| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ihr Windowssystem wurde aus Sicherheitsgründen blockiertWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
14.02.2012, 18:48
| #1 |
| |  Ihr Windowssystem wurde aus Sicherheitsgründen blockiert Hab mir jetzt auch den netten Trojaner eingefangen und soll 50 euro zahlen und bräuchte etwas hilfe um ihn wieder zu entfernen. Ich Benutzt Windows 7 Pro. 32bit und die OTL file kommt gleich der scan läuft. OTL Logfile: Code:
ATTFilter OTL logfile created on: 14.02.2012 18:50:34 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Jan\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,48 Gb Available Physical Memory | 82,77% Memory free 6,00 Gb Paging File | 5,64 Gb Available in Paging File | 94,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 830,08 Gb Total Space | 335,40 Gb Free Space | 40,41% Space Free | Partition Type: NTFS Drive D: | 572,43 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: JAN-PC | User Name: Jan | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.02.09 01:08:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Jan\Downloads\OTL.exe PRC - [2011.08.17 08:28:14 | 003,120,448 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Pro\DTShellHlp.exe PRC - [2009.11.09 10:38:18 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Win32 Services (SafeList) ========== SRV - [2012.02.14 17:18:14 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2012.01.21 18:31:01 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2012.01.10 12:20:18 | 000,083,872 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2012.01.10 12:20:17 | 000,025,888 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2011.12.12 19:31:38 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.10.15 09:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus) DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt) DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc) DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap) DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID) DRV - [2003.04.29 12:10:40 | 000,004,448 | ---- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfhlp01.sys -- (sfhlp01) DRV - [2003.04.28 11:12:21 | 000,094,464 | ---- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\prohlp02.sys -- (prohlp02) DRV - [2003.04.28 10:16:07 | 000,050,816 | ---- | M] (StarForce Technologies, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\prodrv06.sys -- (prodrv06) DRV - [2003.04.04 08:41:46 | 000,006,848 | ---- | M] (StarForce Technologies, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\prosync1.sys -- (prosync1) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 67 2B 54 CF DD B7 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.10 23:55:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.11 09:01:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\Mozilla\Extensions [2012.02.14 16:12:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\cxt4o21r.default\extensions [2011.12.11 09:01:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\USERS\JAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXT4O21R.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI [2012.02.10 23:55:13 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.01.09 06:54:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.09 06:54:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.01.09 06:54:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.01.09 06:54:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.09 06:54:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.09 06:54:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd) O4 - HKCU..\Run: [ffdwnd] C:\Users\Jan\AppData\Local\Mozilla\Firefox\firefox.exe (Tomasz Pawlak) O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F7A8E14A-5BA6-4F2B-95D4-F4DA1CB4465A}: DhcpNameServer = 192.168.178.1 O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006.04.12 14:18:39 | 001,003,520 | R--- | M] (Microsoft Corporation) - D:\autorun.exe -- [ CDFS ] O32 - AutoRun File - [2006.04.12 14:21:25 | 000,000,240 | R--- | M] () - D:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{c0e42179-23c5-11e1-b2f5-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{c0e42179-23c5-11e1-b2f5-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2006.04.12 14:18:39 | 001,003,520 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{c0e42179-23c5-11e1-b2f5-806e6f6e6963}\Shell\directx\command - "" = D:\directx9\dxsetup.exe -- [2005.12.06 03:08:30 | 000,484,560 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{c0e42179-23c5-11e1-b2f5-806e6f6e6963}\Shell\setup\command - "" = D:\setup.exe -- [2006.04.25 18:41:01 | 000,253,952 | R--- | M] () O33 - MountPoints2\D\Shell - "" = AutoRun O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\autorun.exe -- [2006.04.12 14:18:39 | 001,003,520 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2012.02.14 17:55:17 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\ElevatedDiagnostics [2012.02.14 17:32:16 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2012.02.14 17:28:21 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\Simply Super Software [2012.02.14 17:14:48 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software [2012.02.14 17:14:48 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software [2012.02.14 16:14:41 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.02.14 16:14:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.02.14 16:14:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.02.12 02:30:20 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games [2012.02.12 02:30:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games [2012.02.11 00:01:21 | 000,000,000 | ---D | C] -- C:\Program Files\LG [2012.02.09 16:36:59 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2012.02.08 14:44:57 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\EA Games [2012.02.08 14:44:45 | 000,000,000 | RH-D | C] -- C:\Users\Jan\AppData\Roaming\SecuROM [2012.02.08 14:29:16 | 000,000,000 | ---D | C] -- C:\Program Files\EA Games [2012.02.08 14:28:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2012.02.07 20:25:22 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Malwarebytes [2012.02.07 20:25:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.02.07 00:12:18 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\DarknessIIDemo [2012.02.05 22:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace [2012.02.04 17:43:51 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Skyrim [2012.02.01 20:39:45 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\TechArts3D [2012.02.01 20:39:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechArts3D [2012.01.28 23:12:21 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\Meine Spiele [2012.01.28 22:46:52 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts [2012.01.28 22:46:51 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll [2012.01.28 22:46:51 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll [2012.01.28 22:46:51 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll [2012.01.28 16:10:24 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\Disney Interactive Studios [2012.01.28 16:03:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Disney Interactive Studios [2012.01.28 16:03:03 | 000,000,000 | ---D | C] -- C:\Program Files\Disney Interactive Studios [2012.01.27 16:11:45 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2012.01.27 16:11:45 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2012.01.27 16:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012 [2012.01.27 16:11:16 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\TuneUp Software [2012.01.27 16:11:05 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012 [2012.01.27 16:10:23 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2012.01.27 16:10:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2012.01.25 16:44:45 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\SKIDROW [2012.01.25 16:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Dungeon Siege III [2012.01.21 23:20:54 | 000,000,000 | ---D | C] -- C:\Program Files\directx [2012.01.21 20:50:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86) [2012.01.21 18:32:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro [2012.01.21 18:31:01 | 000,232,512 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [2012.01.21 18:30:57 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro [2012.01.18 18:46:48 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\REAL [2012.01.18 18:38:13 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\REAL [2012.01.18 18:38:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REAL [2012.01.18 18:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\Gokuaku [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.02.14 17:56:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.14 17:56:55 | 2415,370,240 | -HS- | M] () -- C:\hiberfil.sys [2012.02.14 17:52:51 | 000,001,867 | ---- | M] () -- C:\Users\Jan\Desktop\xp-AntiSpy.lnk [2012.02.14 17:15:09 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2012.02.14 16:14:42 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.02.14 14:35:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.14 14:35:25 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.14 14:35:17 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.02.14 14:35:17 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.02.14 14:35:17 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.02.14 14:35:17 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.02.14 14:33:19 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.02.12 17:45:45 | 000,311,856 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.02.12 02:30:18 | 000,002,103 | ---- | M] () -- C:\Users\Public\Desktop\Rise Of Legends.lnk [2012.02.11 22:14:54 | 000,001,258 | ---- | M] () -- C:\Users\Jan\Desktop\Skyrim.lnk [2012.02.08 16:29:49 | 000,000,216 | ---- | M] () -- C:\Users\Jan\Desktop\Jagged Alliance - Back in Action Demo.url [2012.02.08 14:43:12 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\Mirror's Edge™.lnk [2012.02.07 19:10:49 | 000,032,489 | ---- | M] () -- C:\Users\Jan\Desktop\16546546th.jpg [2012.02.06 17:43:44 | 000,000,216 | ---- | M] () -- C:\Users\Jan\Desktop\The Darkness II Demo.url [2012.02.04 00:52:22 | 000,034,185 | ---- | M] () -- C:\Users\Jan\Desktop\16th.jpg [2012.02.04 00:52:03 | 000,060,922 | ---- | M] () -- C:\Users\Jan\Desktop\7th.jpg [2012.02.02 13:07:00 | 000,006,986 | ---- | M] () -- C:\Users\Jan\Documents\Zager1.pdf [2012.02.02 12:48:56 | 000,132,560 | ---- | M] () -- C:\Users\Jan\Documents\Lebenslauf.pdf [2012.01.28 16:06:27 | 000,002,203 | ---- | M] () -- C:\Users\Public\Desktop\Split Second.lnk [2012.01.27 16:11:44 | 000,002,159 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.01.27 16:11:44 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk [2012.01.26 21:04:33 | 000,213,839 | ---- | M] () -- C:\Users\Jan\Desktop\53th.jpg [2012.01.25 23:35:04 | 000,000,095 | ---- | M] () -- C:\Windows\winamp.ini [2012.01.21 18:32:41 | 000,001,882 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Pro.lnk [2012.01.21 18:31:01 | 000,232,512 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.02.14 17:52:51 | 000,001,867 | ---- | C] () -- C:\Users\Jan\Desktop\xp-AntiSpy.lnk [2012.02.14 16:14:42 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.02.14 14:33:19 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf [2012.02.12 02:30:18 | 000,002,103 | ---- | C] () -- C:\Users\Public\Desktop\Rise Of Legends.lnk [2012.02.11 22:14:54 | 000,001,258 | ---- | C] () -- C:\Users\Jan\Desktop\Skyrim.lnk [2012.02.10 20:44:51 | 000,132,560 | ---- | C] () -- C:\Users\Jan\Documents\Lebenslauf.pdf [2012.02.10 20:44:51 | 000,006,986 | ---- | C] () -- C:\Users\Jan\Documents\Zager1.pdf [2012.02.08 16:29:49 | 000,000,216 | ---- | C] () -- C:\Users\Jan\Desktop\Jagged Alliance - Back in Action Demo.url [2012.02.08 14:43:12 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\Mirror's Edge™.lnk [2012.02.07 19:10:48 | 000,032,489 | ---- | C] () -- C:\Users\Jan\Desktop\16546546th.jpg [2012.02.06 17:43:43 | 000,000,216 | ---- | C] () -- C:\Users\Jan\Desktop\The Darkness II Demo.url [2012.02.04 00:52:22 | 000,034,185 | ---- | C] () -- C:\Users\Jan\Desktop\16th.jpg [2012.02.04 00:52:02 | 000,060,922 | ---- | C] () -- C:\Users\Jan\Desktop\7th.jpg [2012.01.28 16:06:27 | 000,002,203 | ---- | C] () -- C:\Users\Public\Desktop\Split Second.lnk [2012.01.27 16:11:44 | 000,002,159 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.01.27 16:11:44 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk [2012.01.27 16:11:41 | 000,002,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk [2012.01.26 21:04:32 | 000,213,839 | ---- | C] () -- C:\Users\Jan\Desktop\53th.jpg [2012.01.21 18:32:41 | 000,001,882 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Pro.lnk [2011.12.12 09:15:22 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2011.12.12 09:15:21 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011.12.11 08:52:22 | 000,000,095 | ---- | C] () -- C:\Windows\winamp.ini [2011.12.11 08:50:52 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll [2011.12.11 08:50:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2011.12.11 08:50:50 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2011.12.11 08:50:50 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2011.12.11 08:50:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2009.07.14 09:47:43 | 000,643,628 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 09:47:43 | 000,126,188 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 05:33:53 | 000,311,856 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,606,992 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,103,370 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.12.11 08:10:51 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.12.11 08:09:00 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.01.05 07:50:03 | 000,000,000 | ---D | M] -- C:\Games [2011.12.11 14:37:55 | 000,000,000 | ---D | M] -- C:\NVIDIA [2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.02.14 17:38:02 | 000,000,000 | R--D | M] -- C:\Program Files [2012.01.21 20:50:03 | 000,000,000 | ---D | M] -- C:\Program Files (x86) [2012.02.14 17:38:01 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.12.11 08:09:00 | 000,000,000 | -HSD | M] -- C:\Programme [2011.12.11 08:09:00 | 000,000,000 | -HSD | M] -- C:\Recovery [2012.02.12 02:13:52 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.12.11 08:10:35 | 000,000,000 | ---D | M] -- C:\Users [2012.02.14 17:37:52 | 000,000,000 | ---D | M] -- C:\Windows [2012.01.21 14:58:40 | 000,000,000 | ---D | M] -- C:\Zeug < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2009.11.09 10:38:18 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009.11.09 10:38:18 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\explorer.exe [2009.11.09 10:38:18 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe < MD5 for: IASTORV.SYS > [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\System32\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.02.14 18:49:53 | 001,572,864 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT [2012.02.14 18:49:53 | 000,262,144 | -HS- | M] () -- C:\Users\Jan\ntuser.dat.LOG1 [2011.12.11 08:10:36 | 000,000,000 | -HS- | M] () -- C:\Users\Jan\ntuser.dat.LOG2 [2012.01.27 21:23:31 | 000,000,000 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT_tureg_new.LOG1 [2012.01.27 21:23:31 | 000,000,000 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT_tureg_new.LOG2 [2012.01.27 21:23:34 | 001,572,864 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT_tureg_old [2011.12.11 08:10:36 | 000,065,536 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf [2011.12.11 08:10:36 | 000,524,288 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms [2011.12.11 08:10:36 | 000,524,288 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms [2012.01.28 00:30:26 | 000,065,536 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{af785641-4924-11e1-81b5-806e6f6e6963}.TM.blf [2012.01.28 00:30:26 | 000,524,288 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{af785641-4924-11e1-81b5-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2012.01.28 00:30:26 | 000,524,288 | -HS- | M] () -- C:\Users\Jan\NTUSER.DAT{af785641-4924-11e1-81b5-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2011.12.11 08:10:36 | 000,000,020 | -HS- | M] () -- C:\Users\Jan\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ========== Alternate Data Streams ========== @Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0AACC9 < End of report > Geändert von Miyagie (14.02.2012 um 19:02 Uhr) |
| Themen zu Ihr Windowssystem wurde aus Sicherheitsgründen blockiert |
| 50 euro, 50 euro zahlen, alternate, aus sicherheitsgründen, blockiert, bräuchte, eingefangen, entferne, entfernen, euro, gefangen, gen, langs, mbamservice.exe, nette, netten, nvstor.sys, required, sicherheitsgründe, sicherheitsgründen, super, troja, trojaner, windowssystem, zahlen |
Baum-Darstellung