| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: E-Mail mit PDF Anhang im Namen von O2 - telefonicaWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.06.2012, 10:01
| #1 |
| |  E-Mail mit PDF Anhang im Namen von O2 - telefonica Hallo! Vorgestern habe ich eine E-Mail mit einer PDF Rechnung für zusätzlich gebuchte Leistungen von O2 erhalten. Leider nicht aufgepasst und den Anhang geöffnet.... Danach fing die Platte an zu rödeln und das System war eingefroren. Nach Neustart lief das System wieder. Allerdings hatte ich gestern einen seltsamen Absturz. Erste Analyse mit einem Online Tool zeigte einen Exploit der angeblich erst diese Woche entdeckt wurde. Nur zwei Virenscanner erkannten das Problem. Emsisoft 5.1.0.11/20120605 found Exploit.JS.Pdfka!A2 Comodo 12517/20120605 found TestSignature.JS.Pdfka.FBQ Sophos 4.78.0/20120605 found Troj/PdfJs-XW Die E-Mail habe ich bereits eingesenden. Vielen Dank für jeden Hinweis. |
|
07.06.2012, 11:20
| #2 |
| /// Malware-holic   | E-Mail mit PDF Anhang im Namen von O2 - telefonica hi,
__________________wenn du wieder solche mails bekommst, bitte hinweis in meiner signatur beachten. das exploit ist relativ neu anscheinend. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
07.06.2012, 12:13
| #3 |
| | E-Mail mit PDF Anhang im Namen von O2 - telefonica Hier der SCan:OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 07.06.2012 12:47:16 - Run 2 OTL by OldTimer - Version 3.2.46.1 Folder = \\dmn01\export\home\mackenb\ol\Download Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 59,80% Memory free 7,22 Gb Paging File | 5,89 Gb Available in Paging File | 81,50% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 363,81 Gb Total Space | 53,96 Gb Free Space | 14,83% Space Free | Partition Type: NTFS Drive D: | 100,00 Gb Total Space | 79,04 Gb Free Space | 79,04% Space Free | Partition Type: NTFS Drive M: | 1,95 Gb Total Space | 1,73 Gb Free Space | 88,56% Space Free | Partition Type: NTFS Computer Name: GM | User Name: mackenb | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - \\dmn01\export\home\mackenb\ol\Download\OTL.exe (OldTimer Tools) PRC - C:\Programme\Microsoft Team Foundation Server 2010 Power Tools\TfsComProviderSvr.exe (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Common Files\Livescribe\PenComm\PenCommService.exe (Livescribe) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe () PRC - C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe () PRC - \\Gm\c$\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - \\Gm\c$\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Windows\System32\rdpclip.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\PDF Complete\pdfsvc.exe (PDF Complete Inc) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\dbe597aa9c12df5d08fb2f3f9872b834\System.Web.Services.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.TeamFound#\edf0fa04aff5b8cf94207bae7ac4f581\Microsoft.TeamFoundation.VersionControl.Client.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.TeamFound#\ffdeba2810391daa2ae4efc426db9e6c\Microsoft.TeamFoundation.VersionControl.Common.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.TeamFound#\0ca7424d393eb0e4caa2fd3831da210c\Microsoft.TeamFoundation.Common.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.TeamFound#\722b928e21fea29806297b80a8c29314\Microsoft.TeamFoundation.Client.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.TeamFound#\457059fe0d634a1a8d36a65e615bed7c\Microsoft.TeamFoundation.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\bfdd10e0a0aacf46bac557ffc5d55ba5\System.Data.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll () MOD - C:\Programme\Microsoft Team Foundation Server 2010 Power Tools\TfsShellExt.dll () MOD - C:\Programme\Microsoft Team Foundation Server 2010 Power Tools\TfsComProviderStub.DLL () MOD - C:\Programme\HTC\HTC Sync 3.0\Maps\R66Api.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe () MOD - C:\Programme\HTC\HTC Sync 3.0\sqlite3.7.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\sqlite3.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDetect.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDisk.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDetectLegend.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\fdHttpd.dll () MOD - \\Gm\c$\Program Files\OpenOffice.org 3\program\libxml2.dll () MOD - C:\Programme\WinRAR\RarExt.dll () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () ========== Win32 Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (PenCommService) -- C:\Programme\Common Files\Livescribe\PenComm\PenCommService.exe (Livescribe) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (PassThru Service) -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe () SRV - (NetTcpPortSharing) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetTcpActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetPipeActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (NetMsmqActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation) SRV - (SysMain) -- C:\Windows\System32\sysmain.dll (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (msvsmon90) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation) SRV - (pdfcDispatcher) -- C:\Program Files\PDF Complete\pdfsvc.exe (PDF Complete Inc) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (RemoteAccess) -- C:\Windows\System32\mprdim.dll (Microsoft Corporation) SRV - (SharedAccess) -- C:\Windows\System32\ipnathlp.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (zghsmdm) -- C:\Windows\System32\drivers\zghsmdm.sys (ZTE Incorporated) DRV - (PulseUsb) -- C:\Windows\System32\drivers\PulseUsb.sys (Windows (R) Win 7 DDK provider) DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation) DRV - (htcnprot) -- C:\Windows\System32\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (HTCAND32) -- C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC, Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (udfs) -- C:\Windows\System32\drivers\udfs.sys (Microsoft Corporation) DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Research Inc.) DRV - (e1yexpress) Intel(R) -- C:\Windows\System32\drivers\e1y6032.sys (Intel Corporation) DRV - (ws2ifsl) -- C:\Windows\System32\drivers\ws2ifsl.sys (Microsoft Corporation) DRV - (MegaSR) -- C:\Windows\System32\drivers\MegaSR.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\System32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\System32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (HpCISSs) -- C:\Windows\System32\drivers\HpCISSs.sys (Hewlett-Packard Company) DRV - (megasas) -- C:\Windows\System32\drivers\megasas.sys (LSI Corporation) DRV - (adpahci) -- C:\Windows\System32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (adpu160m) -- C:\Windows\System32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\System32\drivers\lsi_sas.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\System32\drivers\sisraid2.sys (Microsoft Corporation) DRV - (circlass) -- C:\Windows\System32\drivers\circlass.sys (Microsoft Corporation) DRV - (ql2300) -- C:\Windows\System32\drivers\ql2300.sys (QLogic Corporation) DRV - (arcsas) -- C:\Windows\System32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (Wd) -- C:\Windows\System32\drivers\wd.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\System32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (LSI_FC) -- C:\Windows\System32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\System32\drivers\arc.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\System32\drivers\iaStorV.sys (Intel Corporation) DRV - (ulsata2) -- C:\Windows\System32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\System32\drivers\lsi_scsi.sys (LSI Logic) DRV - (sffdisk) -- C:\Windows\System32\drivers\sffdisk.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\System32\drivers\elxstor.sys (Emulex) DRV - (IPMIDRV) -- C:\Windows\System32\drivers\IPMIDrv.sys (Microsoft Corporation) DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation) DRV - (adp94xx) -- C:\Windows\System32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\System32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (mpio) -- C:\Windows\System32\drivers\mpio.sys (Microsoft Corporation) DRV - (nvraid) -- C:\Windows\System32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (msdsm) -- C:\Windows\System32\drivers\msdsm.sys (Microsoft Corporation) DRV - (nvstor) -- C:\Windows\System32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (i8042prt) -- C:\Windows\System32\drivers\i8042prt.sys (Microsoft Corporation) DRV - (fdc) -- C:\Windows\System32\drivers\fdc.sys (Microsoft Corporation) DRV - (flpydisk) -- C:\Windows\System32\drivers\flpydisk.sys (Microsoft Corporation) DRV - (sermouse) -- C:\Windows\System32\drivers\sermouse.sys (Microsoft Corporation) DRV - (i2omp) -- C:\Windows\System32\drivers\i2omp.sys (Microsoft Corporation) DRV - (Parport) -- C:\Windows\System32\drivers\parport.sys (Microsoft Corporation) DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys (Microsoft Corporation) DRV - (isapnp) -- C:\Windows\System32\drivers\isapnp.sys (Microsoft Corporation) DRV - (AmdK8) -- C:\Windows\System32\drivers\amdk8.sys (Microsoft Corporation) DRV - (ViaC7) -- C:\Windows\System32\drivers\viac7.sys (Microsoft Corporation) DRV - (AmdK7) -- C:\Windows\System32\drivers\amdk7.sys (Microsoft Corporation) DRV - (Processor) -- C:\Windows\System32\drivers\processr.sys (Microsoft Corporation) DRV - (Crusoe) -- C:\Windows\System32\drivers\crusoe.sys (Microsoft Corporation) DRV - (msahci) -- C:\Windows\System32\drivers\msahci.sys (Microsoft Corporation) DRV - (atapi) -- C:\Windows\System32\drivers\atapi.sys (Microsoft Corporation) DRV - (Compbatt) -- C:\Windows\System32\drivers\compbatt.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\System32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\System32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (intelide) -- C:\Windows\System32\drivers\intelide.sys (Microsoft Corporation) DRV - (amdide) -- C:\Windows\System32\drivers\amdide.sys (Microsoft Corporation) DRV - (aliide) -- C:\Windows\System32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (pciide) -- C:\Windows\System32\drivers\pciide.sys (Microsoft Corporation) DRV - (WmiAcpi) -- C:\Windows\System32\drivers\wmiacpi.sys (Microsoft Corporation) DRV - (ErrDev) -- C:\Windows\System32\drivers\errdev.sys (Microsoft Corporation) DRV - (pcmcia) -- C:\Windows\System32\drivers\pcmcia.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\System32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\System32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\System32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\System32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (sbp2port) -- C:\Windows\System32\drivers\sbp2port.sys (Microsoft Corporation) DRV - (aic78xx) -- C:\Windows\System32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\System32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\System32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\System32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\System32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\System32\drivers\Mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\System32\drivers\sym_hi.sys (LSI Logic) DRV - (BTHMODEM) -- C:\Windows\System32\drivers\bthmodem.sys (Microsoft Corporation) DRV - (HidBth) -- C:\Windows\System32\drivers\hidbth.sys (Microsoft Corporation) DRV - (usbcir) eHome Infrared Receiver (USBCIR) -- C:\Windows\System32\drivers\usbcir.sys (Microsoft Corporation) DRV - (usbohci) -- C:\Windows\System32\drivers\usbohci.sys (Microsoft Corporation) DRV - (HidIr) -- C:\Windows\System32\drivers\hidir.sys (Microsoft Corporation) DRV - (WacomPen) -- C:\Windows\System32\drivers\wacompen.sys (Microsoft Corporation) DRV - (sfloppy) -- C:\Windows\System32\drivers\sfloppy.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\drivers\BrSerId.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\System32\drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\System32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=93&bd=all&pf=cmdt IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=93&bd=all&pf=cmdt IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iesetup.dll/SoftAdmin.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = file:///C:/misc/iehome.html IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUT_de IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\mackenb.dmn\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\mackenb.dmn\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.15 17:37:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.03 17:21:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.08.19 09:33:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.12.03 18:55:43 | 000,000,000 | ---D | M] (No name found) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Extensions [2010.12.03 18:55:43 | 000,000,000 | ---D | M] (No name found) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.06.04 10:07:24 | 000,000,000 | ---D | M] (No name found) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Firefox\Profiles\xhntk702.default\extensions [2010.12.03 18:56:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Firefox\Profiles\xhntk702.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.05.03 15:14:44 | 000,000,000 | ---D | M] (EPUBReader) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Firefox\Profiles\xhntk702.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2011.03.31 16:53:51 | 000,000,000 | ---D | M] ("S3 Firefox Organizer(S3Fox)") -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Firefox\Profiles\xhntk702.default\extensions\{7CEA821D-3DAB-4238-B424-BF7324531750} [2011.03.31 16:39:57 | 000,000,000 | ---D | M] (s3://) -- \\dmn01\export\home\mackenb\ol\AppData\mozilla\Firefox\Profiles\xhntk702.default\extensions\s3@overstimulate.com [2012.04.02 15:56:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions File not found (No name found) -- \\dmn01\EXPORT\HOME\MACKENB\OL\APPDATA\THUNDERBIRD\PROFILES\WQ6ZS6HF.DEFAULT\EXTENSIONS\DE-DE@DICTIONARIES.ADDONS.MOZILLA.ORG [2012.05.15 17:37:16 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.03.05 13:35:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.01.26 16:37:51 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.26 16:37:51 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.01.26 16:37:51 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.01.26 16:37:51 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.26 16:37:51 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.26 16:37:51 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [PDF Complete] C:\Programme\PDF Complete\pdfsty.exe (PDF Complete Inc) O4 - HKLM..\Run: [SetRefresh] C:\Programme\HP\SetRefresh\SetRefresh.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Adobe Reader Synchronizer] C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe (Adobe Systems Incorporated) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DefaultLogonDomain = dmn O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites) O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab (DLC Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dmn.de O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E08A580-234D-4571-A342-C2A2A6771365}: NameServer = 192.168.0.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: \\dmn01\export\home\mackenb\ol\AppData\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: \\dmn01\export\home\mackenb\ol\AppData\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{c55a9f5b-fbc8-11df-b88e-0024818376cf}\Shell - "" = AutoRun O33 - MountPoints2\{c55a9f5b-fbc8-11df-b88e-0024818376cf}\Shell\AutoRun\command - "" = N:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.06.05 12:05:18 | 000,000,000 | ---D | C] -- \\dmn01\export\home\mackenb\ol\AppData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows Performance Toolkit [2012.06.05 11:58:16 | 000,000,000 | ---D | C] -- \\dmn01\export\home\mackenb\ol\AppData\DAEMON Tools Lite [2012.05.15 17:37:19 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2012.05.15 17:37:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla ========== Files - Modified Within 30 Days ========== [2024.05.21 16:03:47 | 000,032,001 | ---- | M] () -- C:\rd295.csv [2012.06.07 12:45:06 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.06.07 12:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.07 12:35:28 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.07 12:35:28 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.07 11:48:59 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.06.06 23:12:59 | 000,002,036 | -H-- | M] () -- \\dmn01\export\home\mackenb\ol\Dokumente\Default.rdp [2012.06.06 14:50:27 | 000,000,560 | RHS- | M] () -- C:\Users\mackenb.dmn\ntuser.pol [2012.06.06 10:36:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.06 10:35:47 | 3757,232,128 | -HS- | M] () -- C:\hiberfil.sys [2012.05.25 10:16:22 | 000,001,868 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\TeamViewer 7.lnk [2012.05.25 10:02:38 | 000,671,212 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.05.25 10:02:38 | 000,631,942 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.05.25 10:02:38 | 000,144,380 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.05.25 10:02:38 | 000,118,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.05.24 09:25:05 | 000,001,969 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\Google Chrome.lnk [2012.05.22 17:39:09 | 001,514,716 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\2012-05-22 16.20.01.jpg [2012.05.22 17:38:37 | 000,001,447 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\scVB6.exe - Verknüpfung.lnk [2012.05.22 17:37:53 | 001,401,767 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\2012-05-20 15.56.14.jpg [2012.05.21 17:19:46 | 000,008,941 | ---- | M] () -- \\dmn01\export\home\mackenb\ol\Desktop\Setup.odt [2012.05.12 16:12:59 | 000,256,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.05.25 10:16:22 | 000,001,892 | ---- | C] () -- \\dmn01\export\home\mackenb\ol\AppData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7.lnk [2012.05.25 10:16:17 | 000,001,868 | ---- | C] () -- \\dmn01\export\home\mackenb\ol\Desktop\TeamViewer 7.lnk [2012.05.22 17:39:52 | 001,514,716 | ---- | C] () -- \\dmn01\export\home\mackenb\ol\Desktop\2012-05-22 16.20.01.jpg [2012.05.22 17:38:32 | 001,401,767 | ---- | C] () -- \\dmn01\export\home\mackenb\ol\Desktop\2012-05-20 15.56.14.jpg [2011.12.09 23:13:01 | 000,048,586 | ---- | C] () -- C:\ProgramData\xpif-v02030a.dtd [2011.11.10 13:54:18 | 000,000,600 | ---- | C] () -- \\dmn01\export\home\mackenb\ol\AppData\winscp.rnd [2011.02.15 13:54:20 | 000,000,680 | ---- | C] () -- C:\Users\mackenb\AppData\Local\d3d9caps.dat [2011.01.27 08:33:22 | 000,026,624 | ---- | C] () -- C:\Windows\System32\ssb7mlm.dll [2011.01.06 19:22:05 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI [2010.11.15 14:58:45 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2010.11.15 14:58:38 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.11.15 14:57:46 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.11.13 03:55:50 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.11.13 03:54:27 | 000,180,720 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2010.11.13 03:54:27 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2010.11.13 03:54:27 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe [2010.11.13 03:54:27 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe [2010.11.13 03:54:27 | 000,011,264 | ---- | C] () -- C:\Windows\System32\atimuixx.dll [2010.11.13 03:50:09 | 000,671,212 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2010.11.13 03:50:09 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2010.11.13 03:50:09 | 000,144,380 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2010.11.13 03:50:09 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2010.11.12 19:34:21 | 000,008,558 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2010.11.12 19:15:17 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin ========== LOP Check ========== [2012.06.05 10:01:57 | 000,032,550 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.06.09 20:32:41 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2011.02.03 16:13:06 | 000,000,000 | ---D | M] -- C:\Android [2010.11.12 20:46:46 | 000,000,000 | ---D | M] -- C:\app [2010.11.12 20:46:51 | 000,000,000 | ---D | M] -- C:\asterisk [2010.11.15 15:12:08 | 000,000,000 | -HSD | M] -- C:\boot [2012.03.05 23:31:00 | 000,000,000 | ---D | M] -- C:\Branch [2010.11.12 20:47:12 | 000,000,000 | ---D | M] -- C:\Brother [2010.11.12 20:55:07 | 000,000,000 | ---D | M] -- C:\COMPAQ [2011.04.28 12:29:21 | 000,000,000 | ---D | M] -- C:\crash [2011.08.11 03:03:27 | 000,000,000 | ---D | M] -- C:\d63899293852679a2f76b0fd91d73c [2012.02.14 16:39:33 | 000,000,000 | ---D | M] -- C:\dmb_crash [2012.03.29 18:49:55 | 000,000,000 | ---D | M] -- C:\dmn [2006.11.02 15:02:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.11.12 19:27:01 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.05.02 12:12:40 | 000,000,000 | ---D | M] -- C:\forschung [2012.04.25 12:32:59 | 000,000,000 | R--D | M] -- C:\usx [2012.03.30 23:26:22 | 000,000,000 | ---D | M] -- C:\gdn Sandcastle [2010.11.21 13:39:27 | 000,000,000 | ---D | M] -- C:\gdn Sandcastle1 [2012.03.05 23:45:17 | 000,000,000 | ---D | M] -- C:\gss [2012.01.31 13:29:24 | 000,000,000 | ---D | M] -- C:\home [2011.11.05 18:35:43 | 000,000,000 | -H-D | M] -- C:\hp [2010.11.12 21:38:20 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver PostScript v5.1.0.1 [2011.06.27 16:57:35 | 000,000,000 | ---D | M] -- C:\Macromedia [2012.03.12 20:13:33 | 000,000,000 | ---D | M] -- C:\misc [2010.11.13 13:44:27 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.05.19 18:35:16 | 000,000,000 | ---D | M] -- C:\mysql-5.5.12-win32 [2012.02.08 20:02:19 | 000,000,000 | ---D | M] -- C:\osm [2012.04.03 19:43:47 | 000,000,000 | ---D | M] -- C:\pcc [2008.01.21 04:33:10 | 000,000,000 | ---D | M] -- C:\PerfLogs [2010.11.12 21:40:13 | 000,000,000 | ---D | M] -- C:\Perl [2012.05.15 17:37:19 | 000,000,000 | R--D | M] -- C:\Program Files [2012.05.15 17:37:19 | 000,000,000 | -H-D | M] -- C:\ProgramData [2010.11.12 19:27:01 | 000,000,000 | -HSD | M] -- C:\Programme [2012.04.03 20:09:41 | 000,000,000 | ---D | M] -- C:\src [2010.11.12 19:30:54 | 000,000,000 | ---D | M] -- C:\swsetup [2012.06.07 12:49:12 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.11.12 19:30:50 | 000,000,000 | -H-D | M] -- C:\system.sav [2012.06.06 10:32:14 | 000,000,000 | ---D | M] -- C:\tmp [2011.06.09 20:31:57 | 000,000,000 | R--D | M] -- C:\Users [2012.06.06 10:36:07 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 04:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 00:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys [2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2010.01.27 00:59:08 | 000,028,797 | R--- | M] () MD5=486232DD9FDCAA3FF410E10BB0D0C5D4 -- C:\Perl\lib\auto\Win32\EventLog\EventLog.dll [2004.11.15 12:37:52 | 000,028,672 | ---- | M] () MD5=9937F303C344C00849E8E5CA26CED439 -- C:\app\mackenb\product\11.1.0\db_2\perl\site\5.8.3\lib\MSWin32-x86-multi-thread\auto\Win32\EventLog\EventLog.dll < MD5 for: EXPLORER.EXE > [2010.11.13 04:06:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2010.11.13 04:06:36 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2010.11.13 04:06:36 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2010.11.13 04:06:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 04:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTOR.SYS > [2008.08.13 18:08:44 | 000,325,144 | ---- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 -- C:\COMPAQ\MSD\IaStor.sys [2008.08.13 18:08:44 | 000,325,144 | ---- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 -- C:\swsetup\Drivers\MSD\RAID\Intel\IaStor.sys [2008.08.13 18:08:44 | 000,325,144 | ---- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 -- C:\Windows\System32\drivers\iaStor.sys [2008.08.13 18:08:44 | 000,325,144 | ---- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_d5cc8525\iaStor.sys [2008.08.13 18:08:44 | 000,325,144 | ---- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ea0e1546\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 00:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 04:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 00:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2012.02.14 20:55:22 | 000,069,632 | ---- | M] (Microsoft Corporation) MD5=B24A0AAA435674392405C770F2F45268 -- C:\dmb_crash\s3\d\SYS\TRANSFER\SYSTEM\USER32.DLL [2008.01.21 04:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 00:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 00:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.02.18 19:05:12 | 000,019,640 | ---- | M] () -- C:\Users\mackenb.dmn\5A3EEAE0C6759A95ED48757857D5C.xml [2011.10.10 17:46:18 | 000,008,661 | ---- | M] () -- C:\Users\mackenb.dmn\gsview32.ini [2012.06.07 12:50:47 | 008,126,464 | -HS- | M] () -- C:\Users\mackenb.dmn\NTUSER.DAT [2012.06.07 12:50:47 | 000,262,144 | -H-- | M] () -- C:\Users\mackenb.dmn\ntuser.dat.LOG1 [2010.11.15 13:29:26 | 000,000,000 | -H-- | M] () -- C:\Users\mackenb.dmn\ntuser.dat.LOG2 [2012.06.06 23:13:11 | 000,065,536 | -HS- | M] () -- C:\Users\mackenb.dmn\NTUSER.DAT{0f69446d-6a70-11db-8eb3-985e31beb686}.TM.blf [2012.01.10 18:08:16 | 000,524,288 | -HS- | M] () -- C:\Users\mackenb.dmn\NTUSER.DAT{0f69446d-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000001.regtrans-ms [2012.06.06 23:13:11 | 000,524,288 | -HS- | M] () -- C:\Users\mackenb.dmn\NTUSER.DAT{0f69446d-6a70-11db-8eb3-985e31beb686}.TMContainer00000000000000000002.regtrans-ms [2012.06.06 23:13:31 | 000,000,250 | -HS- | M] () -- C:\Users\mackenb.dmn\ntuser.ini [2012.06.06 14:50:27 | 000,000,560 | RHS- | M] () -- C:\Users\mackenb.dmn\ntuser.pol < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < End of report > |
|
| Themen zu E-Mail mit PDF Anhang im Namen von O2 - telefonica |
| analyse, angeblich, anhang, aufgepasst, e-mail, entdeck, entdeckt, erhalte, exploit, gen, hinweis, namen, neustart, online, pdf, pdf anhang, pdf-anhang telefonica, pdfka, platte, rechnung, scan, scanner, seltsame, system, tool, virenscan, virenscanner, woche |
Linear-Darstellung
