| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: mediashifting.com - unregelmäßge Tab-ÖffnungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
31.12.2011, 15:45
| #1 |
| |  mediashifting.com - unregelmäßge Tab-Öffnung Hallo zusammen, zuerst: Ich habe von Computern und Technik und Viren nicht viel Ahnung, bin also ein kompletter Laie. Seit ca. einem Tag öffnet sich unregelmäßig ein Tab der mich zu mediashifting.com/?search=MICROPHONE&subid=193&key=e3c9f40ed6765b8ada4e&p=1 schicken will, allerdings kann die Seite nie geladen werden. Laut Angaben hier im Forum kommt das bei vielen vor, wenn sie etwas bei Google suchen oder so, das ist bei mir nicht der Fall. Ich kann kein Muster erkennen, wann er versucht, diese Seite aufzurufen. Avira hat zwei Sachen gefunden: Code:
ATTFilter Die Datei 'C:\Users\***p\AppData\Local\Mozilla\Firefox\Profiles\y2j3dj3u.default\Cache\4\28\00892d01'
enthielt einen Virus oder unerwünschtes Programm 'JS/Toieung.A' [virus].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5376a279.qua' verschoben!
Die Datei 'C:\Windows\System32\consrv.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/ATRAPS.Gen2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4bbb8d9f.qua' verschoben!
Code:
ATTFilter Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2011.12.31.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 ***p :: JAN-LAPTOP2 [Administrator] 31.12.2011 13:10:08 mbam-log-2011-12-31 (13-10-08).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 439468 Laufzeit: 1 Stunde(n), 41 Minute(n), 14 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Backdoor.Agent) -> Daten: C:\Users\***p\AppData\Local\6e15ba28\X -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 31.12.2011 15:20:13 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\***p\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 2,30 Gb Available Physical Memory | 59,47% Memory free 7,73 Gb Paging File | 6,07 Gb Available in Paging File | 78,56% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 452,97 Gb Total Space | 318,82 Gb Free Space | 70,38% Space Free | Partition Type: NTFS Drive D: | 525,88 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: JAN-LAPTOP2 | User Name: ***p | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.12.31 02:08:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\***p\Desktop\OTL.exe PRC - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 13:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.09 11:54:58 | 000,055,144 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe PRC - [2010.07.20 17:21:40 | 000,323,280 | ---- | M] (Napster) -- C:\Program Files (x86)\Napster\napster.exe PRC - [2010.04.08 21:18:40 | 000,908,368 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2010.04.08 21:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe PRC - [2010.04.08 21:18:40 | 000,298,064 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe PRC - [2010.03.09 00:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe PRC - [2010.03.03 13:42:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2010.03.03 13:41:58 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010.02.26 22:39:02 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe PRC - [2009.12.24 01:39:04 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe PRC - [2005.01.18 16:37:30 | 000,217,088 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\Video\LogiTray.exe PRC - [2005.01.18 16:08:36 | 000,192,512 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\Video\FxSvr2.exe ========== Modules (No Company Name) ========== MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.02.26 22:39:02 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe MOD - [2009.05.20 23:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.01.22 18:01:12 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.11.02 11:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010.06.01 18:54:35 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2010.04.08 21:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.09 00:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2010.03.03 13:42:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R) SRV - [2010.03.03 13:41:58 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R) SRV - [2010.02.05 19:23:06 | 000,865,824 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc) SRV - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Updater Service) SRV - [2009.12.24 01:39:04 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.12.09 10:46:54 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.10.11 14:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.16 12:18:27 | 000,046,112 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd) DRV:64bit: - [2010.11.14 17:48:44 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:64bit: - [2010.04.07 19:04:22 | 002,216,960 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.01.22 18:13:24 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:64bit: - [2010.01.22 17:07:56 | 000,161,280 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2009.12.17 18:42:08 | 000,538,136 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.12.02 03:21:32 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor) DRV:64bit: - [2009.11.02 11:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2009.10.26 21:39:44 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd) DRV:64bit: - [2009.10.22 05:55:06 | 000,272,432 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService) DRV:64bit: - [2009.10.16 11:32:22 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM) DRV:64bit: - [2009.09.30 18:34:32 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.09.17 11:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009.08.18 13:06:36 | 000,135,168 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnet.sys -- (ZTEusbnet) DRV:64bit: - [2009.08.18 13:06:36 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zteusbvoice.sys -- (ZTEusbvoice) DRV:64bit: - [2009.08.18 13:06:36 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k) DRV:64bit: - [2009.08.18 13:06:36 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea) DRV:64bit: - [2009.08.18 13:06:36 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k) DRV:64bit: - [2009.08.18 13:06:36 | 000,011,776 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.20 03:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) DRV:64bit: - [2009.06.10 21:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 21:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2008.06.16 02:00:00 | 000,055,024 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2007.05.09 20:50:48 | 000,050,208 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64) DRV:64bit: - [2007.05.09 20:46:48 | 001,127,328 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV:64bit: - [2007.05.09 20:46:36 | 000,016,032 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64) DRV - [2010.03.19 15:15:50 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/11/14 17:34:14] [Kernel | Auto | Running] -- C:\Program Files (x86)\Cyberlink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD}) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lm85&r=27361110p3b6l0460z1i5f4611d44n IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lm85&r=27361110p3b6l0460z1i5f4611d44n IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lm85&r=27361110p3b6l0460z1i5f4611d44n IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lm85&r=27361110p3b6l0460z1i5f4611d44n IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lm85&r=27361110p3b6l0460z1i5f4611d44n IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "Google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@reiner-sct.com/OWOK,version=2.0.0.4: C:\Program Files (x86)\REINER SCT\OWOK\NPAPI-20\nprsct_owok_npapi-2004.dll (REINER Kartengeräte GmbH und Co. KG.) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.11 19:52:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.23 10:27:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.11.13 19:43:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.11.14 17:36:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Extensions [2010.11.14 17:36:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.11.11 19:34:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\y2j3dj3u.default\extensions [2011.11.11 19:52:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.09.01 21:09:05 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.11.11 19:52:09 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2010.11.10 21:44:21 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.07.20 17:21:40 | 000,106,192 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npstrlnk.dll [2011.06.23 16:26:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.06.23 16:26:49 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.06.23 16:26:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.06.23 16:26:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.06.23 16:26:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.06.23 16:26:48 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated) O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe () O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files (x86)\Logitech\Video\ISStart.exe (Logitech Inc.) O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files (x86)\Logitech\Video\LogiTray.exe (Logitech Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\***p\AppData\Local\Akamai\netsession_win.exe File not found O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKCU..\Run: [EPSON Stylus DX4400] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICAE.EXE /FU "C:\Windows\TEMP\E_S12D6.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [EPSON Stylus DX4400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICAE.EXE /FU "C:\Windows\TEMP\E_SDB27.tmp" /EF "HKCU" File not found O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files (x86)\Logitech\Video\ManifestEngine.exe (Logitech Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F7547AA-0DC6-4D70-9D11-97D11E9135C2}: DhcpNameServer = 192.33.112.29 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B67B12A0-8897-4D85-A570-D3F6E2A300BA}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F79AE88E-F11C-469E-B816-BBB8A8ACDF17}: DhcpNameServer = 139.7.30.125 139.7.30.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC9DB454-AE82-406E-B970-C6DCCAEAA56F}: DhcpNameServer = 139.7.30.125 139.7.30.126 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (C:\Users\***p\AppData\Local\6e15ba28\X) -C:\Users\***p\AppData\Local\6e15ba28\X () O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2000.10.19 13:26:18 | 001,744,896 | R--- | M] (Impressions Games) - D:\AUTORUN.EXE -- [ CDFS ] O32 - AutoRun File - [2000.10.05 09:00:56 | 000,000,126 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{143f74c7-6da3-11df-aee7-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{143f74c7-6da3-11df-aee7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AUTORUN.EXE -- [2000.10.19 13:26:18 | 001,744,896 | R--- | M] (Impressions Games) O33 - MountPoints2\{e2868a85-40d3-11e0-b16a-78e400de3d53}\Shell - "" = AutoRun O33 - MountPoints2\{e2868a85-40d3-11e0-b16a-78e400de3d53}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Program Files (x86)\PixiePack Codec Pack\InstallerHelper.exe ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.12.31 03:01:35 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{F5EFF8F3-0493-4B3A-86DA-799E368338BE} [2011.12.31 03:01:18 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{27E12A56-830F-45A7-8B65-71792FC4B9EA} [2011.12.31 02:36:08 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Roaming\Malwarebytes [2011.12.31 02:36:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.31 02:36:02 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.31 02:36:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.12.31 02:36:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.31 02:08:35 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\***p\Desktop\OTL.exe [2011.12.31 01:57:54 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{1F859F05-8435-4006-B89C-C9ED30AECA1B} [2011.12.31 01:57:41 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{07604D1F-CB2E-4C42-AADE-1A04423CF83C} [2011.12.31 01:18:04 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{F3F75EBE-9E8C-436C-AD3C-8293132FB59D} [2011.12.31 01:17:52 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{74BED3A8-E807-4F76-B225-EBA7DCB020D3} [2011.12.30 16:55:10 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{7894EF4F-9451-47B2-A586-2168931BD78D} [2011.12.30 16:54:58 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{BDB8536A-EBFF-43BE-886C-328DC1D1ABE2} [2011.12.30 11:15:46 | 000,000,000 | -HSD | C] -- C:\Users\***p\AppData\Local\6e15ba28 [2011.12.30 10:02:18 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{11109EF5-3856-45CC-88EE-D86AB1E162C9} [2011.12.30 10:02:05 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{0334421C-CA70-4B60-91A0-B055127D5FEA} [2011.12.29 18:39:24 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{55F3C176-2966-4935-A9F5-E082016B96B4} [2011.12.29 18:39:09 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{B3E24AB8-7F76-4017-B0B8-43F9B0DD4B15} [2011.12.29 15:18:07 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{D091D177-E7B7-429F-948A-730EE4DA2D9E} [2011.12.29 15:17:55 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{CC8BD0D0-F1CE-401C-A47B-78746C2A2460} [2011.12.29 09:26:13 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{17124DEB-147D-48AA-9F2A-B3252025E161} [2011.12.29 09:26:02 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{2356C6FA-81F0-42EE-BC33-5ECEF44E5819} [2011.12.28 22:11:13 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{97B8BA2E-85B5-4B87-A610-8F8AF8809616} [2011.12.28 22:11:02 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{E7B31453-A99B-4FDD-9E9B-E7FE2B39B8D2} [2011.12.27 21:02:37 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{2BDC04EC-0B0E-4DAD-B618-BB19E68A21C0} [2011.12.27 21:02:19 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{152C646B-4384-4CA2-B7E9-4E7A886BA945} [2011.12.27 17:42:00 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{FAD6C584-F9D4-4CCF-859F-5F04818DC109} [2011.12.27 17:41:49 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{3CDAF678-3D14-467F-A299-5D56402D3B78} [2011.12.26 22:50:48 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{2D69B3ED-541F-4E24-8DA5-F759B0E5DAE7} [2011.12.26 22:50:36 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{EB5E91ED-E882-4981-A18D-D38CA1506419} [2011.12.26 10:45:06 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\SWTOR [2011.12.26 10:44:56 | 000,000,000 | ---D | C] -- C:\Users\***p\Documents\HeroBlade Logs [2011.12.25 22:17:35 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{C973A60C-3C95-4C9B-83CB-E72A74EB0AB7} [2011.12.25 22:17:21 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{5A1689C4-FE6B-4DD3-839C-0E3325A80108} [2011.12.25 21:57:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA [2011.12.25 21:57:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\BioWare [2011.12.24 22:37:43 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{5A900FBD-9F2F-4E39-9DD0-A1FD4F1B4001} [2011.12.24 22:37:31 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{2864C02B-7204-4BBB-9E6E-C35ECEEA7078} [2011.12.24 15:03:28 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{EEE0D075-549C-4568-A82B-470C50A2994B} [2011.12.24 15:03:17 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{B08D863F-C696-4E53-A159-ECC95329E490} [2011.12.22 20:38:10 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{5B0B2950-662C-4291-A67A-E7C57C7C2B8A} [2011.12.22 20:37:59 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{F7E0726B-6581-432A-B1CA-232C18ADDADC} [2011.12.20 19:51:29 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{F2F5A032-27F0-4725-8C75-D8036155F599} [2011.12.20 19:51:15 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{DC584C34-8A5E-42CD-A284-12F88A8714DA} [2011.12.19 20:04:01 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{EF82C575-07DF-4774-A68B-71622578120A} [2011.12.19 20:03:48 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{FB95EC1D-1790-44C6-AE5C-4966FEF914EE} [2011.12.18 10:15:08 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{90598E80-C14D-46D2-85C0-424E05594F83} [2011.12.18 10:14:56 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{965E7937-2F5B-4CEB-B174-36443101375F} [2011.12.17 18:06:38 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{0460C51A-5CE8-45C0-9C58-8167B25D3EE2} [2011.12.17 18:06:25 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{D828EED4-679F-4495-8BA9-8C3AD5B2DEA9} [2011.12.16 20:10:24 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{C5E1322E-600F-4ABA-995D-DACDDF149AA2} [2011.12.16 20:10:07 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{A63DBC49-07C2-4DDC-A2C1-E2F4E5BB7EE7} [2011.12.15 22:51:42 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Roaming\Amazon [2011.12.15 22:51:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon [2011.12.15 21:42:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.12.15 21:41:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2011.12.15 21:41:56 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011.12.15 21:41:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2011.12.15 21:41:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2011.12.15 21:41:17 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2011.12.15 21:41:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2011.12.15 21:38:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2011.12.15 21:38:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple [2011.12.15 21:29:59 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Roaming\WindSolutions [2011.12.15 21:29:58 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions [2011.12.15 20:08:59 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{98B23AE9-0B46-4E69-904B-C655418AE7DA} [2011.12.15 20:08:39 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{D45F9B3F-52E5-4BF8-BCBB-994208F6D474} [2011.12.14 19:08:51 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{9AAB812A-00A0-4BC9-AF8F-0FA42A71DAD5} [2011.12.14 19:08:39 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{6931897B-9A8F-45B0-8275-DF908813EA35} [2011.12.14 14:26:47 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{6F5DC193-78E9-4B63-8B62-E86CBAA27715} [2011.12.14 14:26:26 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{21966B7A-27EA-41A5-8449-84C9793D7FD2} [2011.12.11 19:36:03 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{0BB8412C-083A-4457-94F5-65535B2BF135} [2011.12.11 19:35:50 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{748350AC-70AC-451E-AB88-CC3D9D58F890} [2011.12.10 11:44:16 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{85332E7E-FBF9-46D9-BB34-9D36CD1C59E8} [2011.12.10 11:44:04 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{FFBFC55F-73BA-4D7B-8C52-21A927CF4FC3} [2011.12.10 00:42:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.12.10 00:42:12 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2011.12.09 10:48:24 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{445E0139-F759-4064-AC73-669674193CAB} [2011.12.09 10:48:12 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{524043D6-40FA-4572-8EF3-6C5566145947} [2011.12.08 11:59:46 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{FABC5AE6-D7CD-4C2D-9CE7-A3B83D536334} [2011.12.08 11:59:34 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{02F50F3C-25D8-40D5-998A-1BA3F758A53B} [2011.12.07 19:54:31 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{52FD1041-8488-4FC8-93B2-EF0005272133} [2011.12.07 19:54:19 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{B65C6249-D7EF-4DA4-978D-5273C8FE4FED} [2011.12.05 20:02:04 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{8F73A2A5-9934-49FF-9F9D-9E45967EC0E7} [2011.12.05 20:01:50 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{022DE2E9-7F88-4B49-8704-64FC7289F8E7} [2011.12.04 11:32:41 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{8EBAB23F-5ECA-4599-803A-A2F3C553ED15} [2011.12.04 11:32:26 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{ED845A14-A941-451B-B9D7-F1936ED5AF5E} [2011.12.03 18:07:40 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{4656B953-5068-482E-BBF0-2A7C5AD89256} [2011.12.03 18:07:14 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{321B1E2D-8CC3-4D7B-A630-2FCF1FDDFDCC} [2011.12.02 20:52:21 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{F8C58A11-69F8-4A76-83E1-E0A6AE8D5EB3} [2011.12.02 20:52:02 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{EDA302F1-8915-48A8-9A6D-692E0619F039} [2011.12.01 20:04:41 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\{AB03A945-A35A-4117-83CD-4DCF4C73BEF1} [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.12.31 14:33:07 | 000,021,840 | ---- | M] () -- C:\Windows\SysWow64\SIntfNT.dll [2011.12.31 14:33:07 | 000,017,212 | ---- | M] () -- C:\Windows\SysWow64\SIntf32.dll [2011.12.31 14:33:07 | 000,012,067 | ---- | M] () -- C:\Windows\SysWow64\SIntf16.dll [2011.12.31 13:17:27 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.31 13:17:27 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.31 13:09:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.31 13:08:52 | 3111,514,112 | -HS- | M] () -- C:\hiberfil.sys [2011.12.31 02:42:23 | 000,001,993 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2011.12.31 02:38:28 | 000,000,188 | ---- | M] () -- C:\Users\***p\defogger_reenable [2011.12.31 02:36:03 | 000,001,088 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.31 02:08:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\***p\Desktop\OTL.exe [2011.12.31 01:44:07 | 000,046,386 | ---- | M] () -- C:\Users\***p\Desktop\Link.png [2011.12.25 21:58:11 | 000,001,428 | ---- | M] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk [2011.12.25 21:45:08 | 000,731,772 | ---- | M] () -- C:\Users\***p\Desktop\Unbenannt.png [2011.12.15 21:42:49 | 000,001,762 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.12.15 20:05:42 | 000,429,616 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.09 23:40:48 | 000,001,770 | ---- | M] () -- C:\Users\***p\Desktop\Herrscher des Olymp - Zeus.lnk [2011.12.09 23:34:22 | 000,000,402 | ---- | M] () -- C:\Windows\SIERRA.INI [2011.12.09 10:46:54 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.12.31 02:38:28 | 000,000,188 | ---- | C] () -- C:\Users\***p\defogger_reenable [2011.12.31 02:36:03 | 000,001,088 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2011.12.31 01:44:07 | 000,046,386 | ---- | C] () -- C:\Users\***p\Desktop\Link.png [2011.12.25 21:58:11 | 000,001,428 | ---- | C] () -- C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk [2011.12.25 21:45:07 | 000,731,772 | ---- | C] () -- C:\Users\***p\Desktop\Unbenannt.png [2011.12.15 21:42:49 | 000,001,762 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.12.15 21:41:36 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2011.12.09 23:40:54 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll [2011.12.09 23:40:54 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll [2011.12.09 23:40:54 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll [2011.12.09 23:40:48 | 000,001,770 | ---- | C] () -- C:\Users\***p\Desktop\Herrscher des Olymp - Zeus.lnk [2011.10.23 15:28:39 | 000,000,402 | ---- | C] () -- C:\Windows\SIERRA.INI [2011.04.02 13:35:18 | 000,000,019 | ---- | C] () -- C:\Windows\popcinfo.dat [2010.11.21 19:02:17 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll [2010.11.11 22:50:13 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.11.11 19:34:49 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.06.02 04:14:30 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2010.06.02 04:13:34 | 000,001,791 | ---- | C] () -- C:\Windows\WPatchProgress.ini [2010.06.01 18:54:56 | 000,000,033 | ---- | C] () -- C:\Windows\LaunApp.ini [2010.06.01 18:38:28 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe [2010.06.01 18:38:28 | 000,000,302 | ---- | C] () -- C:\Windows\PidList_C.ini [2010.06.01 18:32:42 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.05.07 04:43:04 | 000,000,193 | ---- | C] () -- C:\Windows\Prelaunch.ini [2010.05.07 04:43:04 | 000,000,168 | ---- | C] () -- C:\Windows\WisLangCode.ini [2010.05.07 04:43:04 | 000,000,147 | ---- | C] () -- C:\Windows\WisPriority.ini [2009.11.25 13:40:50 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin [2009.07.13 22:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin [2009.07.13 22:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin [2009.07.13 22:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [1999.01.27 12:39:06 | 000,065,024 | ---- | C] () -- C:\Windows\SysWow64\indounin.dll [1997.06.13 06:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\Iyvu9_32.dll ========== LOP Check ========== [2011.12.15 22:51:42 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Amazon [2010.11.21 11:50:21 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools Lite [2011.04.27 19:37:54 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\FotoWire [2011.11.03 09:54:28 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\RIFT [2011.06.02 12:08:44 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\SNS [2010.11.11 20:48:58 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\TeamViewer [2010.11.14 17:36:42 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Thunderbird [2011.12.31 01:54:37 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\TS3Client [2010.11.10 21:46:23 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\TuneUp Software [2011.05.02 02:12:57 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Unity [2011.02.25 12:42:56 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Vodafone [2011.03.01 17:08:01 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\WildTangentv1002 [2011.12.15 21:37:59 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\WindSolutions [2011.10.27 18:39:28 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.02.10 21:02:37 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.11.11 19:11:22 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2010.11.11 19:13:42 | 000,000,000 | ---D | M] -- C:\elements [2010.11.14 17:24:02 | 000,000,000 | ---D | M] -- C:\IDE [2010.05.07 04:05:57 | 000,000,000 | ---D | M] -- C:\Intel [2010.11.14 17:22:43 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.11.13 12:59:09 | 000,000,000 | ---D | M] -- C:\Netts [2010.11.11 19:11:39 | 000,000,000 | -H-D | M] -- C:\OEM [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.12.15 21:41:58 | 000,000,000 | R--D | M] -- C:\Program Files [2011.12.31 02:36:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86) [2011.12.31 02:36:02 | 000,000,000 | -H-D | M] -- C:\ProgramData [2010.11.11 19:11:22 | 000,000,000 | -HSD | M] -- C:\Programme [2010.11.11 19:11:22 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.11.03 09:55:15 | 000,000,000 | ---D | M] -- C:\RocWorks [2011.12.09 23:31:36 | 000,000,000 | ---D | M] -- C:\SIERRA [2011.12.31 15:23:40 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.04.21 18:00:46 | 000,000,000 | R--D | M] -- C:\Users [2011.12.31 01:55:29 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < MD5 for: AFD.SYS > [2011.04.25 03:44:02 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=6EF20DDF3172E97D69F596FB90602F29 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys [2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys [2010.11.20 10:23:34 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys [2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys [2011.04.25 03:44:27 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=FBFF8B7C9D116229E9208A0D1CAEB49B -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys < MD5 for: EXPLORER.EXE > [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2010.05.07 04:38:53 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2010.05.07 04:31:05 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2010.05.07 04:38:53 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2010.05.07 04:31:05 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2010.05.07 04:38:53 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2010.05.07 04:31:05 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2010.05.07 04:38:53 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2010.05.07 04:31:05 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2010.05.07 04:38:53 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2010.05.07 04:38:53 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > aswMBR habe ich auch mal laufen lassen. Code:
ATTFilter aswMBR version 0.9.9.1124 Copyright(c) 2011 AVAST Software
Run date: 2011-12-31 16:03:52
-----------------------------
16:03:52.994 OS Version: Windows x64 6.1.7601 Service Pack 1
16:03:52.994 Number of processors: 4 586 0x2502
16:03:52.994 ComputerName: JAN-LAPTOP2 UserName: ***p
16:03:55.287 Initialize success
16:04:13.763 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:04:13.763 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
16:04:13.810 Disk 0 MBR read successfully
16:04:13.810 Disk 0 MBR scan
16:04:13.826 Disk 0 Windows VISTA default MBR code
16:04:13.826 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13000 MB offset 2048
16:04:13.841 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 26626048
16:04:13.857 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 463838 MB offset 26830848
16:04:13.857 Service scanning
16:04:14.871 Modules scanning
16:04:14.871 Disk 0 trace - called modules:
16:04:14.918 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
16:04:14.918 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bf1060]
16:04:14.918 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800492f050]
16:04:15.433 Scan finished successfully
16:05:50.317 Disk 0 MBR has been saved successfully to "C:\Users\***p\Desktop\MBR.dat"
16:05:50.323 The log file has been saved successfully to "C:\Users\***p\Desktop\aswMBR.txt"
Nun natürlich die Fragen: Was habe ich? Wie gefährlich ist das? Wie werde ich das wieder los? Vielen Dank im vorraus für eure Hilfe. Geändert von Kayy (31.12.2011 um 16:28 Uhr) |
| Themen zu mediashifting.com - unregelmäßge Tab-Öffnung |
| 'tr/atraps.gen2', akamai, antivir, bho, bonjour, c:\windows\system32\rundll32.exe, classpnp.sys, computer, computern, dateisystem, firefox, frage, google, hal.dll, heuristiks/extra, heuristiks/shuriken, home, karte, launch, logfile, mozilla, mozilla thunderbird, packard bell, plug-in, programm, realtek, registry, required, rundll, scan, schädling, software, system, trojan, version=1.0, viren, virus, webcheck, wildtangent games, windows |
Baum-Darstellung