| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
14.12.2011, 15:54
| #1 |
| |  Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden Hallo! Ich habe ein ganz ähnliches Problem wie hier: TB Google Verlinkungen auf falsche Websites (thema 106190, ich kann hier aus irgendeinem grund keinen link einfügen...). Sowohl Google als auch Bing Ergebnisse waren plötzlich auf Werbung verlinkt, im Firefox als auch IE. Im Autostart Ordner in der Registry war eine gewisse F35.exe eingetragen, die ich da noch nie gesehen hatte. Im Taskmanager lief die F35, also hab ich sie erst mal abgeschossen, und dann aus dem Ordner C:\Users\[Mein Name]\AppData\Roaming\Microsoft\ gelöscht. Nach einem Neustart war sie dann aber nach einer Weile wieder da. Virenscan mit den Microsoft Security Essentials hat nichts gebracht. Über Diverse Foren hab ich dann von den Malwarebytes Scanner erfahren. Der hat mehrere Sachen gefunden und gelöscht (hab leider keine Logfile mehr). Danach war das Problem mit den Umleitungen erst einmal weg. Ich war da wohl ein bischen naiv mit "hier mal das Löschen und dann einen Scan, dann ist alles wieder gut" war es nicht getan: Jetzt lässt sich der Windows Defender nicht mehr starten, weil der Sicherheitscenterdienst komplett verschwunden ist (aus der Liste der Dienste)... Auch die beiden Browser haben Schubweise ungewöhnlich hohe CPU auslastung (sind die auch infiziert worden!?)... Ich weiss nicht mehr ganz weiter. Danke schonmal im Vorraus für eure Hilfe! Falls es weiter hilft, ich hab mal OTL laufen lassen: OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.12.2011 15:46:43 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = D:\ 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 1,93 Gb Available Physical Memory | 49,86% Memory free 7,72 Gb Paging File | 5,37 Gb Available in Paging File | 69,55% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 148,95 Gb Total Space | 19,86 Gb Free Space | 13,33% Space Free | Partition Type: NTFS Drive D: | 931,51 Gb Total Space | 108,11 Gb Free Space | 11,61% Space Free | Partition Type: NTFS Computer Name: [**Mein Computername**] | User Name: [**Mein Username**] | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.09 22:56:59 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2011.10.16 14:22:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\OTL.exe PRC - [2011.09.05 18:04:56 | 001,489,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.05.25 21:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\[**Mein Username**]\AppData\Roaming\Dropbox\bin\Dropbox.exe PRC - [2011.03.08 13:21:18 | 000,138,168 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ZOOM\TpScrex.exe PRC - [2011.03.08 13:20:58 | 000,267,624 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPONSCR.exe PRC - [2011.02.18 17:09:02 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe PRC - [2011.02.04 03:45:00 | 000,062,824 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE PRC - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe PRC - [2010.11.29 16:32:44 | 000,069,560 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe PRC - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\micmute.exe PRC - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2010.04.23 12:21:00 | 000,154,112 | ---- | M] (troubadix) -- C:\Programme\TPFanControl\TPFanControl.exe PRC - [2010.04.20 12:23:32 | 000,074,088 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe PRC - [2010.04.20 12:23:28 | 000,062,312 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe PRC - [2010.04.20 12:23:18 | 000,050,536 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\CamMute.exe PRC - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe PRC - [2010.04.01 14:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe ========== Modules (No Company Name) ========== MOD - [2011.11.14 13:11:27 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll MOD - [2011.11.09 22:56:58 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2011.09.23 15:04:22 | 009,364,480 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu MOD - [2011.09.05 18:04:58 | 000,056,832 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\de_DE\BRdlang32.DEU MOD - [2011.09.05 18:04:56 | 000,249,232 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll MOD - [2010.09.16 21:04:50 | 000,095,528 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.08.05 11:53:12 | 000,467,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc) SRV:64bit: - [2011.08.05 11:53:12 | 000,306,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm) SRV:64bit: - [2011.08.05 11:53:06 | 008,277,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc) SRV:64bit: - [2011.06.03 12:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:64bit: - [2011.06.01 11:09:42 | 000,131,072 | --S- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Research KinectSDK\Service\KinectManagementService.exe -- (KinectManagement) SRV:64bit: - [2011.04.27 16:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv) SRV:64bit: - [2011.04.27 16:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2011.01.10 13:48:32 | 000,231,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe -- (arXfrSvc) SRV:64bit: - [2011.01.10 13:47:54 | 000,109,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Home Server\esClient.exe -- (esClient) SRV:64bit: - [2011.01.10 13:47:42 | 000,489,840 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Home Server\WHSConnector.exe -- (WHSConnector) SRV:64bit: - [2010.12.13 13:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc) SRV:64bit: - [2010.11.12 18:48:50 | 000,045,928 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:64bit: - [2010.10.08 06:18:46 | 000,697,616 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd) SRV:64bit: - [2010.10.08 06:18:46 | 000,056,592 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe -- (dtpd) SRV:64bit: - [2010.10.08 06:18:44 | 000,957,712 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\iked.exe -- (iked) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.09.09 04:46:14 | 000,912,384 | ---- | M] () [Auto | Stopped] -- C:\Programme\Synergy\synergys.exe -- (Synergy Server) SRV - [2011.08.31 18:08:08 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.07.27 21:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R) SRV - [2011.07.27 20:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R) SRV - [2011.06.30 14:36:22 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.02.18 17:09:02 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService) SRV - [2011.02.04 03:45:00 | 000,155,496 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc) SRV - [2011.02.04 03:45:00 | 000,079,208 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE -- (Power Manager DBC Service) SRV - [2010.12.03 11:00:54 | 000,114,024 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD) SRV - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC) SRV - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE) SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC) SRV - [2010.11.20 13:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010.08.20 21:08:46 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2010.04.20 12:23:32 | 000,074,088 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC) SRV - [2010.04.20 12:23:18 | 000,050,536 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE) SRV - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.12.14 23:43:20 | 000,515,560 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.08.08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) DRV:64bit: - [2011.08.08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) DRV:64bit: - [2011.08.03 17:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R) DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.07.28 17:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB) DRV:64bit: - [2011.06.09 10:14:26 | 000,295,272 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\VMM.sys -- (vmm) DRV:64bit: - [2011.05.27 20:01:12 | 000,046,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\kinectcamera.sys -- (KinectCamera) DRV:64bit: - [2011.05.02 15:29:49 | 000,023,816 | ---- | M] (Prime Sense Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\psdrv3.sys -- (psdrv3) DRV:64bit: - [2011.04.27 14:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.02.17 19:25:02 | 001,419,824 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2011.02.14 18:43:46 | 000,043,456 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0) DRV:64bit: - [2011.02.04 03:45:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64) DRV:64bit: - [2011.02.04 03:45:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF) DRV:64bit: - [2011.01.19 11:20:46 | 007,886,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETwNv64.sys -- (NETwNv64) ___ Intel(R) DRV:64bit: - [2011.01.13 11:21:28 | 000,166,656 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.12 18:48:30 | 000,039,024 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:64bit: - [2010.09.07 14:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi) DRV:64bit: - [2010.09.02 08:18:46 | 000,021,504 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vfilter.sys -- (vflt) DRV:64bit: - [2010.09.02 08:18:46 | 000,017,408 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\virtualnet.sys -- (vnet) DRV:64bit: - [2010.08.20 21:08:46 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2010.07.22 09:39:10 | 000,295,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R) DRV:64bit: - [2010.07.08 11:14:04 | 000,154,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iANSW60e.sys -- (IANSPROTOCOL) Intel(R) DRV:64bit: - [2010.07.08 11:14:04 | 000,154,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iANSW60e.sys -- (iANSMiniport) Intel(R) DRV:64bit: - [2010.06.21 15:07:38 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.06.09 16:10:16 | 000,046,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\nm3.sys -- (nm3) DRV:64bit: - [2010.04.19 19:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2010.03.17 21:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R) DRV:64bit: - [2010.01.20 13:14:06 | 000,682,040 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2009.12.17 23:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2009.11.01 18:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64) DRV:64bit: - [2009.10.26 05:52:00 | 000,061,952 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci) DRV:64bit: - [2009.08.09 22:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV:64bit: - [2009.07.14 01:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan) DRV:64bit: - [2009.07.14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx) DRV:64bit: - [2009.07.14 00:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.11 08:33:56 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd) DRV:64bit: - [2007.02.19 06:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd) DRV:64bit: - [2006.10.13 03:21:00 | 000,016,080 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVicPort64.sys -- (TVicPort64) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.03.13 13:47:34 | 000,013,840 | ---- | M] (UPEK Inc.) [Kernel | Auto | Running] -- C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys -- (smihlp) SMI Helper Driver (smihlp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heise.de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6B 83 4B F1 84 1C CB 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.heise.de" FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.1 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2 FF - prefs.js..extensions.enabledItems: {9c51bd27-6ed8-4000-a2bf-36cb95c0c947}:11.0.1 FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: tineye@ideeinc.com:1.1 FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.0 FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..network.proxy.backup.ftp: "proxy.in.tum.de" FF - prefs.js..network.proxy.backup.ftp_port: 8080 FF - prefs.js..network.proxy.backup.gopher: "proxy.in.tum.de" FF - prefs.js..network.proxy.backup.gopher_port: 8080 FF - prefs.js..network.proxy.backup.socks: "proxy.in.tum.de" FF - prefs.js..network.proxy.backup.socks_port: 8080 FF - prefs.js..network.proxy.backup.ssl: "proxy.in.tum.de" FF - prefs.js..network.proxy.backup.ssl_port: 8080 FF - prefs.js..network.proxy.ftp: "proxy.in.tum.de" FF - prefs.js..network.proxy.ftp_port: 8080 FF - prefs.js..network.proxy.gopher: "proxy.in.tum.de" FF - prefs.js..network.proxy.gopher_port: 8080 FF - prefs.js..network.proxy.http: "proxy.in.tum.de" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "proxy.in.tum.de" FF - prefs.js..network.proxy.socks_port: 8080 FF - prefs.js..network.proxy.ssl: "proxy.in.tum.de" FF - prefs.js..network.proxy.ssl_port: 8080 FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 22:56:59 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.23 00:51:53 | 000,000,000 | ---D | M] [2010.07.05 22:05:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Extensions [2011.12.09 18:21:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions [2010.07.05 22:29:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.07.05 22:29:12 | 000,000,000 | ---D | M] (Tamper Data) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{9c51bd27-6ed8-4000-a2bf-36cb95c0c947} [2011.01.03 01:52:56 | 000,000,000 | ---D | M] (Password Exporter) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492} [2011.11.14 13:12:27 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2011.02.02 17:18:23 | 000,000,000 | ---D | M] (User Agent Switcher) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1} [2011.06.29 15:57:49 | 000,000,000 | ---D | M] (Custom Buttons) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\custombuttons@xsms.org [2011.03.09 11:33:10 | 000,000,000 | ---D | M] (TinEye Reverse Image Search) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\tineye@ideeinc.com [2009.07.09 11:27:34 | 000,002,172 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\bing.xml [2011.02.07 12:40:48 | 000,002,321 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\dictcc.xml [2011.06.14 10:38:02 | 000,002,006 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\urban-dictionary.xml [2011.11.09 22:57:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.08.31 09:08:37 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.10.29 01:14:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} () (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI () (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI () (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI [2011.11.09 22:56:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.12.13 14:52:17 | 000,000,856 | RH-- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 94.63.240.140 www.bing.com O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (BrowserHelper Class) - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Programme\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3:64bit: - HKLM\..\Toolbar: (Home Server Banner) - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Programme\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\SysNative\ExplorerFrame.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\SysWOW64\ExplorerFrame.dll (Microsoft Corporation) O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe (Lenovo Group Limited) O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [TPFanControl] C:\Programme\TPFanControl\TPFanControl.exe (troubadix) O4:64bit: - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Dominik Reichl) O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited) O4 - HKLM..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Ricoh co.,Ltd.) O4 - Startup: C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\[**Mein Username**]\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O8:64bit: - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 131.159.14.206 131.159.14.208 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3B95F5B2-532F-4302-92FC-F1D0E1289524}: DhcpNameServer = 192.168.100.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45A3E5B8-AAAB-47D8-A902-DF89920FA93E}: NameServer = 194.24.128.100 81.3.216.100 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66903589-D907-47DE-94FE-52BF7291FFEF}: Domain = tu-muenchen.de O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66903589-D907-47DE-94FE-52BF7291FFEF}: NameServer = 10.156.33.53,129.187.5.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78A15479-FA38-4FEB-9567-0118E6097A68}: DhcpNameServer = 131.159.14.206 131.159.14.208 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{805AA013-3BFB-4689-B617-5C5805333934}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC002D33-B931-4996-A0EA-60763D9D5CFA}: DhcpNameServer = 213.133.100.100 213.133.98.98 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{46bba8e4-39eb-11e0-b86b-f977e927b5e5}\Shell - "" = AutoRun O33 - MountPoints2\{46bba8e4-39eb-11e0-b86b-f977e927b5e5}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{46bba8f7-39eb-11e0-b86b-f977e927b5e5}\Shell - "" = AutoRun O33 - MountPoints2\{46bba8f7-39eb-11e0-b86b-f977e927b5e5}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{4ab8d773-b234-11e0-af05-5cff350991a1}\Shell - "" = AutoRun O33 - MountPoints2\{4ab8d773-b234-11e0-af05-5cff350991a1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{af37d370-88f0-11df-8555-5cff350991a1}\Shell - "" = AutoRun O33 - MountPoints2\{af37d370-88f0-11df-8555-5cff350991a1}\Shell\AutoRun\command - "" = E:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.14 03:27:35 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{458D3125-0D31-4F13-BCED-6491E36E5AA2} [2011.12.14 03:27:25 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D41D5D4D-9A1B-4CE9-9CDC-0256600E6095} [2011.12.14 03:15:19 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.12.14 03:15:19 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.12.14 03:15:18 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011.12.14 03:15:18 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011.12.14 03:15:18 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.12.14 03:15:17 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.12.14 03:15:16 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2011.12.14 03:15:16 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2011.12.14 03:15:16 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2011.12.14 03:15:16 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2011.12.14 03:15:15 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2011.12.14 03:06:19 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011.12.14 03:06:19 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011.12.14 03:06:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011.12.14 03:04:08 | 052,988,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe [2011.12.14 01:59:58 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Malwarebytes [2011.12.14 01:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.14 01:59:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.14 01:59:44 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.14 01:59:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.12.14 01:26:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.12.14 01:26:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.12.14 01:19:07 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2011.12.14 01:19:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2011.12.14 00:38:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2011.12.13 17:33:07 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\48A74 [2011.12.13 16:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebReaper [2011.12.13 16:59:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebReaper [2011.12.13 16:49:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LP [2011.12.13 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\74508 [2011.12.13 16:18:56 | 000,000,000 | -HSD | C] -- C:\Users\[**Mein Username**]\AppData\Local\5d87cf71 [2011.12.13 15:01:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Inspyder Web2Disk [2011.12.13 14:46:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Visual Web Spider [2011.12.13 14:21:23 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{58559085-C5DA-4FEA-A9CC-856BDA4F4BE0} [2011.12.13 14:21:13 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B2B10D9D-8C25-4673-B682-C492E8C79E38} [2011.12.12 14:40:58 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{3844D27F-421D-42E7-A5D8-B334034730AE} [2011.12.12 14:39:55 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B0F9D105-5B05-40A3-8F14-0261271D4D79} [2011.12.12 14:32:25 | 000,053,248 | ---- | C] (EnTech Taiwan) -- C:\Windows\System\TVicPort.dll [2011.12.12 14:32:25 | 000,016,080 | ---- | C] (EnTech Taiwan) -- C:\Windows\SysNative\drivers\TVicPort64.sys [2011.12.12 14:32:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TPFanControl [2011.12.12 14:32:25 | 000,000,000 | ---D | C] -- C:\Program Files\TPFanControl [2011.12.12 13:47:13 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{114D8A5D-178F-458A-B953-B5A03E3ADA20} [2011.12.10 16:58:25 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{F7A23DFB-68EF-4509-B5F5-097A67C397C7} [2011.12.10 16:58:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{51AD986D-6976-42AB-908E-06F8BDEC9B41} [2011.12.06 16:42:20 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Desktop\chill [2011.12.05 17:37:02 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{EAE49450-42A4-4A82-8A26-B854E81C9C61} [2011.12.05 17:36:41 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{BB56FCA8-43A5-414C-9212-BA2C404E1B60} [2011.12.03 12:56:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{5854D1AC-C6D7-4F17-9A0D-314868229CAC} [2011.12.03 12:56:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C94D2BAF-0C30-4C1D-B658-6121CD0FF8BE} [2011.12.03 00:52:34 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B9598C30-623C-450D-BA85-E7BCE2C96498} [2011.12.03 00:52:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{7772624F-6CD8-4DC9-BF92-8FA7E2A81A13} [2011.12.01 14:53:46 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{35F0F095-3E02-4DC3-9B59-788593A1C87B} [2011.11.29 10:44:14 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{4B1CDF44-0663-42AA-8C7B-FFDDABE7E807} [2011.11.29 10:43:53 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D6697C06-227F-47EA-BC70-23D1208531CD} [2011.11.29 04:27:22 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Documents\Meine empfangenen Dateien [2011.11.28 22:43:30 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{F46CE415-DA9B-4B1E-BB97-33C78200AA08} [2011.11.28 09:00:35 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D47E542C-55A0-4791-AF52-8B41AA87D7DE} [2011.11.28 09:00:14 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{62215CE6-7B9D-4DA0-9886-2ED3E3D11636} [2011.11.28 04:10:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\com.adobe.bridge.PublishPanel [2011.11.27 20:59:51 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C9DA4A17-8544-4D8F-B628-B7E436A7D64C} [2011.11.27 20:59:30 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{912693EA-CA1B-4A4B-BDC5-B6EB88B3393A} [2011.11.27 08:59:19 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{7E94746C-845D-4200-B340-382D39BC0791} [2011.11.27 08:59:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{74B7EA83-2E8F-4280-88D9-58B509F94F9B} [2011.11.26 15:23:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Desktop\bilder [2011.11.25 10:46:29 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{123D6A73-2D7A-40D6-AAC0-166F9FF35AD4} [2011.11.24 22:45:57 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{FFB08158-15AB-413C-9363-3DA4359FEAFE} [2011.11.24 22:45:36 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{93325A73-B66C-4200-9D76-4A74D85C473D} [2011.11.24 00:31:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{3C30E7A4-DDDD-4989-B91A-62C5AB0228C5} [2011.11.24 00:30:42 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{AC81E3A6-589A-40AD-A92B-781815A08762} [2011.11.23 19:11:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel [2011.11.23 19:10:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel [2011.11.23 19:10:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco [2011.11.22 23:05:00 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D3B7EFBA-8F90-4DBC-9210-B39821794ECC} [2011.11.22 23:04:39 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{550550AF-E1E9-4C03-81EA-DEFA0D1646CA} [2011.11.20 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{A8B4BC9D-0EBB-4FB8-8778-CD2CE46E6B80} [2011.11.20 17:25:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{69741420-9C95-4147-A6B0-0D8709B02F6F} [2011.11.20 05:24:59 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{595BE7F4-83E3-462B-BD63-AA0797AB7832} [2011.11.19 13:37:23 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{848CD9C2-4E7E-4CF8-8144-1376B3D233C2} [2011.11.19 01:36:51 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C27BA6F2-2E47-4590-B851-C3AC00CF3661} [2011.11.19 01:36:41 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{FFAB961C-1384-4540-92FD-4BDF07F41E8D} [2011.11.18 13:36:18 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C0C86756-6564-48B9-B7C9-D841F65E8439} [2011.11.18 13:35:53 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{637949B0-9E60-4DA6-926D-CDDA734A24FE} [2011.11.17 22:12:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.11.17 18:22:11 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{9DD5F022-DB6F-4C19-9FDA-4D2EF29EB724} [2011.11.17 18:22:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{9E02481D-8319-4859-B67B-D3BF36072FC9} [2011.11.16 17:11:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\MvvmLight [2011.11.16 17:11:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MvvmLight [2011.11.16 17:11:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Laurent Bugnion (GalaSoft) [2011.11.14 17:30:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mendeley Desktop [2011.11.14 17:30:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mendeley Desktop ========== Files - Modified Within 30 Days ========== [2011.12.14 15:20:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.14 14:57:25 | 000,018,320 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.14 14:57:25 | 000,018,320 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.14 14:56:48 | 002,131,116 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.14 14:56:48 | 000,901,142 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.12.14 14:56:48 | 000,820,576 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.12.14 14:56:48 | 000,226,982 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.12.14 14:56:48 | 000,181,330 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.12.14 14:50:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.14 14:50:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.14 14:50:08 | 3110,866,944 | -HS- | M] () -- C:\hiberfil.sys [2011.12.14 03:26:55 | 005,948,616 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.14 02:12:03 | 000,089,088 | ---- | M] () -- C:\Windows\SysNative\mbr.exe [2011.12.14 00:14:55 | 000,007,600 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Local\Resmon.ResmonCfg [2011.12.13 19:39:09 | 000,000,724 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport.arff [2011.12.13 14:52:17 | 000,000,856 | RH-- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2011.12.07 11:44:28 | 052,988,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe [2011.12.01 04:39:42 | 000,427,474 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\panorama.jpg [2011.11.29 19:14:00 | 000,053,083 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensor processing chain.png [2011.11.25 16:50:47 | 000,574,615 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata.ssd [2011.11.25 16:50:47 | 000,574,615 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata - Compass Stability.ssd [2011.11.23 19:11:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_AMPPAL_01009.Wdf [2011.11.23 18:32:01 | 000,357,978 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_longertest.arff [2011.11.23 17:39:44 | 000,406,469 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_firstclassified.arff ========== Files Created - No Company Name ========== [2011.12.14 02:12:03 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\mbr.exe [2011.12.01 04:39:27 | 000,427,474 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\panorama.jpg [2011.11.29 19:14:00 | 000,053,083 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensor processing chain.png [2011.11.25 16:59:11 | 000,574,615 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata - Compass Stability.ssd [2011.11.24 19:32:35 | 000,574,615 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata.ssd [2011.11.24 19:32:35 | 000,000,724 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport.arff [2011.11.23 19:11:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_AMPPAL_01009.Wdf [2011.11.23 18:20:52 | 000,357,978 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_longertest.arff [2011.11.14 23:03:11 | 015,922,019 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\CVPR 2011 - Final Video.mp4 [2011.11.14 16:25:21 | 000,406,469 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_firstclassified.arff [2011.10.24 16:43:23 | 000,000,000 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\{B5ECF200-429F-43EE-9814-C15191ECCD26} [2011.09.27 14:40:19 | 000,001,456 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\Adobe Save for Web 12.0 Prefs [2011.07.23 13:20:24 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.07.23 13:12:56 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll [2011.06.13 19:20:04 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2011.06.13 19:20:04 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.03.25 13:58:05 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll [2010.11.21 03:47:35 | 000,007,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\Resmon.ResmonCfg [2010.11.13 20:42:44 | 000,000,000 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\gnuplot_history [2010.11.04 01:58:46 | 000,038,425 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Kommagetrennte Werte (Windows).ADR [2010.10.15 21:56:43 | 000,000,263 | ---- | C] () -- C:\Windows\SmartTRAK.INI [2010.10.15 21:35:04 | 000,015,259 | ---- | C] () -- C:\Windows\SysWow64\compress.exe [2010.09.03 15:52:51 | 000,000,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\PUTTY.RND [2010.08.31 00:31:21 | 000,001,442 | ---- | C] () -- C:\Windows\cxxd-n.ini [2010.08.23 13:23:19 | 000,000,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\winscp.rnd [2010.07.31 23:16:50 | 000,000,419 | ---- | C] () -- C:\Windows\QIII.INI [2010.07.08 13:32:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.07.06 00:03:30 | 002,112,958 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.07.05 22:13:01 | 001,612,392 | ---- | C] () -- C:\Windows\SysWow64\nView.dll [2010.07.05 22:13:01 | 001,108,584 | ---- | C] () -- C:\Windows\SysWow64\nvwimg.dll [2010.07.05 22:13:01 | 000,256,616 | ---- | C] () -- C:\Windows\SysWow64\nViewSetup.exe [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat < End of report > |
| Themen zu Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden |
| auslastung, autorun, bho, bonjour, browser, chdrt64.sys, document, error, firefox, google, google earth, helper, hijack, hohe cpu, home, langs, lenovo, libusb0.sys, logfile, microsoft security, microsoft security essentials, mozilla, plug-in, problem, pwmtr64v.dll, registry, reverse, scan, security, server, sicherheitscenterdienst, software, starten, taskmanager, usb, user agent, verlinkungen, version=1.0, webcheck, werbung, windows |
Baum-Darstellung