| |
| |||||||
Log-Analyse und Auswertung: BOO/Shertwil.L in Bootsektor gefunden!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
23.11.2011, 05:33
| #1 |
| |  BOO/Shertwil.L in Bootsektor gefunden! Seit vorigen Freitag wird bei mir von AVIRA im Masterbootsektor und in Bootsektor HD folgendes gefunden: BOO/Shertwil.L Entfernen wird angeboten. Nach Neustart ist er trotzdem wieder da. Malwarebytes hat folgendes ergeben: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8218 Windows 6.1.7601 Service Pack 1 Internet Explorer X.X.X.XXXXX 22.11.2011 19:45:58 mbam-log-2011-11-22 (19-45-58).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 172389 Laufzeit: 2 Minute(n), 57 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) ESET ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=f1487f20cdea4d46bf5d576ba5aa20a0 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-22 10:07:40 # local_time=2011-11-22 11:07:40 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 3478719 3478719 0 0 # compatibility_mode=4096 16777215 100 0 0 0 0 0 # compatibility_mode=5893 16776573 100 94 7144366 73619139 0 0 # compatibility_mode=8192 67108863 100 0 4504 4504 0 0 # scanned=583184 # found=9 # cleaned=0 # scan_time=10371 C:\ProgramData\Spybot - Search & Destroy\Recovery\ToolbarFacemood50.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I C:\Users\All Users\Spybot - Search & Destroy\Recovery\ToolbarFacemood50.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I C:\Users\Nico\Downloads\SoftonicDownloader_fuer_7-zip.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I C:\Users\Nico\Downloads\SoftonicDownloader_fuer_winzip.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I E:\C backup\Lokaler Datenträger (D)\Programme\Spiel\Hentai 3D 2\XP_Only\Binaries\fcHentai3DRun.DE.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I E:\C backup\Lokaler Datenträger (D)\Programme\Spiel\Hentai 3D 2\XP_Only\Binaries\fcHentai3DRun.EN.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I E:\C backup\Lokaler Datenträger (D)\Programme\thriXXX\Hentai 3D 2 - Cry of Pleasure\Binaries\fcHentai3DRun.DE.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I E:\C backup\Lokaler Datenträger (D)\Programme\thriXXX\Hentai 3D 2 - Cry of Pleasure\Binaries\fcHentai3DRun.EN.exe a variant of Win32/Inject.NDT trojan (unable to clean) 00000000000000000000000000000000 I E:\Datensicherung\Users\Nico\Downloads\SoftonicDownloader_fuer_izarc.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I Hoffe mir kann jemand helfen! |
|
23.11.2011, 14:53
| #2 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™   | BOO/Shertwil.L in Bootsektor gefunden!Zitat:
Zitat:
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ |
|
23.11.2011, 20:56
| #3 |
| | BOO/Shertwil.L in Bootsektor gefunden! Malwarebytes' Anti-Malware 1.51.2.1300
__________________www.malwarebytes.org Datenbank Version: 8218 Windows 6.1.7601 Service Pack 1 Internet Explorer X.X.XXXX.XXXX 23.11.2011 20:48:17 mbam-log-2011-11-23 (20-47-56).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 724839 Laufzeit: 3 Stunde(n), 48 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Zitat: Bitte nicht falsch verstehen, aber irgendwie hab ich den Eindruck es ist ein Volkssport geworden sich sämtlichen Kram von Softonic zu laden. Da ist immer irgendein Müll wie Toolbars oder der sinnlose Softonic Downloader drin. Warum lädst du die Software nicht von der Seite des Herstellers oder notfalls bei chip.de? Versteh ich nicht falsch. Keine Sorge! Hab mir nichts dabei gedacht, wie bestimmt tausende "Normal-PC Benutzer"! Hoffe Ihr helft mir trotzdem! |
|
23.11.2011, 21:08
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BOO/Shertwil.L in Bootsektor gefunden!Zitat:
Wenn sollen in Logs nur private infos unkenntlich gemacht werden, NICHTS WEITER!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.11.2011, 21:14
| #5 |
| | BOO/Shertwil.L in Bootsektor gefunden! Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 |
|
23.11.2011, 21:25
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BOO/Shertwil.L in Bootsektor gefunden! CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ --> BOO/Shertwil.L in Bootsektor gefunden! |
|
27.11.2011, 12:48
| #7 |
| | BOO/Shertwil.L in Bootsektor gefunden! OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.11.2011 12:35:30 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Nico\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,93 Gb Available Physical Memory | 73,35% Memory free 8,00 Gb Paging File | 6,69 Gb Available in Paging File | 83,69% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 930,87 Gb Total Space | 728,14 Gb Free Space | 78,22% Space Free | Partition Type: NTFS Computer Name: HAUPTRECHNER | User Name: Nico | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.24 18:52:17 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Nico\Downloads\OTL.exe PRC - [2011.10.11 17:02:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 17:00:14 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE PRC - [2011.10.11 16:59:45 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe PRC - [2011.10.11 16:59:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.11 16:59:39 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.09.19 13:50:22 | 000,993,280 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe PRC - [2011.01.05 11:51:15 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe PRC - [2010.10.16 11:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2010.07.14 04:00:00 | 000,032,240 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe PRC - [2010.07.13 21:23:50 | 000,084,464 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe PRC - [2010.06.30 09:10:14 | 000,477,680 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe PRC - [2009.12.07 13:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe PRC - [2009.06.02 19:05:58 | 000,457,200 | ---- | M] () -- C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2007.05.10 22:46:20 | 000,624,248 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe ========== Modules (No Company Name) ========== MOD - [2011.08.31 15:44:40 | 000,315,392 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libtidy.dll MOD - [2011.08.31 15:44:38 | 000,433,664 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libxml2.dll MOD - [2010.07.13 21:23:50 | 000,084,464 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe MOD - [2010.06.30 09:10:14 | 000,477,680 | ---- | M] () -- C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.10.11 17:02:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 17:00:14 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.10.11 16:59:45 | 000,342,480 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2011.10.11 16:59:41 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.29 15:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion) SRV - [2011.01.05 11:51:15 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.10.16 11:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010.07.16 06:48:26 | 000,354,288 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe -- (RoxWatch12) SRV - [2010.07.16 06:48:04 | 001,099,248 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe -- (RoxMediaDB13) SRV - [2010.07.14 04:00:00 | 000,032,240 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe -- (BOT4Service) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.12.07 13:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe -- (Realtek11nSU) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.02 19:05:58 | 000,457,200 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe -- (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) SRV - [2007.05.31 16:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 16:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) SRV - [2007.03.20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.10.11 17:03:33 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.10.11 17:03:32 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.10.11 17:03:30 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.01.06 11:07:26 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2011.01.06 11:07:25 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2010.09.07 21:08:55 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.03.19 03:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009.11.11 09:54:46 | 000,676,864 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8192su.sys -- (RTL8192su) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.02 01:00:00 | 000,027,632 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SaibVdAd64.sys -- (SaibVdAd64) DRV:64bit: - [2009.06.02 01:00:00 | 000,027,120 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Sahdad64.sys -- (Sahdad64) DRV:64bit: - [2009.06.02 01:00:00 | 000,019,952 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Saibad64.sys -- (Saibad64) DRV:64bit: - [2008.05.16 10:33:06 | 000,158,760 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mdm.sys -- (s0016mdm) DRV:64bit: - [2008.05.16 10:33:06 | 000,151,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) DRV:64bit: - [2008.05.16 10:33:06 | 000,137,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) DRV:64bit: - [2008.05.16 10:33:06 | 000,136,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016obex.sys -- (s0016obex) DRV:64bit: - [2008.05.16 10:33:06 | 000,034,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) DRV:64bit: - [2008.05.16 10:33:04 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016mdfl.sys -- (s0016mdfl) DRV:64bit: - [2008.05.16 10:32:56 | 000,115,240 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Hotmail und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 5E 69 90 AE 94 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Facemoods Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig" FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll (TVU networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 19:42:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.01 10:03:26 | 000,000,000 | ---D | M] [2010.12.05 20:02:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions [2011.11.21 19:48:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions [2011.05.09 17:37:07 | 000,000,000 | ---D | M] (PokHelper) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{3189af69-c0a1-4318-b2b9-610e0ba6a775} [2011.07.24 17:44:36 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.11.12 20:22:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.08.14 09:39:51 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\445zmwz0.default\extensions\firefox@tvunetworks.com [2011.11.09 19:42:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2010.12.05 21:05:33 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} () (No name found) -- C:\USERS\NICO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\445ZMWZ0.DEFAULT\EXTENSIONS\EXTENSION@CIUVO.COM.XPI () (No name found) -- C:\USERS\NICO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\445ZMWZ0.DEFAULT\EXTENSIONS\FINDER@MEINGUTSCHEINCODE.DE.XPI [2011.11.09 19:41:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.10.06 20:08:46 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.06 20:08:46 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.10.06 20:08:46 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.10.06 20:08:46 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.06 20:08:46 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.06 20:08:46 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll () O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (no name) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - No CLSID value found. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CPMonitor] C:\Program Files (x86)\Roxio 2011\5.0\CPMonitor.exe () O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio 2011\Roxio Burn\RoxioBurnLauncher.exe () O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe (Sonic Solutions) O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10v_Plugin.exe (Adobe Systems, Inc.) O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta () O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta () O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55463C69-1F87-4397-9210-B40C42B51227}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{80D3CD33-5690-4F78-9569-7A403D5C00E9}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2c267311-07e5-11e1-8f42-0030678c23af}\Shell - "" = AutoRun O33 - MountPoints2\{2c267311-07e5-11e1-8f42-0030678c23af}\Shell\AutoRun\command - "" = N:\pushinst.exe O33 - MountPoints2\{f9737440-f252-11e0-ac6c-0030678c23af}\Shell - "" = AutoRun O33 - MountPoints2\{f9737440-f252-11e0-ac6c-0030678c23af}\Shell\AutoRun\command - "" = N:\Startme.exe O33 - MountPoints2\D\Shell - "" = AutoRun O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.11.27 12:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{67FD8132-783B-4408-8FEE-EA838542DDB3} [2011.11.27 12:17:28 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B61DC993-2F9A-4FA5-9455-33DF002E0C1F} [2011.11.24 19:49:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{BDA73C94-40FA-4560-A389-58DBEB0D7DA1} [2011.11.24 19:49:11 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EC295C47-7717-47BE-83EC-B149464E7385} [2011.11.24 18:20:42 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FFC83DEB-0F02-4E9E-AD46-9B9019D654C3} [2011.11.24 18:20:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0A2C2349-1C2D-41B0-B5A4-97847B81B746} [2011.11.24 16:18:55 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1E470FC1-BEA2-4D18-A2EE-1180BDE6DC45} [2011.11.24 16:18:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B29DA048-67FC-4F93-A151-3B02477E19F1} [2011.11.23 22:18:07 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\Norman Malware Cleaner [2011.11.23 21:38:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{16DF4132-FCBC-4AEB-88FD-5AFF91BF6B03} [2011.11.23 20:52:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AECC823D-E2F1-4121-A40A-2359B7488D65} [2011.11.23 20:52:37 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EF44BBEA-C6DA-4B1B-8BFE-CBB807FFD808} [2011.11.22 19:59:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2011.11.22 19:49:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{2A32F83D-1EC3-425C-9120-B7CB7EE2E8BA} [2011.11.22 19:49:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{9EF85C28-3258-4CCD-BAD7-E812DDD4F9C6} [2011.11.22 19:41:13 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Malwarebytes [2011.11.22 19:41:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.11.22 19:41:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.22 19:41:03 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.11.22 19:41:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.11.22 19:10:53 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0FE9DAE5-1772-4A87-92E4-D795EEE495AE} [2011.11.22 19:10:27 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1DE8E220-0C94-413C-80C2-F13CAD1958D2} [2011.11.21 20:55:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2011.11.21 20:55:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.11.21 20:55:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2011.11.21 19:08:15 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{95F58DA1-C77A-4907-8938-89DE793B3CD3} [2011.11.21 19:07:54 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6C910F9C-B0D1-4824-AC4C-0B1E8D36777D} [2011.11.21 19:07:12 | 000,000,000 | ---D | C] -- C:\Program Files\Flatout2 [2011.11.21 17:29:36 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{CC2DF0F8-F89D-4708-BEA9-46AE344ED85A} [2011.11.21 17:29:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1857CBE2-7F2C-40B3-B316-D500FDC7938B} [2011.11.20 19:51:02 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6B736FE0-A130-4D4E-91E7-7A3A8CC3A386} [2011.11.20 19:50:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6EBF32E0-FC24-4E02-AB82-49149E0F5FF8} [2011.11.20 17:27:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{4A8E6780-1429-4F71-B29B-A13DC5FF05A7} [2011.11.20 17:26:57 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1D60CEEC-C7F4-4D0A-9F8C-32A35FBE4392} [2011.11.20 11:02:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{303FFB94-23A7-4184-9090-441D8DA47275} [2011.11.20 11:02:09 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E2489FC0-DD4F-46E7-B34A-38C9716F790D} [2011.11.20 10:32:41 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7A3A2975-EFB9-4DA0-8F45-3AD6C17C402F} [2011.11.20 10:32:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{42E08E2C-A8D2-42DD-AE73-AC23CE5B8E8D} [2011.11.19 19:57:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0E5861F6-16F4-4A96-B1A8-382549F21437} [2011.11.19 19:57:22 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{79822E5A-7E20-49DD-94B0-7B39F16B2EA9} [2011.11.19 19:12:23 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6D1BA755-1AF2-4889-BF64-7395F2DEF65B} [2011.11.19 19:11:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{49500172-5289-4FA7-8160-AC47DFEF7AE4} [2011.11.19 09:43:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{03A455EC-067F-4E06-95AD-A5B57BA7B30B} [2011.11.18 19:44:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0EF56DED-4D4B-4A76-8DDD-B9FBFB768C3E} [2011.11.18 19:44:12 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AEA01728-46C9-40F6-8028-EE3B933B4C1F} [2011.11.18 19:42:59 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D6539889-9BD4-48C5-B938-01C65DAE6024} [2011.11.18 19:42:37 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{068D7DB7-CB0A-4E2D-988E-A00E79CA3CAA} [2011.11.17 21:53:33 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{8D4CDF12-8B91-4048-BA56-7E5207A9AC18} [2011.11.17 21:53:22 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{64D45E0C-8B8A-4189-80EE-68C61F2545CB} [2011.11.17 21:13:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{9107C332-5840-4FC9-9771-DF1725BB6313} [2011.11.17 21:13:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{5BDFCF86-E93F-4D59-A3A3-9C789A48E468} [2011.11.17 12:13:36 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B8345280-BD83-46D6-B413-93B8323A451B} [2011.11.17 12:13:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{3C2A3DC0-3D44-44D9-82AA-F7432492421C} [2011.11.17 12:03:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{353567AC-88EA-453D-9926-B976BDAFCF43} [2011.11.17 12:03:46 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{EA26CFA9-E5AA-4B95-A3B3-9BBFB1858EC2} [2011.11.16 12:05:47 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{279A3BA1-1784-48A7-B90B-144464F7E064} [2011.11.16 12:05:35 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{53DE42D3-FE2C-42A5-8734-F0C4CA4B07B5} [2011.11.15 19:07:26 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B743B015-D379-4F7C-9BD8-3BDD35028CCE} [2011.11.15 19:07:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{DB68D2C0-E9AA-43B3-B871-F06249EAD444} [2011.11.15 12:33:42 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7EFF78CB-3726-47C6-9430-30773B4770CF} [2011.11.15 12:33:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F9B61699-5550-406D-84D0-FCC754855DB8} [2011.11.15 11:57:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{278AE714-C593-47D8-BF95-E0E9B9DEFCBB} [2011.11.15 11:57:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AA146606-4C56-4695-9A8A-BA2EA9351838} [2011.11.15 10:56:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{284D4E7E-2236-4C87-95B1-FF69E780C286} [2011.11.15 10:56:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7293AAFF-4118-44D7-B294-7019AED381D6} [2011.11.14 17:42:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0705085A-F468-4050-A93E-B6E74747CC3B} [2011.11.14 17:42:07 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B07DA6D5-79B2-4610-A5C8-CD2FD538DE26} [2011.11.14 12:20:35 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D323E509-41DE-49D3-86B7-98C5A7885511} [2011.11.14 12:20:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{77D2CDBF-950B-4C63-9987-835DFC5ADF70} [2011.11.14 11:58:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{6623EAFF-1366-4B8F-AEA5-3BD377D5E51E} [2011.11.14 11:57:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7A530A30-B8ED-4187-988E-2D8F9D4741E7} [2011.11.13 14:00:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{C307BBCF-DE2B-4927-B726-F1A87E09BB48} [2011.11.13 14:00:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{D921146E-3642-4F4C-B0E8-5DB55DC83780} [2011.11.13 09:59:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{5AA5D019-8E0C-48DB-8EDD-432BE55FA7F9} [2011.11.13 09:59:16 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{44DC6D7E-64A1-47B7-AD84-3FF6A1C4C6E4} [2011.11.12 20:22:54 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{DD7408FF-3926-4C34-91AB-F3C5AC51755F} [2011.11.12 20:22:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{ECED5719-58E3-4528-8CEF-31C6763A8592} [2011.11.10 18:50:27 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{7AB9BE4A-B373-4AD9-A455-67FC4B38A833} [2011.11.10 18:50:05 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{A49AD25A-B830-450B-9945-36ECEB691C98} [2011.11.10 18:27:26 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E597F6DF-CDF5-4000-8D55-515767C71715} [2011.11.10 18:27:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F96A9025-6E5E-479A-A0F1-243A7006438B} [2011.11.09 21:15:29 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{8D71304B-DDDD-457C-837B-92C8E6E0C8C8} [2011.11.09 21:15:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{0840D378-4E60-4C6B-B37D-D534DE42F931} [2011.11.09 19:42:46 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FBE8A36E-4636-44B3-8CB4-38541D58CEE2} [2011.11.09 19:42:18 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{79B99273-F9E3-49F2-BCFA-F17FECA0542D} [2011.11.08 20:03:30 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{26305F2B-CC5B-45D3-95C5-274D1DF6AE50} [2011.11.08 20:03:08 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{059A81EE-418D-42D1-93FD-B39243D7FA18} [2011.11.08 18:28:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{F872BB80-3132-481D-B497-8826FC9D1C43} [2011.11.08 18:28:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{B16FEF7F-6314-4EC0-B243-6C73DAA673F6} [2011.11.06 19:57:09 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\Klasse Luis [2011.11.06 18:56:19 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{C9B78DAD-E9A4-4009-AF65-5A851CE2B796} [2011.11.06 15:19:23 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1AC9B41A-6145-49D2-A684-180A1F17F98F} [2011.11.06 15:19:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{60A368E7-C91B-49B4-9552-9F5FA5F6CC90} [2011.11.06 15:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco [2011.11.06 15:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REALTEK 11n USB Wireless LAN Utility [2011.11.06 15:01:20 | 000,380,928 | ---- | C] (Realtek) -- C:\Windows\SysNative\RtlUI2.exe [2011.11.06 15:01:20 | 000,380,928 | ---- | C] (Realtek) -- C:\Windows\RtlUI2.exe [2011.11.06 15:01:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\REALTEK [2011.11.05 21:30:47 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{39C1D1C3-70D1-4049-9CF8-5E9F4E5B38E2} [2011.11.05 21:30:24 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{73B87822-F4A1-493E-9ED3-CCF79AEEDCE1} [2011.11.02 18:19:20 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{35D9EB5B-EB06-4353-AB5A-8C485605BAF5} [2011.11.02 18:18:58 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{ADA828B0-D923-4F26-A1D2-3053D9F5D6B1} [2011.11.02 11:53:15 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{1C5B74CB-9A9A-458C-899B-1FF41690A849} [2011.11.02 11:11:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Apple Computer [2011.11.01 10:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2011.11.01 10:03:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer [2011.11.01 09:58:43 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{E019A52F-44D2-4790-B7C9-0723F6A27669} [2011.11.01 09:58:31 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{68C2DEEE-B3F8-4173-8E59-E74BD807B597} [2011.11.01 09:44:32 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{35A6490E-2956-4B69-B091-218479EE86F7} [2011.11.01 09:44:05 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{FABCF518-394C-4876-8CAC-5AE822BD6DDA} [2011.10.28 19:03:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{71838F42-748B-43EA-9C73-02BEFF1CE2A7} [2011.10.28 19:03:14 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{32C36884-F042-48E8-9316-9F369890AF1A} [2011.10.28 18:41:48 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{AF790A58-40CD-4AA5-B76B-0E9FD5B9E62E} [2011.10.28 18:41:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\{77553A8F-4E70-416A-8C92-FA41208E6467} [6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.27 12:24:44 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.27 12:24:44 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.27 12:20:38 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.27 12:20:38 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.27 12:20:38 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.27 12:20:38 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.27 12:20:38 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.27 12:15:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.27 12:15:39 | 3220,725,760 | -HS- | M] () -- C:\hiberfil.sys [2011.11.22 19:41:08 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.21 20:55:26 | 000,001,262 | ---- | M] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk [2011.11.21 19:13:24 | 000,000,969 | ---- | M] () -- C:\Users\Nico\Desktop\FlatOut2 - Verknüpfung.lnk [2011.11.09 19:45:20 | 000,002,268 | ---- | M] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk [2011.11.06 15:02:28 | 000,002,286 | ---- | M] () -- C:\Users\Public\Desktop\REALTEK 11n USB Wireless LAN Utility.lnk [2011.11.01 10:03:22 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.22 19:41:08 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.21 20:55:26 | 000,001,262 | ---- | C] () -- C:\Users\Nico\Desktop\Spybot - Search & Destroy.lnk [2011.11.21 19:13:24 | 000,000,969 | ---- | C] () -- C:\Users\Nico\Desktop\FlatOut2 - Verknüpfung.lnk [2011.11.09 19:45:20 | 000,002,268 | ---- | C] () -- C:\Users\Public\Desktop\Sony Ericsson PC Companion 2.0.lnk [2011.11.06 15:02:28 | 000,002,286 | ---- | C] () -- C:\Users\Public\Desktop\REALTEK 11n USB Wireless LAN Utility.lnk [2011.11.06 15:01:19 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe [2011.11.01 10:03:22 | 000,001,845 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2011.07.11 17:32:42 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi [2011.06.30 10:10:07 | 000,390,588 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.01.17 21:19:53 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2011.01.05 11:58:40 | 002,463,976 | ---- | C] () -- C:\Windows\SysWow64\NPSWF32.dll [2011.01.04 11:43:33 | 000,000,000 | ---- | C] () -- C:\Users\Nico\AppData\Local\rx_image32.Cache [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.11.20 20:09:43 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\BOM [2011.07.24 17:44:41 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\DVDVideoSoft [2011.07.24 17:30:48 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers [2011.01.25 10:41:52 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\FreeFLVConverter [2011.08.17 21:25:42 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\GHISLER [2010.12.13 20:39:46 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\gtk-2.0 [2010.12.08 16:50:23 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\InterTrust [2011.09.09 19:30:10 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Jumping Bytes [2010.12.05 20:54:14 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Leadertech [2011.06.27 11:42:18 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\PeaZip [2011.08.16 11:03:46 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Scooter Software [2010.12.08 16:28:43 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Windows Live Writer [2011.01.06 11:54:37 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Winter Sports 2011 [2011.02.03 17:13:30 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\Z-Software [2011.11.23 16:24:00 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
|
27.11.2011, 12:52
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | BOO/Shertwil.L in Bootsektor gefunden! Sry aber die Anleitung musst du schon richtig umsetzen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2011, 13:08
| #9 |
| | BOO/Shertwil.L in Bootsektor gefunden! Ich weiß nicht was ich falsch mach. Wenn ich den Text reinkopiere kommt bei OTL nach einer kurzen Programmluiafzeit die Fehlermeldung: OUT OF TIME? Woran kanns liegen? |
|
| Themen zu BOO/Shertwil.L in Bootsektor gefunden! |
| anti-malware, avira, bootsektor, dateien, datensicherung, datenträger, downloader, escan, eset, explorer, folge, found, malwarebytes, mas, neustart, onlinescan, programme, recovery, search, service, spybot, trojan, variant, version, win32/inject.ndt, win32/softonicdownloader.a, worm |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
