.sys ========== Files Created - No Company Name ========== [2011.11.01 14:16:28 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.11.01 14:16:28 | 000,001,997 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.10.27 19:36:05 | 000,146,852 | ---- | C] () -- C:\windows\System32\systemsf.ebd [2011.10.27 19:35:04 | 000,010,429 | ---- | C] () -- C:\windows\System32\ScavengeSpace.xml [2011.10.27 19:34:57 | 000,105,559 | ---- | C] () -- C:\windows\System32\RacRules.xml [2011.10.26 13:43:20 | 000,006,012 | ---- | C] () -- C:\Users\Franziska\Documents\Holzhauer Franziska.pfx [2011.10.26 12:24:29 | 000,000,432 | ---- | C] () -- C:\windows\BRWMARK.INI [2011.10.26 12:22:59 | 000,000,065 | ---- | C] () -- C:\windows\System32\bd7030.dat [2011.10.26 12:22:22 | 000,045,056 | ---- | C] () -- C:\windows\System32\BRTCPCON.DLL [2011.10.26 12:22:18 | 000,000,114 | ---- | C] () -- C:\windows\System32\BRLMW03A.INI [2011.10.26 12:20:43 | 000,031,864 | ---- | C] () -- C:\windows\maxlink.ini [2011.10.26 12:20:15 | 000,002,153 | ---- | C] () -- C:\windows\epplauncher.mif [2011.10.26 12:05:15 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.10.26 11:33:03 | 000,001,413 | ---- | C] () -- C:\Users\Franziska\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.10.26 10:43:15 | 000,001,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.10.26 10:43:15 | 000,001,100 | ---- | C] () -- C:\Users\Public\Desktop\Firefox.lnk [2011.10.26 10:41:49 | 000,002,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk [2011.10.26 10:41:49 | 000,002,040 | ---- | C] () -- C:\Users\Public\Desktop\Thunderbird.lnk [2011.10.26 10:26:28 | 1558,159,360 | -HS- | C] () -- C:\hiberfil.sys [2010.06.02 21:05:28 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin [2010.06.02 21:05:24 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin [2010.06.02 21:05:24 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin [2010.06.02 20:19:12 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config [2010.06.02 20:15:30 | 000,208,896 | ---- | C] () -- C:\windows\System32\iglhsip32.dll [2010.06.02 20:15:28 | 000,143,360 | ---- | C] () -- C:\windows\System32\iglhcp32.dll [2010.03.15 20:14:34 | 000,005,120 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll [2009.07.14 09:47:43 | 000,653,928 | ---- | C] () -- C:\windows\System32\perfh007.dat [2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat [2009.07.14 09:47:43 | 000,129,800 | ---- | C] () -- C:\windows\System32\perfc007.dat [2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat [2009.07.14 05:33:53 | 000,341,504 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,615,810 | ---- | C] () -- C:\windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,106,190 | ---- | C] () -- C:\windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\windows\System32\dssec.dat [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\windows\System32\BWContextHandler.dll [2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\windows\System32\igfcg500.bin [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat ========== LOP Check ========== [2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird [2009.07.14 05:53:46 | 000,009,700 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.11.01 14:24:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Adobe [2011.10.26 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Avira [2011.10.31 07:10:46 | 000,000,000 | R--D | M] -- C:\Users\Franziska\AppData\Roaming\Brother [2011.10.26 11:32:19 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Identities [2011.10.26 12:21:55 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\InstallShield [2011.11.01 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Macromedia [2011.11.02 09:04:30 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Malwarebytes [2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Media Center Programs [2011.11.02 16:28:10 | 000,000,000 | --SD | M] -- C:\Users\Franziska\AppData\Roaming\Microsoft [2011.10.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Mozilla [2011.10.26 12:06:09 | 000,000,000 | ---D | M] -- C:\Users\Franziska\AppData\Roaming\Thunderbird < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < End of report > |
|
03.11.2011, 10:58
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Log ist unauffällig. Entweder war der gefunde Link von Malwarebytes ein Fehlalarm oder ein unbedeutender Überrest. Noch Probleme oder gab es überhaupt welche?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.11.2011, 11:08
| #15 |
| | Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! Hallo Cosinus, erstmal danke für deine prompte und kompetente Hilfe! Nein, Probleme sind mir keine aufgefallen (aber ich weiß das ja auch nicht so wirklich, auf was ich achten muss...), auch ein erneuter Avira- sowie Malwarebytes-Scan war unauffällig. Wollte eben einfach auf Nummer sicher gehen, da ich relativ viel mit dem Computer arbeite und da keine Probleme möchte. Liebe Grüße, Lady Curious |
|
| Themen zu Malwarebytes Logfile: Infizierte File "Rogue.ControlCenter" - was ist das? Bitte um Hilfe! |
| computern, flash-player, system neu |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
