| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: mbam MeldungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.01.2012, 08:08
| #1 |
 |  mbam Meldung Hallo an alle, ich vermute das ich einen trojaner oder ähnliches auf meinem laptop habe, da ich gestern eine ominöse testüberweisung beim online-banking machen sollte, die ich natürlich nicht durchgeführt habe. von einem sicheren pc aus habe ich die pw's schon geändert. ich habe daraufhin mbam, superantispyware, spybot und antivir nacheinander über mein system laufen lassen, die jedoch alle nicht viel gefunden haben. bei mbam habe ich die 14tägige testversion angeklickt und nun bringt mbam immer die meldung "zugang zu einer potentiell gefährliche website 31.184.237.148 erfolgreich gestoppt" (abgehend)" oder so!!! danach habe ich im forum von HJT eine anleitung gefunden welche antiviren programme mal prinzipiell über system laufen lassen kann. das hab ich gemacht und "Dr.Web-cureit" hat dann endlich einiges gefunden. nun ist meine frage, ob mein system soweit sauber ist!?! Kann mir bitte jemand weiter helfen?!? VG chiquita PS HJT Logfile Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 08:00:23, on 18.01.2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\IDT\WDM\stacsv.exe C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe C:\WINDOWS\Explorer.EXE C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\IDT\WDM\sttray.exe C:\WINDOWS\system32\AESTFltr.exe C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe C:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe C:\WINDOWS\system32\WLTRAY.exe C:\Programme\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programme\WIDCOMM\Bluetooth Software\BtTray.exe C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lkcitdl.exe C:\WINDOWS\system32\lkads.exe C:\WINDOWS\system32\lktsrv.exe C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe C:\Programme\National Instruments\Shared\Security\nidmsrv.exe C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe C:\Programme\RDS\RDSService.exe C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/sphome.aspx R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USREL/8 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.bing.com/sphome.aspx R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://r.office.microsoft.com/r/rlidOfficeUserRegSetup?clid=1031 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\WI371A~1\Datamngr\BROWSE~1.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg O4 - HKLM\..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe O4 - HKLM\..\Run: [DellControlPoint] "c:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe" O4 - HKLM\..\Run: [DellConnectionManager] "C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [USCService] C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /installquiet O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [NUSB3MON] "C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Txtwmi] C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\packlink\javator.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send To Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Web-Suche - C:\Programme\SweetIM\Toolbars\Internet Explorer\resources\menuext.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O15 - ESC Trusted Zone: hxxp://*.update.microsoft.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291383512875 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - AppInit_DLLs: C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Dell ControlPoint Button Service (buttonsvc32) - Dell Inc. - C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe O23 - Service: Credential Vault Host Control Service - Broadcom Corporation - C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe O23 - Service: Credential Vault Host Storage - Broadcom Corporation - C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments Corporation - C:\WINDOWS\system32\lkads.exe O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments Corporation - C:\WINDOWS\system32\lktsrv.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments Corporation - C:\Programme\National Instruments\Shared\Security\nidmsrv.exe O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: RDSService - Unknown owner - C:\Programme\RDS\RDSService.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: Smith Micro Connection Manager Service (SMManager) - Smith Micro Software, Inc. - C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Programme\IDT\WDM\stacsv.exe O23 - Service: NTRU TSS v1.2.1.29 TCS (tcsd_win32.exe) - Unknown owner - C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: DW WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 12545 bytes |
|
18.01.2012, 08:15
| #2 |
| /// Malwareteam    | mbam Meldung Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld  Gruß, PsYcHoTiC
__________________ |
|
18.01.2012, 08:35
| #3 |
| /// Malwareteam | mbam Meldung__________________
__________________ |
|
18.01.2012, 09:49
| #4 |
| | mbam Meldung Hier die geforderte FileOTL Logfile: Code:
ATTFilter OTL logfile created on: 18.01.2012 08:57:56 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Hexmet\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,49 Gb Total Physical Memory | 2,88 Gb Available Physical Memory | 82,69% Memory free 5,33 Gb Paging File | 4,75 Gb Available in Paging File | 89,24% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 149,01 Gb Total Space | 122,40 Gb Free Space | 82,15% Space Free | Partition Type: NTFS Computer Name: H463RN1 | User Name: Hexmet | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.01.18 08:54:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hexmet\Desktop\OTL.exe PRC - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.11.09 11:42:38 | 001,694,608 | ---- | M] (Bandoo Media, inc) -- C:\Programme\Windows iLivid Toolbar\Datamngr\datamngrUI.exe PRC - [2011.10.11 14:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 13:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.11.02 08:47:10 | 001,224,704 | ---- | M] (Romer) -- C:\Programme\RDS\RDSService.exe PRC - [2010.07.21 22:01:34 | 000,159,616 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe PRC - [2010.06.22 17:33:38 | 000,034,232 | ---- | M] (Broadcom Corporation) -- C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe PRC - [2010.05.25 09:52:20 | 000,495,708 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe PRC - [2010.05.25 09:52:14 | 000,245,842 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\stacsv.exe PRC - [2010.05.25 09:51:36 | 000,737,280 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe PRC - [2010.04.30 06:52:54 | 003,795,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe PRC - [2010.03.29 18:45:48 | 001,164,648 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe PRC - [2010.03.24 06:09:28 | 000,812,448 | ---- | M] (Broadcom Corporation) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe PRC - [2010.03.24 06:09:28 | 000,027,040 | ---- | M] (Broadcom Corporation) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe PRC - [2010.03.04 02:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.03.04 02:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.02.08 22:24:06 | 001,338,224 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe PRC - [2010.02.08 22:20:18 | 000,376,688 | ---- | M] (Dell Inc.) -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe PRC - [2009.12.22 17:23:52 | 001,845,248 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe PRC - [2009.12.22 17:23:34 | 000,077,312 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe PRC - [2009.11.20 23:42:48 | 000,278,304 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe PRC - [2009.11.20 19:17:54 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2009.11.02 17:40:54 | 000,657,920 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe PRC - [2009.01.16 23:56:42 | 000,604,776 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2008.06.17 17:38:28 | 000,213,552 | ---- | M] (National Instruments Corporation) -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe PRC - [2008.06.17 17:38:16 | 000,050,736 | ---- | M] (National Instruments Corporation) -- C:\WINDOWS\system32\lktsrv.exe PRC - [2008.06.17 17:38:08 | 000,040,488 | ---- | M] (National Instruments Corporation) -- C:\WINDOWS\system32\lkads.exe PRC - [2008.06.17 16:21:50 | 000,695,136 | ---- | M] (National Instruments, Inc.) -- C:\WINDOWS\system32\lkcitdl.exe PRC - [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.01.06 13:40:50 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll MOD - [2012.01.06 13:40:39 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3c272cad7afb127e2a2bdb8a5a808512\System.Runtime.Remoting.ni.dll MOD - [2012.01.06 13:40:00 | 000,372,736 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll MOD - [2012.01.03 14:10:46 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU MOD - [2011.10.14 14:07:44 | 000,170,496 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\e47ebc55d9036f7eb854afc0a80472f7\IsdiInterop.ni.dll MOD - [2011.10.14 14:07:43 | 000,453,120 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\224bf16aacb22cef27ebd3b83afe5eeb\IAStorUtil.ni.dll MOD - [2011.10.14 14:07:43 | 000,176,128 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\780cd129bf85736abf86afc43aeb6be9\IAStorDataMgr.ni.dll MOD - [2011.10.14 14:07:43 | 000,019,968 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\e979a81a75f3ece9384fe7a9b52a5be4\IAStorDataMgrSvc.ni.exe MOD - [2011.10.14 14:07:40 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\90b90e700e59d73d6d692cf74e1ba16e\System.Management.ni.dll MOD - [2011.10.14 07:05:25 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll MOD - [2011.10.14 07:04:52 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll MOD - [2011.10.14 07:04:47 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll MOD - [2011.10.14 07:04:35 | 003,325,440 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\1adc4ae51a5ac63e896a1402749ca495\WindowsBase.ni.dll MOD - [2011.10.14 07:04:31 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll MOD - [2011.10.14 07:04:28 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll MOD - [2011.10.14 07:04:26 | 007,950,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll MOD - [2011.10.14 07:04:19 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll MOD - [2011.10.11 13:59:51 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2010.09.16 22:11:05 | 000,046,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Status Lib\1.6.460.18066__f25c74fcad379103\Status Lib.dll MOD - [2010.09.16 22:11:05 | 000,014,240 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\StatusInterfaces\1.6.460.18065__4ca2a925deedf37d\StatusInterfaces.dll MOD - [2010.09.16 20:59:50 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2010.09.16 20:59:49 | 000,315,392 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.09.16 20:59:47 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll MOD - [2010.04.30 06:52:54 | 003,795,560 | ---- | M] () -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe MOD - [2010.03.04 02:08:58 | 000,058,880 | ---- | M] () -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll MOD - [2010.03.02 18:46:38 | 000,010,752 | ---- | M] () -- C:\WINDOWS\system32\Wavx_ESC_Logging.dll MOD - [2010.02.03 03:47:42 | 000,143,360 | ---- | M] () -- C:\WINDOWS\system32\preflib.dll MOD - [2010.02.03 03:45:58 | 000,757,760 | ---- | M] () -- C:\WINDOWS\system32\bcm1xsup.dll MOD - [2010.01.19 18:44:30 | 000,249,856 | ---- | M] () -- C:\WINDOWS\system32\wxvault.dll MOD - [2009.12.22 17:21:12 | 000,128,512 | ---- | M] () -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMBIOSController.dll MOD - [2009.12.22 17:19:42 | 000,573,440 | ---- | M] () -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll MOD - [2009.01.16 23:55:38 | 002,854,976 | ---- | M] () -- C:\WINDOWS\system32\btwicons.dll MOD - [2009.01.16 23:53:32 | 000,069,697 | ---- | M] () -- C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll MOD - [2008.11.12 19:29:06 | 000,004,608 | ---- | M] () -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll ========== Win32 Services (SafeList) ========== SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.11.02 08:47:10 | 001,224,704 | ---- | M] (Romer) [Auto | Running] -- C:\Programme\RDS\RDSService.exe -- (RDSService) SRV - [2010.05.25 09:52:14 | 000,245,842 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv.exe -- (STacSV) SRV - [2010.04.30 06:52:54 | 003,795,560 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe -- (NVIDIA Performance Driver Service) SRV - [2010.03.29 18:45:48 | 001,164,648 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe -- (TdmService) SRV - [2010.03.24 06:09:28 | 000,812,448 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service) SRV - [2010.03.24 06:09:28 | 000,027,040 | ---- | M] (Broadcom Corporation) [Auto | Running] -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage) SRV - [2010.03.04 02:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2010.02.08 22:20:18 | 000,376,688 | ---- | M] (Dell Inc.) [Auto | Running] -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc) SRV - [2010.02.03 23:24:20 | 001,032,192 | ---- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService) SRV - [2009.12.22 17:23:34 | 000,077,312 | ---- | M] (Smith Micro Software, Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe -- (SMManager) SRV - [2009.11.20 23:42:48 | 000,278,304 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe -- (buttonsvc32) SRV - [2008.11.12 19:25:48 | 001,273,856 | ---- | M] () [Auto | Stopped] -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe -- (tcsd_win32.exe) SRV - [2008.06.17 17:38:28 | 000,213,552 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService) SRV - [2008.06.17 17:38:16 | 000,050,736 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\WINDOWS\system32\lktsrv.exe -- (lkTimeSync) SRV - [2008.06.17 17:38:08 | 000,040,488 | ---- | M] (National Instruments Corporation) [Auto | Running] -- C:\WINDOWS\system32\lkads.exe -- (lkClassAds) SRV - [2008.06.17 16:21:50 | 000,695,136 | ---- | M] (National Instruments, Inc.) [Auto | Running] -- C:\WINDOWS\system32\lkcitdl.exe -- (LkCitadelServer) SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.12.09 07:24:13 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.10.11 14:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 14:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.09.16 21:49:11 | 000,991,784 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2010.09.16 21:49:11 | 000,534,568 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio) DRV - [2010.09.16 21:49:11 | 000,156,816 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS) DRV - [2010.09.16 21:49:11 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver) DRV - [2010.09.16 21:49:11 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.05.25 09:52:14 | 001,660,691 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) DRV - [2010.05.25 09:51:34 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud) DRV - [2010.02.03 03:47:32 | 002,696,448 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX) DRV - [2010.01.19 18:46:26 | 000,233,856 | ---- | M] (Wave Systems Corp.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\WavxDMgr.sys -- (WavxDMgr) DRV - [2009.11.09 15:31:54 | 000,193,696 | ---- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\windrvr6.sys -- (WinDriver6) DRV - [2009.11.03 23:40:42 | 000,033,832 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv) DRV - [2009.11.02 10:16:18 | 000,010,520 | ---- | M] (Broadcom Corporation) [Kernel | Auto | Running] -- C:\Programme\Broadcom\BACS\BASFND.sys -- (BASFND) DRV - [2009.10.27 20:39:50 | 000,214,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2009.10.26 12:39:04 | 000,125,696 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Impcd.sys -- (Impcd) DRV - [2009.10.15 08:59:04 | 000,090,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp) DRV - [2009.09.17 07:05:02 | 000,092,712 | ---- | M] (SafeNet, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel) DRV - [2009.09.17 07:05:02 | 000,038,376 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS -- (SNTNLUSB) DRV - [2009.08.21 10:00:00 | 000,004,096 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\cvintdrv.sys -- (cvintdrv) DRV - [2009.06.19 16:44:14 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2009.04.15 15:49:48 | 000,028,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID) DRV - [2008.10.31 06:19:14 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2008.06.04 20:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\PBADRV.sys -- (PBADRV) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = Willkommen beim Dell-Support IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = Dell | MSN IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = Dell | MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Dell | MSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Bing IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dell | MSN IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..keyword.URL: "www.google.de" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.10 07:24:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.01.10 14:08:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Mozilla\Extensions [2012.01.02 10:36:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Mozilla\Firefox\Profiles\juw9ggwx.default\extensions [2012.01.10 14:08:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.01.10 07:24:49 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.12.09 08:44:33 | 000,002,519 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.01.17 13:10:10 | 000,000,789 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc) O4 - HKLM..\Run: [DellConnectionManager] C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.) O4 - HKLM..\Run: [DellControlPoint] c:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NUSB3MON] C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /installquiet File not found O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [USCService] C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation) O4 - HKLM..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.) O4 - HKCU..\Run: [Txtwmi] C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\packlink\javator.exe () O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Dell ControlPoint System Manager.lnk = C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send To Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Web-Suche - C:\Programme\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291383512875 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.158.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{84EB4465-DE57-4652-AC1D-CABBAC508985}: DhcpNameServer = 192.168.158.2 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O30 - LSA: Authentication Packages - (wvauth) -C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.04.25 16:00:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell - "" = AutoRun O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Bluetooth.lnk - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe - (Broadcom Corporation.) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^TdmNotify.lnk - C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe - (Wave Systems Corp.) MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: PDVDDXSrv - hkey= - key= - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.) MsConfig - StartUpReg: SUPERAntiSpyware - hkey= - key= - File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.01.18 08:54:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hexmet\Desktop\OTL.exe [2012.01.17 13:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\DoctorWeb [2012.01.17 07:20:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Malwarebytes [2012.01.17 07:20:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.01.17 07:20:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.01.17 07:20:16 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.01.17 07:20:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.01.16 12:59:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel [2012.01.10 13:57:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy [2012.01.10 13:57:38 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy [2012.01.10 13:57:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy [2012.01.09 15:00:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Eurocopter_Babylon [2011.12.19 14:10:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\pdfforge [2011.12.19 14:10:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDFCreator [2011.12.19 14:10:00 | 000,000,000 | ---D | C] -- C:\Programme\PDFCreator [2011.12.19 11:29:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Leadertech [2011.12.19 11:25:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Xerox Office Printing [2011.12.19 11:24:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Xerox [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.18 08:56:02 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\defogger_reenable [2012.01.18 08:55:06 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\7ft92huv.exe [2012.01.18 08:54:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Hexmet\Desktop\OTL.exe [2012.01.18 08:54:18 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Defogger.exe [2012.01.18 08:52:41 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.01.18 08:50:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.01.18 08:49:36 | 000,069,109 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001 [2012.01.18 08:48:53 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat [2012.01.18 08:48:50 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.01.18 08:48:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.01.18 08:48:44 | 3745,689,600 | -HS- | M] () -- C:\hiberfil.sys [2012.01.18 08:00:02 | 000,464,904 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.01.18 08:00:02 | 000,446,190 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.01.18 08:00:02 | 000,087,090 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.01.18 08:00:02 | 000,073,396 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012.01.17 13:10:10 | 000,000,789 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2012.01.17 08:23:32 | 000,000,245 | RHS- | M] () -- C:\boot.ini [2012.01.13 07:24:44 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2012.01.10 13:18:12 | 000,001,645 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\fsc.db [2012.01.10 13:12:45 | 000,006,656 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.01.10 11:22:01 | 000,001,088 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\TBSettings.db [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.18 08:56:02 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\defogger_reenable [2012.01.18 08:55:06 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\7ft92huv.exe [2012.01.18 08:54:18 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Defogger.exe [2012.01.18 07:54:46 | 3745,689,600 | -HS- | C] () -- C:\hiberfil.sys [2012.01.10 11:22:01 | 000,001,088 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\TBSettings.db [2011.12.19 14:10:01 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2011.11.11 08:11:34 | 000,006,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.12.03 14:21:10 | 000,216,952 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin [2010.12.03 14:21:09 | 000,216,952 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin [2010.12.03 14:21:09 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin [2010.12.03 13:54:37 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2010.12.03 13:54:37 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat [2010.09.16 23:00:10 | 002,186,342 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin [2010.09.16 22:56:36 | 000,001,505 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2010.09.16 22:24:37 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2010.09.16 22:04:33 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll [2010.09.16 22:04:33 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE [2010.09.16 21:16:45 | 000,308,624 | ---- | C] () -- C:\WINDOWS\System32\brcmbsp.dll [2010.09.16 21:16:45 | 000,206,216 | ---- | C] () -- C:\WINDOWS\System32\bipbsp.dll [2010.09.16 21:13:55 | 000,080,368 | ---- | C] () -- C:\WINDOWS\System32\pbadrvdll.dll [2010.09.16 20:22:48 | 000,069,109 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat [2010.03.02 18:46:38 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\Wavx_ESC_Logging.dll [2010.02.04 17:18:22 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_th.dll [2010.02.04 17:18:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-HK.dll [2010.02.04 17:18:20 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sl.dll [2010.02.04 17:18:18 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sk.dll [2010.02.04 17:18:18 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_hr.dll [2010.02.04 17:18:12 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ro.dll [2010.02.04 17:18:12 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_tr.dll [2010.02.04 17:18:10 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pt-BR.dll [2010.02.04 17:18:10 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_hu.dll [2010.02.04 17:18:08 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_fi.dll [2010.02.04 17:18:08 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_he.dll [2010.02.04 17:18:06 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_el.dll [2010.02.04 17:18:06 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_cs.dll [2010.02.04 17:18:04 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ar.dll [2010.02.04 17:18:04 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHT.dll [2010.02.04 17:18:02 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHS.dll [2010.02.04 17:18:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sv.dll [2010.02.04 17:18:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ru.dll [2010.02.04 17:17:58 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pt.dll [2010.02.04 17:17:58 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pl.dll [2010.02.04 17:17:56 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_nl.dll [2010.02.04 17:17:56 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_no.dll [2010.02.04 17:17:54 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ko.dll [2010.02.04 17:17:54 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ja.dll [2010.02.04 17:17:52 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_it.dll [2010.02.04 17:17:50 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_fr.dll [2010.02.04 17:17:50 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_es.dll [2010.02.04 17:17:48 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_de.dll [2010.02.04 17:17:46 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_da.dll [2010.01.19 18:44:30 | 000,249,856 | ---- | C] () -- C:\WINDOWS\System32\wxvault.dll [2009.12.22 17:03:22 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll [2009.11.06 21:27:22 | 000,839,680 | ---- | C] () -- C:\WINDOWS\System32\DemoLicense.dll [2009.08.26 22:25:08 | 000,917,504 | ---- | C] () -- C:\WINDOWS\System32\lmgr10.dll [2009.08.21 10:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\cvintdrv.sys [2009.01.16 23:55:38 | 002,854,976 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2008.04.25 16:02:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008.04.25 15:57:56 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008.04.25 15:57:02 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2008.04.25 10:46:09 | 000,464,904 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2008.04.25 10:46:09 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2008.04.25 10:46:09 | 000,087,090 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2008.04.25 10:46:09 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2008.04.25 10:45:57 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2008.04.25 10:45:56 | 000,446,190 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2008.04.25 10:45:56 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2008.04.25 10:45:56 | 000,073,396 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2008.04.25 10:45:56 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2008.04.25 10:45:55 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2008.04.25 10:45:55 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2008.04.25 10:45:53 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2008.04.25 10:45:50 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2008.04.25 10:45:50 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2008.04.25 10:45:46 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2008.04.25 10:45:43 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2008.04.25 02:52:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008.04.25 02:51:36 | 000,269,392 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008.03.25 15:46:00 | 000,077,536 | ---- | C] () -- C:\WINDOWS\System32\xltZlib.dll [2006.06.30 18:58:44 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll [2006.06.30 18:58:44 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\bioapi100.dll [2001.11.14 18:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== LOP Check ========== [2010.09.16 22:01:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AT&T [2011.12.09 09:03:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess [2010.09.16 21:14:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Broadcom [2010.12.21 14:44:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Delcam [2010.12.03 15:03:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\National Instruments [2010.09.16 22:06:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NTRU Cryptosystems [2010.09.16 22:07:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Wave Systems Corp [2011.12.13 14:08:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\BACS.exe [2010.09.16 22:24:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Broadcom [2010.12.16 08:46:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Delcam [2012.01.16 12:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\inkscape [2011.12.19 11:29:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Leadertech [2011.12.09 08:49:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\packlink [2011.12.19 14:10:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\pdfforge [2011.12.09 08:55:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchquband [2012.01.10 13:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchqutoolbar [2010.09.16 22:10:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Wave Systems Corp [2010.12.03 14:36:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Windows Search [2011.12.19 11:29:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Xerox ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.09.16 22:15:42 | 000,000,000 | ---D | M] -- C:\apps [2010.12.21 14:46:25 | 000,000,000 | ---D | M] -- C:\dcam [2010.12.03 14:26:33 | 000,000,000 | ---D | M] -- C:\dell [2010.12.03 13:54:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2010.09.17 03:08:35 | 000,000,000 | ---D | M] -- C:\drivers [2010.09.16 20:33:43 | 000,000,000 | ---D | M] -- C:\I386 [2010.09.16 21:45:06 | 000,000,000 | ---D | M] -- C:\Intel [2010.12.03 14:33:44 | 000,000,000 | RH-D | M] -- C:\MSOCache [2010.09.16 22:15:34 | 000,000,000 | ---D | M] -- C:\Program Files [2012.01.17 07:20:16 | 000,000,000 | R--D | M] -- C:\Programme [2010.12.03 14:36:57 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2012.01.17 09:06:44 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.01.18 08:49:36 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: AFD.SYS > [2011.08.17 14:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\dllcache\afd.sys [2011.08.17 14:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\drivers\afd.sys [2011.02.16 14:22:48 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=355556D9E580915118CD7EF736653A89 -- C:\WINDOWS\$NtUninstallKB2592799$\afd.sys [2008.10.16 16:07:58 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=38D7B715504DA4741DF35E3594FE2099 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys [2008.08.14 11:34:26 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=4D43E74F2A1239D53929B82600F1971C -- C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys [2008.10.16 15:43:01 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7618D5218F2A614672EC61A80D854A37 -- C:\WINDOWS\$NtUninstallKB2503665$\afd.sys [2008.08.14 11:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$NtUninstallKB2509553$\afd.sys [2011.02.16 14:25:05 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=8D499B1276012EB907E7A9E0F4D8FDA4 -- C:\WINDOWS\$hf_mig$\KB2503665\SP3QFE\afd.sys [2008.06.20 12:48:03 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=D6EE6014241D034E63C49A50CB2B442A -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys [2011.08.17 14:41:46 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys < MD5 for: EXPLORER.EXE > [2008.04.14 13:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe < MD5 for: IPSEC.SYS > [2008.04.14 13:00:00 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys < MD5 for: REGEDIT.EXE > [2008.04.14 13:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\I386\REGEDIT.EXE [2008.04.14 13:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 13:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008.04.14 13:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011.11.23 15:39:21 | 001,868,672 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-13 06:24:48 < End of report > |
|
18.01.2012, 09:49
| #5 |
| | mbam Meldung Hilft dir etwa das HTJ-Log nicht weiter??? |
|
18.01.2012, 11:03
| #6 |
| | mbam Meldung ok! frage hat sich erledigt!  hxxp://www.trojaner-board.de/95174-bitte-keine-hijackthis-logfiles-posten.html |
|
18.01.2012, 16:30
| #7 |
| /// Malwareteam | mbam MeldungMein Name ist Marius und ich werde dir bei deinem Problem helfen. Eines vorneweg: Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist. Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.
Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Zunächst: bitte poste auch die Extras.txt, die von OTL erstellt wurde! Dann weiter mit GMER: GMER Bitte
__________________ Kein Asylrecht für Trojaner!  Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
23.01.2012, 08:52
| #8 |
| | mbam Meldung hier der GMER file GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-23 08:46:07
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST916041 rev.0004
Running: 7ft92huv.exe; Driver: C:\DOKUME~1\Hexmet\LOKALE~1\Temp\uxtdipow.sys
---- System - GMER 1.0.15 ----
SSDT AB9172AC ZwClose
SSDT AB917266 ZwCreateKey
SSDT AB9172B6 ZwCreateSection
SSDT AB91725C ZwCreateThread
SSDT AB91726B ZwDeleteKey
SSDT AB917275 ZwDeleteValueKey
SSDT AB9172A7 ZwDuplicateObject
SSDT AB91727A ZwLoadKey
SSDT AB917248 ZwOpenProcess
SSDT AB91724D ZwOpenThread
SSDT AB9172CF ZwQueryValueKey
SSDT AB917284 ZwReplaceKey
SSDT AB9172C0 ZwRequestWaitReplyPort
SSDT AB91727F ZwRestoreKey
SSDT AB9172BB ZwSetContextThread
SSDT AB9172C5 ZwSetSecurityObject
SSDT AB917270 ZwSetValueKey
SSDT AB9172CA ZwSystemDebugControl
SSDT AB917257 ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB58373A0, 0x592C25, 0xE8000020]
.text ntdll.dll!NtCreateThread 7C91D1AE 5 Bytes [E8, 4D, 2E, 49, 84] {CALL 0xffffffff84492e52}
.text ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes [E8, 0D, 29, 12, 84] {CALL 0xffffffff84122912}
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\Explorer.EXE[1420] ntdll.dll!NtCreateThread 7C91D1AE 5 Bytes CALL 02EC0000
.text C:\WINDOWS\Explorer.EXE[1420] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes CALL 02C80000
.text C:\WINDOWS\Explorer.EXE[1420] kernel32.dll!ExitProcess 7C81CB12 5 Bytes CALL 02EE0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] ntdll.dll!NtCreateThread 7C91D1AE 5 Bytes CALL 00DB0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] ntdll.dll!NtProtectVirtualMemory 7C91D6EE 5 Bytes CALL 00A40000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] kernel32.dll!ExitProcess 7C81CB12 5 Bytes CALL 00DD0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] ws2_32.dll!send 71A14C27 5 Bytes CALL 01010000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!InternetReadFile 408C655B 5 Bytes CALL 00DF0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!InternetCloseHandle 408C9098 5 Bytes CALL 00FF0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!InternetQueryDataAvailable 408CBF93 5 Bytes CALL 00E50000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpAddRequestHeadersA 408CCF5E 5 Bytes CALL 00F70000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpOpenRequestA 408CD518 5 Bytes CALL 00FB0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpSendRequestW 408CFACE 5 Bytes CALL 00F50000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpOpenRequestW 408CFC0B 5 Bytes CALL 00FD0000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpAddRequestHeadersW 408CFE59 5 Bytes CALL 00F90000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!HttpSendRequestA 408DEEA1 5 Bytes CALL 00F30000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!InternetReadFileExW 408E3239 5 Bytes CALL 00E30000
.text C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\7ft92huv.exe[5268] wininet.dll!InternetReadFileExA 408E3271 5 Bytes CALL 00E10000
---- Devices - GMER 1.0.15 ----
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Files - GMER 1.0.15 ----
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Abstandsgewebe\Vorauswahl_8_AK_LL_1.doc 32256 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Abstandsgewebe\Vorauswahl_Abst.Gew.+PUR_Za_1.doc 32768 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Abstandsgewebe\Vorauswahl_Abst.Gew._Randgeschäumt_18_AK.doc 32768 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Abstandsgewebe\Vorauswahl_Da_1.doc 32256 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Genopptes Blech\Vorauswahl_Noppenblech_Al.doc 32256 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchung Sandwichmaterialien für variablen, selbsttragenden Aufbau eines Transporters_Peter Runze\Datenbank_Kern_Haut\Material_Vorauswahl\Vorauswahl_Kombinationen\Sonstiges\Genopptes Blech\Vorauswahl_Noppenblech_Stahl.doc 31744 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Comparison to other foams\comparison to other foams.pdf 597844 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Comparison to other foams\fatigue.htm 4529 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Comparison to other foams\_vti_cnf 0 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Comparison to other foams\_vti_cnf\comparison to other foams.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Comparison to other foams\_vti_cnf\fatigue.htm 1433 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreep110WF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreep200WF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreep51S.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreep51WF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreep71WF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreepHF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreepIG.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreepWF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\compcreepXT.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Compressive Creep\_vti_cnf\creep behaviour-general.pdf 324 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Dielectric Data\_vti_cnf\dielectric constant.pdf 347 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Drying and Heat treatment\drying and heat treatment.pdf 462958 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Drying and Heat treatment\drying time 71WF.pdf 347961 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Drying and Heat treatment\_vti_cnf 0 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Drying and Heat treatment\_vti_cnf\drying and heat treatment.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Drying and Heat treatment\_vti_cnf\drying time 71WF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Dynamical Shear Modulus\dynshearmodulus.htm 932 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Dynamical Shear Modulus\_vti_cnf 0 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Dynamical Shear Modulus\_vti_cnf\dynshearmodulus.htm 1119 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Elevated Temperatures\_vti_cnf\elevated temp.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Fire Behaviour\_vti_cnf\DNV-approval_IMO-HSC-Code.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Fire Behaviour\_vti_cnf\fire general.htm 1007 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Fire Behaviour\_vti_cnf\fire overview.htm 1117 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Impact Energy Absorption\ImpactRCIG.pdf 162054 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Impact Energy Absorption\_vti_cnf 0 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Impact Energy Absorption\_vti_cnf\ImpactRCIG.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Moisture Absorption\_vti_cnf\moistureabsorp general.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Moisture Absorption\_vti_cnf\moistureabsorp sandwich.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Moisture Absorption\_vti_cnf\moistureabsorpIGA.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Moisture Absorption\_vti_cnf\moistureabsorpWF.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Moisture Absorption\_vti_cnf\moistureabsorpXT.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Poisson Ratio\_vti_cnf\poisson ratio_general.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Poisson Ratio\_vti_cnf\poisson ratio_values.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Pressure Behaviour of Foams\pressure.PDF 356185 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Pressure Behaviour of Foams\_vti_cnf 0 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Pressure Behaviour of Foams\_vti_cnf\PRESSURE.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Property Overview\_vti_cnf\Comparison chart.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Thermal Expansion\_vti_cnf\coefficient of thermal expansion.pdf 173 bytes
File C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Diplomarbeiten\Untersuchungen Sandwich-Strukturen in Nassinfiltrationstechnik_Franz Schreiner\Rohacell\Rohacell-Produktinformations-CD---START_MIT_HTMLRUN.EXE---\TechData\Properties\Thermal Expansion\_vti_cnf\thermal expansion 71AWF.pdf 173 bytes
---- EOF - GMER 1.0.15 ----
|
|
23.01.2012, 08:53
| #9 |
| | mbam Meldung und Extras.txt fileOTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 18.01.2012 08:57:56 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Hexmet\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,88 Gb Available Physical Memory | 82,69% Memory free
5,33 Gb Paging File | 4,75 Gb Available in Paging File | 89,24% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,01 Gb Total Space | 122,40 Gb Free Space | 82,15% Space Free | Partition Type: NTFS
Computer Name: H463RN1 | User Name: Hexmet | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker -- (Visicom Media Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}" = UPEK TouchChip Fingerprint Reader
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{0876FD34-9953-4BE6-AA77-C98D3E88EBDB}" = Dell ControlPoint System Manager
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{1B2333BC-7320-4CD5-90C8-7F3FFDE9D796}" = PISysUpdate
"{1E60A729-EC11-40D6-AB86-BA3637C521EC}" = NI Uninstaller
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24B7F9A4-4FA8-437A-8289-2E473E7B4B53}" = NI Logos 5.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{284D3B99-E8F5-4411-A7DD-7072EFCF3A46}" = Dell ControlPoint Connection Manager
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C0A8D65-4286-4B58-87FE-18AD24289285}" = NVIDIA Performance Drivers
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{5A26B7C0-55B1-4DA8-A693-E51380497A5E}" = Dell ControlVault Host Components Installer
"{5FDA8F6A-E87C-484B-BDE2-12C1BE199149}" = Wave Infrastructure Installer
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6991DAF8-91DB-4EA4-8D80-04789C646B66}" = NI Logos XT Support
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B1AA2AB-ACD2-45C7-B1B1-364BEA40615F}" = Sentinel Protection Installer 7.6.1
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{863B903C-4D08-4A9C-9081-EF6A9F7E705E}" = Client für die Windows-Rechteverwaltung mit Service Pack 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9761D880-BC70-4861-B9E6-4308904F59E4}" = NI EULA Depot
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A688E2AA-3061-47B8-BEB4-6347660059B3}" = NI LabWindows/CVI 9.0.1 Run-Time Engine
"{A8BB36D2-D5E8-4BA1-B107-0A3B6E2D9BC6}" = NI MDF Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9C61491-EF2F-4ED8-8E10-FB33E3C6B55A}" = Dell Control Point
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BF9E346B-5ECE-4A18-9510-55729FD08323}" = Sentinel System Driver Installer 7.5.1
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFB0F311-C051-4760-A64A-12CA2609E91A}" = NI TDMS
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D6E46FC2-B513-4B7D-8C8C-352F4735C541}" = Broadcom NetXtreme-I Netlink Driver and Management Installer
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DB2C5648-700D-4AEF-83E1-70C72F0C34FA}" = NI Math Kernel Libraries
"{DDD6BE8C-9AFA-48F1-A6AE-3BD596E2EB0B}" = Trusted Drive Manager
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Rückwärtskompatibilität des Clients für die Windows-Rechteverwaltung SP2
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FE1BF95D-9E68-43FF-B0D1-441CE39B4E97}" = Delcam PostProcessor 2010 SP4
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9512AA21B791B05A54E27065C45BBC417AB282DF" = Windows-Treiberpaket - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Delcam Exchange 6.3.10" = Delcam Exchange 2011
"Delcam PAFWizard 4.2.01" = Delcam PAFWizard 2010
"Delcam PowerINSPECT 9.0.0" = Delcam PowerINSPECT 2011 (remove only)
"Dienstprogramm für die DW WLAN-Karte" = Dienstprogramm für die DW WLAN-Karte
"ie8" = Windows Internet Explorer 8
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"NI Uninstaller" = National Instruments-Software
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PROHYBRIDR" = 2007 Microsoft Office system
"RDS" = RDS
"SynTPDeinstKey" = Dell Touchpad
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Searchqu Toolbar" = Windows iLivid Toolbar
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ OSession Events ]
Error - 02.12.2011 06:11:32 | Computer Name = H463RN1 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3830
seconds with 3180 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 17.01.2012 07:59:23 | Computer Name = H463RN1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 17.01.2012 08:00:46 | Computer Name = H463RN1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 17.01.2012 08:01:30 | Computer Name = H463RN1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error - 17.01.2012 08:01:59 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DHCP-Client" ist vom Dienst "NetBios über TCP/IP" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.01.2012 08:01:59 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DNS-Client" ist vom Dienst "TCP/IP-Protokolltreiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.01.2012 08:01:59 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "TCP/IP-NetBIOS-Hilfsprogramm" ist vom Dienst "AFD" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.01.2012 08:01:59 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "IPSEC-Dienste" ist vom Dienst "IPSEC-Treiber" abhängig,
der aufgrund folgenden Fehlers nicht gestartet wurde: %%31
Error - 17.01.2012 08:01:59 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD avipbb avkmgr Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip
Error - 18.01.2012 02:54:02 | Computer Name = H463RN1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 18.01.2012 02:55:01 | Computer Name = H463RN1 | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume2" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
< End of report >
|
|
24.01.2012, 20:42
| #10 | |
| /// Malwareteam | mbam Meldung Schritt 1: Software deinstallieren
Schritt 2: OTL-Fix
Code:
ATTFilter :OTL
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
[2011.12.09 09:03:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2011.12.09 08:49:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\packlink
[2011.12.09 08:55:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchquband
[2012.01.10 13:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchqutoolbar
:files
C:\PROGRA~1\WI371A~1
:Commands
[emptytemp]
Schritt 3: MBAM Downloade Dir bitte Malwarebytes
Schritt 4: Neues OTL-Log Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
25.01.2012, 08:07
| #11 |
| | mbam Meldung ich habe die gewünschten aktionen durchgeführt. ich muss aber auch dazu sagen, dass ich schon auf eigene Faust mehrere virenscanner durchlaufen lassen habe, also nach dem erstellen meiner ersten logfiles. unteranderen mbam, mse, antivir, emsisoft, spybot destroyer, tdskiller und dr.web. OTL-Logfile nach FIX: Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0}\ not found.
File C:\Programme\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR not found.
File C:\Programme\Windows iLivid Toolbar\Datamngr\datamngrUI.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll deleted successfully.
File pInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\datamngr.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll deleted successfully.
File pInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) -C:\Programme\Windows iLivid Toolbar\Datamngr\IEBHO.dll not found.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess\501A9EF248B6CC01 folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess folder moved successfully.
C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\packlink folder moved successfully.
C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchquband folder moved successfully.
Folder C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\searchqutoolbar\ not found.
========== FILES ==========
File\Folder C:\PROGRA~1\WI371A~1 not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: Hexmet
->Temp folder emptied: 131624182 bytes
->Temporary Internet Files folder emptied: 1837701 bytes
->Java cache emptied: 51548 bytes
->FireFox cache emptied: 193132007 bytes
->Flash cache emptied: 6309 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 10746 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 274806 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 312,00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 01252012_073454
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
mbam-logfile Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.0.1800 www.malwarebytes.org Datenbank Version: v2012.01.25.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Hexmet :: H463RN1 [Administrator] Schutz: Deaktiviert 25.01.2012 07:42:33 mbam-log-2012-01-25 (07-42-33).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 189414 Laufzeit: 2 Minute(n), 26 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) OTL-logfile nach SCAN:OTL Logfile: Code:
ATTFilter OTL logfile created on: 25.01.2012 07:52:44 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,49 Gb Total Physical Memory | 2,73 Gb Available Physical Memory | 78,40% Memory free 5,33 Gb Paging File | 4,68 Gb Available in Paging File | 87,82% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 149,01 Gb Total Space | 122,92 Gb Free Space | 82,49% Space Free | Partition Type: NTFS Computer Name: H463RN1 | User Name: Hexmet | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation) PRC - C:\Programme\RDS\RDSService.exe (Romer) PRC - C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.) PRC - C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation) PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.) PRC - C:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.) PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation) PRC - C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe () PRC - C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.) PRC - C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation) PRC - C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation) PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.) PRC - c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.) PRC - C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.) PRC - C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.) PRC - C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.) PRC - C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) PRC - C:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\National Instruments\Shared\Security\nidmsrv.exe (National Instruments Corporation) PRC - C:\WINDOWS\system32\lktsrv.exe (National Instruments Corporation) PRC - C:\WINDOWS\system32\lkads.exe (National Instruments Corporation) PRC - C:\WINDOWS\system32\lkcitdl.exe (National Instruments, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\62e34cfb5a8b233667c7c5a47a32ad93\System.Web.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3c272cad7afb127e2a2bdb8a5a808512\System.Runtime.Remoting.ni.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll () MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\e47ebc55d9036f7eb854afc0a80472f7\IsdiInterop.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\224bf16aacb22cef27ebd3b83afe5eeb\IAStorUtil.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\780cd129bf85736abf86afc43aeb6be9\IAStorDataMgr.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\e979a81a75f3ece9384fe7a9b52a5be4\IAStorDataMgrSvc.ni.exe () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\90b90e700e59d73d6d692cf74e1ba16e\System.Management.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\71a2ae9ad561a62181cbd9fb11e9de7a\System.Windows.Forms.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\c10bea3c4bb7ef654651141bf9419090\System.Drawing.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\1adc4ae51a5ac63e896a1402749ca495\WindowsBase.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll () MOD - C:\Programme\WinRAR\RarExt.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\Status Lib\1.6.460.18066__f25c74fcad379103\Status Lib.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\StatusInterfaces\1.6.460.18065__4ca2a925deedf37d\StatusInterfaces.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll () MOD - C:\Programme\Unlocker\UnlockerCOM.dll () MOD - C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe () MOD - C:\Programme\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll () MOD - C:\WINDOWS\system32\Wavx_ESC_Logging.dll () MOD - C:\WINDOWS\system32\preflib.dll () MOD - C:\WINDOWS\system32\bcm1xsup.dll () MOD - C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\ContextMenuItem.dll () MOD - C:\WINDOWS\system32\wxvault.dll () MOD - C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMBIOSController.dll () MOD - C:\Programme\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll () MOD - C:\WINDOWS\system32\btwicons.dll () MOD - C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll () MOD - C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll () MOD - C:\WINDOWS\system32\pdfcmnnt.dll () ========== Win32 Services (SafeList) ========== SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation) SRV - (RDSService) -- C:\Programme\RDS\RDSService.exe (Romer) SRV - (STacSV) -- C:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.) SRV - (NVIDIA Performance Driver Service) -- C:\Programme\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe () SRV - (TdmService) -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (Wave Systems Corp.) SRV - (Credential Vault Host Control Service) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (Broadcom Corporation) SRV - (Credential Vault Host Storage) -- C:\Programme\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (Broadcom Corporation) SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (dcpsysmgrsvc) -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (Dell Inc.) SRV - (SecureStorageService) -- C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe (Wave Systems Corp.) SRV - (SMManager) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (Smith Micro Software, Inc.) SRV - (buttonsvc32) -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe (Dell Inc.) SRV - (tcsd_win32.exe) -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe () SRV - (NIDomainService) -- C:\Programme\National Instruments\Shared\Security\nidmsrv.exe (National Instruments Corporation) SRV - (lkTimeSync) -- C:\WINDOWS\system32\lktsrv.exe (National Instruments Corporation) SRV - (lkClassAds) -- C:\WINDOWS\system32\lkads.exe (National Instruments Corporation) SRV - (LkCitadelServer) -- C:\WINDOWS\system32\lkcitdl.exe (National Instruments, Inc.) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (btwmodem) -- C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.) DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.) DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation) DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (WavxDMgr) -- C:\WINDOWS\system32\drivers\WavxDMgr.sys (Wave Systems Corp.) DRV - (WinDriver6) -- C:\WINDOWS\system32\drivers\windrvr6.sys (Jungo) DRV - (cvusbdrv) -- C:\WINDOWS\system32\drivers\cvusbdrv.sys (Broadcom Corporation) DRV - (BASFND) -- C:\Programme\Broadcom\BACS\BASFND.sys (Broadcom Corporation) DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation) DRV - (Impcd) -- C:\WINDOWS\system32\drivers\Impcd.sys (Intel Corporation) DRV - (Blfp) -- C:\WINDOWS\system32\drivers\baspxp32.sys (Broadcom Corporation) DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.) DRV - (SNTNLUSB) -- C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (SafeNet, Inc.) DRV - (cvintdrv) -- C:\WINDOWS\System32\drivers\cvintdrv.sys () DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments) DRV - (USBCCID) -- C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (PBADRV) -- C:\WINDOWS\system32\DRIVERS\PBADRV.sys (Dell Inc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Help_Page = hxxp://support.euro.dell.com/support/index.aspx?c=de&l=de&s=gen IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.bing.com/sphome.aspx IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = hxxp://g.uk.msn.com/USREL/8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/sphome.aspx IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..keyword.URL: "www.google.de" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.10 07:24:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.01.10 14:08:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Mozilla\Extensions [2012.01.02 10:36:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Mozilla\Firefox\Profiles\juw9ggwx.default\extensions [2012.01.10 14:08:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.01.10 07:24:49 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.12.09 08:44:33 | 000,002,519 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.01.17 13:10:10 | 000,000,789 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation) O4 - HKLM..\Run: [DellConnectionManager] C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.) O4 - HKLM..\Run: [DellControlPoint] c:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Programme\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [MSC] c:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [NUSB3MON] C:\Programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /installquiet File not found O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [USCService] C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation) O4 - HKLM..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Dell ControlPoint System Manager.lnk = C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Dell Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Send To Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Web-Suche - C:\Programme\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291383512875 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.158.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{84EB4465-DE57-4652-AC1D-CABBAC508985}: DhcpNameServer = 192.168.158.2 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O30 - LSA: Authentication Packages - (wvauth) -C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.04.25 16:00:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell - "" = AutoRun O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{65748898-2d41-11e0-9c52-c79f057a90e5}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.01.25 07:40:48 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.01.25 07:34:54 | 000,000,000 | ---D | C] -- C:\_OTL [2012.01.25 07:22:38 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2012.01.25 07:22:38 | 000,017,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2012.01.24 13:47:08 | 000,000,000 | ---D | C] -- C:\Programme\Unlocker [2012.01.24 13:47:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Startmenü\Programme\Unlocker [2012.01.24 13:13:44 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [2012.01.24 13:08:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\PCHealth [2012.01.24 13:08:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Client [2012.01.24 11:33:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC [2012.01.24 11:08:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Frame_Demonstrator [2012.01.24 08:45:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Desktop\*** [2012.01.23 10:54:23 | 000,000,000 | ---D | C] -- C:\Programme\Defraggler [2012.01.18 10:06:17 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Hexmet\Recent [2012.01.18 10:04:50 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2012.01.17 13:07:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\DoctorWeb [2012.01.17 07:20:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Malwarebytes [2012.01.17 07:20:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.01.16 12:59:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel [2012.01.10 13:57:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy [2012.01.09 15:00:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Hexmet\Desktop\*** ========== Files - Modified Within 30 Days ========== [2012.01.25 07:50:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.01.25 07:43:02 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2012.01.25 07:38:41 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat [2012.01.25 07:38:40 | 000,069,109 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001 [2012.01.25 07:37:57 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.01.25 07:37:56 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.01.25 07:37:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.01.25 07:37:49 | 3745,689,600 | -HS- | M] () -- C:\hiberfil.sys [2012.01.25 07:34:56 | 000,464,904 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012.01.25 07:34:56 | 000,446,190 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012.01.25 07:34:56 | 000,087,090 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012.01.25 07:34:56 | 000,073,396 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012.01.24 13:08:28 | 000,001,912 | ---- | M] () -- C:\WINDOWS\epplauncher.mif [2012.01.24 13:08:04 | 000,001,654 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Microsoft Security Essentials.lnk [2012.01.23 10:52:28 | 000,000,239 | RHS- | M] () -- C:\boot.ini [2012.01.20 13:57:58 | 001,523,200 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Edge.pwi [2012.01.18 08:56:02 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\defogger_reenable [2012.01.17 13:10:10 | 000,000,789 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2012.01.10 13:18:12 | 000,001,645 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\fsc.db [2012.01.10 13:12:45 | 000,006,656 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.01.10 11:22:01 | 000,001,088 | ---- | M] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\TBSettings.db ========== Files Created - No Company Name ========== [2012.01.24 13:13:22 | 000,000,416 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2012.01.24 13:08:28 | 000,001,912 | ---- | C] () -- C:\WINDOWS\epplauncher.mif [2012.01.24 13:08:04 | 000,001,654 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Microsoft Security Essentials.lnk [2012.01.24 12:07:31 | 3745,689,600 | -HS- | C] () -- C:\hiberfil.sys [2012.01.20 13:57:57 | 001,523,200 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\Edge.pwi [2012.01.18 08:56:02 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\defogger_reenable [2012.01.10 11:22:01 | 000,001,088 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Desktop\TBSettings.db [2011.12.19 14:10:01 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2011.11.11 08:11:34 | 000,006,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.12.03 14:21:10 | 000,216,952 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin [2010.12.03 14:21:09 | 000,216,952 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin [2010.12.03 14:21:09 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin [2010.12.03 13:54:37 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2010.12.03 13:54:37 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Hexmet\Lokale Einstellungen\Anwendungsdaten\WavXMapDrive.bat [2010.09.16 23:00:10 | 002,186,342 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin [2010.09.16 22:56:36 | 000,001,505 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2010.09.16 22:24:37 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2010.09.16 22:04:33 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll [2010.09.16 22:04:33 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE [2010.09.16 21:16:45 | 000,308,624 | ---- | C] () -- C:\WINDOWS\System32\brcmbsp.dll [2010.09.16 21:16:45 | 000,206,216 | ---- | C] () -- C:\WINDOWS\System32\bipbsp.dll [2010.09.16 21:13:55 | 000,080,368 | ---- | C] () -- C:\WINDOWS\System32\pbadrvdll.dll [2010.09.16 20:22:48 | 000,069,109 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat [2010.03.02 18:46:38 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\Wavx_ESC_Logging.dll [2010.02.04 17:18:22 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_th.dll [2010.02.04 17:18:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-HK.dll [2010.02.04 17:18:20 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sl.dll [2010.02.04 17:18:18 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sk.dll [2010.02.04 17:18:18 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_hr.dll [2010.02.04 17:18:12 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ro.dll [2010.02.04 17:18:12 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_tr.dll [2010.02.04 17:18:10 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pt-BR.dll [2010.02.04 17:18:10 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_hu.dll [2010.02.04 17:18:08 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_fi.dll [2010.02.04 17:18:08 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_he.dll [2010.02.04 17:18:06 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_el.dll [2010.02.04 17:18:06 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_cs.dll [2010.02.04 17:18:04 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ar.dll [2010.02.04 17:18:04 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHT.dll [2010.02.04 17:18:02 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_zh-CHS.dll [2010.02.04 17:18:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_sv.dll [2010.02.04 17:18:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ru.dll [2010.02.04 17:17:58 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pt.dll [2010.02.04 17:17:58 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_pl.dll [2010.02.04 17:17:56 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_nl.dll [2010.02.04 17:17:56 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_no.dll [2010.02.04 17:17:54 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ko.dll [2010.02.04 17:17:54 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_ja.dll [2010.02.04 17:17:52 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_it.dll [2010.02.04 17:17:50 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_fr.dll [2010.02.04 17:17:50 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_es.dll [2010.02.04 17:17:48 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_de.dll [2010.02.04 17:17:46 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\Internationalization_da.dll [2010.01.19 18:44:30 | 000,249,856 | ---- | C] () -- C:\WINDOWS\System32\wxvault.dll [2009.12.22 17:03:22 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll [2009.11.06 21:27:22 | 000,839,680 | ---- | C] () -- C:\WINDOWS\System32\DemoLicense.dll [2009.08.26 22:25:08 | 000,917,504 | ---- | C] () -- C:\WINDOWS\System32\lmgr10.dll [2009.08.21 10:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\cvintdrv.sys [2009.01.16 23:55:38 | 002,854,976 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2008.04.25 16:02:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008.04.25 15:57:56 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008.04.25 15:57:02 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2008.04.25 10:46:09 | 000,464,904 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2008.04.25 10:46:09 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2008.04.25 10:46:09 | 000,087,090 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2008.04.25 10:46:09 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2008.04.25 10:45:57 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2008.04.25 10:45:56 | 000,446,190 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2008.04.25 10:45:56 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2008.04.25 10:45:56 | 000,073,396 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2008.04.25 10:45:56 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2008.04.25 10:45:55 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2008.04.25 10:45:55 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2008.04.25 10:45:53 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2008.04.25 10:45:50 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2008.04.25 10:45:50 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2008.04.25 10:45:46 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2008.04.25 10:45:43 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2008.04.25 02:52:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008.04.25 02:51:36 | 000,269,392 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008.03.25 15:46:00 | 000,077,536 | ---- | C] () -- C:\WINDOWS\System32\xltZlib.dll [2006.06.30 18:58:44 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\bioapi_mds300.dll [2006.06.30 18:58:44 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\bioapi100.dll [2001.11.14 18:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== LOP Check ========== [2010.09.16 22:01:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AT&T [2010.09.16 21:14:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Broadcom [2010.12.21 14:44:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Delcam [2010.12.03 15:03:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\National Instruments [2010.09.16 22:06:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NTRU Cryptosystems [2010.09.16 22:07:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Wave Systems Corp [2011.12.13 14:08:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\BACS.exe [2010.09.16 22:24:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Broadcom [2010.12.16 08:46:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Delcam [2012.01.16 12:57:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\inkscape [2011.12.19 11:29:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Leadertech [2011.12.19 14:10:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\pdfforge [2010.09.16 22:10:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Wave Systems Corp [2010.12.03 14:36:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Windows Search [2011.12.19 11:29:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Hexmet\Anwendungsdaten\Xerox [2012.01.25 07:43:02 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job ========== Purity Check ========== < End of report > Extras.txt:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 25.01.2012 07:52:44 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\TrojanerBoard
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,73 Gb Available Physical Memory | 78,40% Memory free
5,33 Gb Paging File | 4,68 Gb Available in Paging File | 87,82% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,01 Gb Total Space | 122,92 Gb Free Space | 82,49% Space Free | Partition Type: NTFS
Computer Name: H463RN1 | User Name: Hexmet | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0003C1E0-E0E7-49BB-A0F6-4AE6D2B09202}" = UPEK TouchChip Fingerprint Reader
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{0876FD34-9953-4BE6-AA77-C98D3E88EBDB}" = Dell ControlPoint System Manager
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1B2333BC-7320-4CD5-90C8-7F3FFDE9D796}" = PISysUpdate
"{1E60A729-EC11-40D6-AB86-BA3637C521EC}" = NI Uninstaller
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24B7F9A4-4FA8-437A-8289-2E473E7B4B53}" = NI Logos 5.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{284D3B99-E8F5-4411-A7DD-7072EFCF3A46}" = Dell ControlPoint Connection Manager
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C0A8D65-4286-4B58-87FE-18AD24289285}" = NVIDIA Performance Drivers
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{5A26B7C0-55B1-4DA8-A693-E51380497A5E}" = Dell ControlVault Host Components Installer
"{5FDA8F6A-E87C-484B-BDE2-12C1BE199149}" = Wave Infrastructure Installer
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6991DAF8-91DB-4EA4-8D80-04789C646B66}" = NI Logos XT Support
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B1AA2AB-ACD2-45C7-B1B1-364BEA40615F}" = Sentinel Protection Installer 7.6.1
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{863B903C-4D08-4A9C-9081-EF6A9F7E705E}" = Client für die Windows-Rechteverwaltung mit Service Pack 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9761D880-BC70-4861-B9E6-4308904F59E4}" = NI EULA Depot
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A688E2AA-3061-47B8-BEB4-6347660059B3}" = NI LabWindows/CVI 9.0.1 Run-Time Engine
"{A8BB36D2-D5E8-4BA1-B107-0A3B6E2D9BC6}" = NI MDF Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9C61491-EF2F-4ED8-8E10-FB33E3C6B55A}" = Dell Control Point
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BF9E346B-5ECE-4A18-9510-55729FD08323}" = Sentinel System Driver Installer 7.5.1
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFB0F311-C051-4760-A64A-12CA2609E91A}" = NI TDMS
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D6E46FC2-B513-4B7D-8C8C-352F4735C541}" = Broadcom NetXtreme-I Netlink Driver and Management Installer
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DB2C5648-700D-4AEF-83E1-70C72F0C34FA}" = NI Math Kernel Libraries
"{DDD6BE8C-9AFA-48F1-A6AE-3BD596E2EB0B}" = Trusted Drive Manager
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Rückwärtskompatibilität des Clients für die Windows-Rechteverwaltung SP2
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FE1BF95D-9E68-43FF-B0D1-441CE39B4E97}" = Delcam PostProcessor 2010 SP4
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"9512AA21B791B05A54E27065C45BBC417AB282DF" = Windows-Treiberpaket - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"Delcam Exchange 6.3.10" = Delcam Exchange 2011
"Delcam PAFWizard 4.2.01" = Delcam PAFWizard 2010
"Delcam PowerINSPECT 9.0.0" = Delcam PowerINSPECT 2011 (remove only)
"Dienstprogramm für die DW WLAN-Karte" = Dienstprogramm für die DW WLAN-Karte
"ie8" = Windows Internet Explorer 8
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"NI Uninstaller" = National Instruments-Software
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PROHYBRIDR" = 2007 Microsoft Office system
"RDS" = RDS
"SynTPDeinstKey" = Dell Touchpad
"Unlocker" = Unlocker 1.9.1
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 24.01.2012 04:33:29 | Computer Name = H463RN1 | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 24.01.2012 08:08:12 | Computer Name = H463RN1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0x80070003, P2 moac, P3 cachereset, P4 3.0.8402.0,
P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.
Error - 24.01.2012 08:08:30 | Computer Name = H463RN1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.
Error - 24.01.2012 08:09:08 | Computer Name = H463RN1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.
Error - 24.01.2012 08:09:22 | Computer Name = H463RN1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.
Error - 24.01.2012 08:16:48 | Computer Name = H463RN1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung msseces.exe, Version 2.1.1116.0, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 24.01.2012 08:43:57 | Computer Name = H463RN1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0, P2 moaccapability, P3 3.0.8402.0, P4
0, P5 0, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.
Error - 24.01.2012 08:52:02 | Computer Name = H463RN1 | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 25.01.2012 02:21:39 | Computer Name = H463RN1 | Source = PerfNet | ID = 2005
Description = Die Leistungsinformationen vom Serverdienst konnten nicht gelesen
werden. Es werden keine Server-Leistungsinformationen zurückgegeben. Der zurückgegebene
Fehlercode befindet sich in DWORD 0, der IOSB.Status ist DWORD 1 und die IOSB.Information
ist DWORD 2.
Error - 25.01.2012 02:21:39 | Computer Name = H463RN1 | Source = PerfNet | ID = 2006
Description = Die Server Queue-Leistungsinformationen konnten nicht gelesen werden.
Es
werden keine Server-Leistungsinformationen zurückgegeben. Der zurückgegebene Fehlercode
ist DWORD 0, der IOSB.Status ist DWORD 1 und die IOSB.Information ist DWORD 2.
[ OSession Events ]
Error - 02.12.2011 06:11:32 | Computer Name = H463RN1 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3830
seconds with 3180 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "Dell ControlPoint System Manager" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Bluetooth Service" wurde unerwartet beendet. Dies ist
bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
durchgeführt: Starten Sie den Dienst neu..
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "Lookout Citadel Server" wurde unerwartet beendet. Dies ist
bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "National Instruments PSP Server Locator" wurde unerwartet
beendet. Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "National Instruments Time Synchronization" wurde unerwartet
beendet. Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Performance Driver Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "National Instruments Domain Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 25.01.2012 02:34:55 | Computer Name = H463RN1 | Source = Service Control Manager | ID = 7034
Description = Dienst "RDSService" wurde unerwartet beendet. Dies ist bereits 1 Mal
passiert.
< End of report >
|
|
25.01.2012, 09:21
| #12 |
| /// Malwareteam | mbam Meldung Schritt 1: Onlinescan zur Kontrolle ESET Online Scanner
Schritt 2: Adobe Flash Player aktualisieren Dein Flash-Player ist veraltet. Da gerade diese Software gerne von Schädlingen als Sprungbrett ins System genutzt wird, muss sie immer aktuell gehalten werden. Um den Flash Player zu aktualisieren, gehe bitte wie folgt vor:
Schritt 3: Java aktualisieren Deine Javaversion ist veraltet. Da einige Schädlinge (z. B. Vundo) über Java-Exploits in das System eindringen, muss Java aktualisiert werden und alte Versionen müssen vom System entfernt werden, da die alten Versionen ein Sicherheitsrisiko darstellen. Lade JavaRa von prm753 herunter und entpacke es auf den Desktop.
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
25.01.2012, 10:41
| #13 |
| | mbam Meldung Schritt 3 funktionierte komplett nicht. beim entfernen (Java(TM)6 Update 20 und Java Auto Updater, befanden sich noch in Systemsteuerung/Software) und bei der installation kam jeweils die gleiche fehlermeldung: Interner Fehler 2753.regutils.dll JavaRa.txt Code:
ATTFilter JavaRa 1.16 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Wed Jan 25 09:34:46 2012
Found and removed: Applications\java.exe
Found and removed: Applications\javaw.exe
Found and removed: JavaPlugin.FamilyVersionSupport
Found and removed: CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBB}
Found and removed: CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}
Found and removed: JavaScript
Found and removed: JavaScript Author
Found and removed: JavaScript1.1
Found and removed: JavaScript1.1 Author
Found and removed: JavaScript1.2
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}
Found and removed: Software\Classes\JavaPlugin.160_20
Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_20
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}
Found and removed: SOFTWARE\Classes\JavaPlugin
Found and removed: SOFTWARE\Classes\JavaPlugin.160_20
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_20
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_20
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_20
Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3412062F00
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0357E4991DA5FF14F9615B3612062F00
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
------------------------------------
Finished reporting.
Code:
ATTFilter C:\Dokumente und Einstellungen\Hexmet\Desktop\André\Programme\Unlocker1.9.1.exe Win32/Adware.ADON application
|
|
25.01.2012, 16:18
| #14 |
| /// Malwareteam | mbam Meldung http://www.trojaner-board.de/108244-...tml#post760202 ------------------------------- Versuchen wir was anderes... Java-Update Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Systemwiederherstellungspunkte löschen Starte OTL.exe. Füge nun folgendes aus der Codebox in die  Textbox.Code:
ATTFilter :Commands
[CLEARALLRESTOREPOINTS]
[reboot]
--------------------------------------------------------------------------------------- Ansonsten sind wir hier durch - lass uns noch ein wenig aufräumen: Defogger Starte bitte den Defogger und klicke den re-enable Button OTL Starte bitte OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Hier noch ein paar Tipps zur Absicherung deines Systems. Aktualität Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann.
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
26.01.2012, 07:54
| #15 |
| | mbam Meldung Bei der Java Installation kommt wieder die Fehlermeldung: "Interner Fehler 2753.regutils.dll" und wenn ich auf das Java Icon in Systemsteuerung drücken will, kommt die Fehlermeldung: "The system cannot find the registry key specified: HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JavaRuntimeEnvironment\1.6.0_20" Wenn die Installation abgebrochen wird und das Fenster schließen will, wird man von Java auf ein Java Hilfe-Center online weitergeleitet. dort steht ein anderer interner fehler 2755 und es wird beschrieben, dass vermutlich ein Antiviren-Programm die Installation blockt. Java Hilfe-Center ach ja und noch was anderes, du hast ja beschrieben das ich die system wiederherstellungspkt, löschen soll, soweit okay. ein kumpel von mir hat aber gemeint, dass nach ein viren befall, man während des starts irgendeine "F-Taste" drücken muss und dann einen solchen pkt. auswählen kann und das system genau an diesem pkt wieder neustartet, als wäre nix gewesen und der virus weg is! funktioniert das wirklich und wenn ja wie gehe ich da vor, da es ja vieles vereinfachen würde!!! |
|
| Themen zu mbam Meldung |
| antivir, avg, avira, bho, citadel, desktop, e-banking, einstellungen, frage, google, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, national, object, performance, plug-in, rundll, security, server, software, superantispyware, sweetim, system, trojaner, usb, usb 3.0, windows, windows xp, wlan |
Textbox.
Linear-Darstellung
