BUNDESPOLIZEI - durch das System der automatischen Informationskontrolle gesperrt(Exploit.Drop.UR.2)

makaveli187 · 07.08.2012, 20:17

Hi!

Als erstes, möchte ich im Voraus allen mein Respekt bezeugen für die Arbeit und die Hilfe die Ihr hier leistet!

Zu meinem Problem, am 12.07. hat sich meine Schwester einen Trojaner eingefangen. Habe ihren Laptop erst jetzt bekommen und folgende Schritte ausgeführt:
- defogger
- OTL (OTL_1+Extras_1)
- gmer (gmer_1)
- Malwarebytes Anti-Malware (Scan_1)
- Reboot
- Malwarebytes Anti-Malware (Scan_2)
- OTL (OTL_2)
- gmer (gmer_2)

Die dazugehörigen Logs folgen.
Ich wollte fragen, ob mir bitte jemand sagen könnte, ob das PC jetzt wieder sauber ist.

OTL_1:

Code:

ATTFilter

OTL logfile created on: 8/5/2012 4:14:43 PM - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\RedRa!n\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.48 Gb Total Physical Memory | 2.90 Gb Available Physical Memory | 83.39% Memory free
6.96 Gb Paging File | 6.49 Gb Available in Paging File | 93.23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 82.07 Gb Total Space | 41.92 Gb Free Space | 51.08% Space Free | Partition Type: NTFS
Drive D: | 200.93 Gb Total Space | 132.24 Gb Free Space | 65.82% Space Free | Partition Type: NTFS
 
Computer Name: REDRAIN-PC | User Name: RedRa!n | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/08/05 15:55:58 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/06/13 00:31:20 | 001,840,640 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\761fd1afc17f11bf6d49c3a7d16465ca\System.Web.Services.ni.dll
MOD - [2012/06/13 00:30:04 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 00:29:44 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/09 16:39:16 | 001,051,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012/05/09 15:13:42 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll
MOD - [2012/05/09 15:13:23 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/09 15:13:19 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/09 15:13:18 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/09 15:13:10 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011/05/28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2010/11/13 01:19:04 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/11/05 03:59:41 | 000,212,992 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/07/11 22:35:51 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/16 18:21:25 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/22 13:51:04 | 000,720,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2012/03/08 18:32:24 | 001,492,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2012/01/27 01:00:34 | 000,827,456 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Users\RedRa!n\AppData\Local\Temp\032587~1.EXE -- (0325871344022281mcinstcleanup)
SRV - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/09/16 23:27:28 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/04/17 02:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Norton 360 Premier Edition\Engine\5.2.2.3\ccSvcHst.exe -- (N360)
SRV - [2011/03/28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010/11/20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010/01/09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010/01/09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\Rezip.exe -- (Rezip)
SRV - [2008/02/28 01:07:26 | 000,594,600 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxdncoms.exe -- (lxdn_device)
SRV - [2008/02/28 01:07:14 | 000,098,984 | ---- | M] () [Auto | Stopped] -- C:\windows\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe -- (lxdnCATSCustConnectService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012/06/21 08:54:58 | 001,589,752 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120711.018\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/06/21 08:54:58 | 000,087,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120711.018\NAVENG.SYS -- (NAVENG)
DRV - [2012/06/19 02:01:14 | 000,821,920 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20120711.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/06/14 20:39:26 | 000,382,624 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20120711.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/05/31 14:52:02 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/05/31 14:52:02 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/04/22 13:51:38 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2012/01/09 17:28:20 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2012/01/09 17:28:20 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2012/01/09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2012/01/09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/12/13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011/08/30 19:24:02 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/21 03:37:49 | 000,299,640 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\symnets.sys -- (SymNetS)
DRV - [2011/03/31 05:00:09 | 000,516,216 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\srtsp.sys -- (SRTSP)
DRV - [2011/03/31 05:00:09 | 000,050,168 | R--- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\srtspx.sys -- (SRTSPX)
DRV - [2011/03/15 04:31:23 | 000,744,568 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\0502020.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 08:47:10 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\0502020.003\symds.sys -- (SymDS)
DRV - [2011/01/27 07:07:05 | 000,136,312 | R--- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\ironx86.sys -- (SymIRON)
DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/11/06 06:07:10 | 009,923,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/10/26 22:39:04 | 000,125,696 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/06/27 16:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009/04/15 16:28:08 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/12/22 11:03:31] [Kernel | Auto | Stopped] -- C:\Programme\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_def
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=DE&ver=5
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.order.1,S: S", "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - prefs.js..keyword.URL,h: h", "hxxp://search.babylon.com/?babsrc=KW_def&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\IPSFFPlgn\ [2012/05/02 20:45:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\coFFPlgn_2011_7_9_4 [2012/07/12 19:06:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/10/22 18:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/16 18:21:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 18:41:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/05/22 19:21:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/16 18:21:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 18:41:14 | 000,000,000 | ---D | M]
 
[2011/08/30 19:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Extensions
[2012/05/02 11:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions
[2011/09/08 13:42:59 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/10/20 22:52:33 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions\welcome@toolmin.com
[2011/08/30 23:40:28 | 000,002,448 | ---- | M] () -- C:\Users\RedRa!n\AppData\Roaming\Mozilla\Firefox\Profiles\f5n1apte.default\searchplugins\safesearch.xml
[2012/05/04 17:41:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/01/30 20:33:01 | 000,021,707 | ---- | M] () (No name found) -- C:\USERS\REDRA!N\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F5N1APTE.DEFAULT\EXTENSIONS\ADAPTER@BABYLONTC.COM.XPI
[2012/01/30 20:33:01 | 000,007,972 | ---- | M] () (No name found) -- C:\USERS\REDRA!N\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F5N1APTE.DEFAULT\EXTENSIONS\OCR@BABYLON.COM.XPI
[2012/06/16 18:21:25 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/07 14:58:09 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/05/04 17:41:20 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/01/30 20:30:25 | 000,002,275 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/05/04 17:41:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/05/04 17:41:20 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/05/04 17:41:20 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/23 11:39:04 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011/10/20 23:09:34 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
[2012/05/04 17:41:20 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/05/04 17:41:20 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\RedRa!n\AppData\Roaming\toolplugin\toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" File not found
O4 - HKLM..\Run: [lxdnamon] C:\Program Files\Lexmark 2600 Series\lxdnamon.exe ()
O4 - HKLM..\Run: [lxdnmon.exe] C:\Program Files\Lexmark 2600 Series\lxdnmon.exe ()
O4 - HKLM..\Run: [NSU_agent] C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [afirjwgolftbsye] C:\ProgramData\afirjwgo.exe ()
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - HKCU..\Run: [ShowBatteryBar] C:\Program Files\BatteryBar\ShowBatteryBar.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C328763-5E05-4A07-9BAE-48FFFAC62621}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0741551-56A9-4D08-941F-4446F9511A52}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{82335fd3-84d9-11e1-a13e-00245486fe15}\Shell - "" = AutoRun
O33 - MountPoints2\{82335fd3-84d9-11e1-a13e-00245486fe15}\Shell\AutoRun\command - "" = F:\Install.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/05 16:08:58 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
[2012/07/12 18:56:43 | 000,000,000 | ---D | C] -- C:\ProgramData\vsczrnsslemazud
[2012/07/10 12:38:59 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\Desktop\Kurzprosa DaZ
[2012/07/08 20:52:30 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\Desktop\Beth
[2012/07/08 20:40:01 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Roaming\Nokia Suite
[2012/07/08 20:25:15 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Local\NokiaAccount
[2012/07/08 19:56:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2012/07/08 19:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Nokia
[2012/07/08 19:56:06 | 000,000,000 | ---D | C] -- C:\Program Files\PC Connectivity Solution
[2012/07/08 19:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\NokiaInstallerCache
[2012/07/08 19:39:38 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2012/07/08 19:36:57 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nokia
[2012/07/08 19:36:55 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Local\Nokia
[2 C:\Users\RedRa!n\*.tmp files -> C:\Users\RedRa!n\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Users\RedRa!n\Desktop\*.tmp files -> C:\Users\RedRa!n\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/05 16:10:10 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/08/05 16:10:10 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/08/05 16:10:10 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/08/05 16:10:10 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/08/05 16:09:51 | 000,000,000 | ---- | M] () -- C:\Users\RedRa!n\defogger_reenable
[2012/08/05 16:07:02 | 000,302,592 | ---- | M] () -- C:\Users\RedRa!n\Desktop\mtp7siun.exe
[2012/08/05 16:04:27 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/08/05 16:04:22 | 2804,113,408 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/05 15:55:58 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
[2012/08/05 15:55:54 | 000,050,477 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Defogger.exe
[2012/07/12 19:13:37 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 19:13:37 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 18:56:44 | 000,000,051 | ---- | M] () -- C:\ProgramData\ykyqksqbdrrfyvh
[2012/07/12 18:56:05 | 000,065,536 | ---- | M] () -- C:\ProgramData\afirjwgo.exe
[2012/07/12 18:56:05 | 000,065,536 | ---- | M] () -- C:\Users\RedRa!n\0.019436527458212782.exe
[2012/07/12 18:35:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/07/11 15:18:31 | 000,149,261 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Epik im Bücher-Wiki  Alles über diese literarische Gattung.pdf
[2012/07/11 15:16:28 | 000,293,003 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Fabel im Bücher-Wiki  Alles über die Fabel, eine wichtige Prosagattung.pdf
[2012/07/11 15:12:15 | 000,127,893 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Fabel  wissen.de.pdf
[2012/07/11 15:09:09 | 000,338,783 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Parabel  wissen.de.pdf
[2012/07/11 15:06:15 | 000,391,922 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Items Of The Week – Parabeln  SOUNDS LIKE ME.pdf
[2012/07/11 15:04:18 | 000,042,635 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Parabel (Literatur).pdf
[2012/07/11 14:45:44 | 000,088,911 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Parabel-Merkmale in Deutsch - eine Erklärung.pdf
[2012/07/11 14:05:05 | 000,387,416 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/07/08 19:56:54 | 000,002,047 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Suite.lnk
[2012/07/08 19:36:57 | 000,002,237 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Nokia Software Updater.lnk
[2012/07/07 15:03:53 | 000,427,450 | ---- | M] () -- C:\Users\RedRa!n\Desktop\07.07.2012 15;03;53  HAPERING.PDF
[2012/07/07 12:27:49 | 000,109,205 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Jutta groß.pdf
[2012/07/07 12:24:57 | 000,115,504 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Beth Zimmer klein.pdf
[2012/07/07 01:00:49 | 000,000,040 | ---- | M] () -- C:\ProgramData\bigksnljxoyjlir
[2 C:\Users\RedRa!n\*.tmp files -> C:\Users\RedRa!n\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Users\RedRa!n\Desktop\*.tmp files -> C:\Users\RedRa!n\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/05 16:09:51 | 000,000,000 | ---- | C] () -- C:\Users\RedRa!n\defogger_reenable
[2012/08/05 16:08:58 | 000,302,592 | ---- | C] () -- C:\Users\RedRa!n\Desktop\mtp7siun.exe
[2012/08/05 16:08:58 | 000,050,477 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Defogger.exe
[2012/07/12 18:56:44 | 000,065,536 | ---- | C] () -- C:\ProgramData\afirjwgo.exe
[2012/07/12 18:56:07 | 000,000,051 | ---- | C] () -- C:\ProgramData\ykyqksqbdrrfyvh
[2012/07/12 18:56:04 | 000,065,536 | ---- | C] () -- C:\Users\RedRa!n\0.019436527458212782.exe
[2012/07/11 15:18:30 | 000,149,261 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Epik im Bücher-Wiki  Alles über diese literarische Gattung.pdf
[2012/07/11 15:16:26 | 000,293,003 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Fabel im Bücher-Wiki  Alles über die Fabel, eine wichtige Prosagattung.pdf
[2012/07/11 15:12:13 | 000,127,893 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Fabel  wissen.de.pdf
[2012/07/11 15:09:06 | 000,338,783 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Parabel  wissen.de.pdf
[2012/07/11 15:06:14 | 000,391,922 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Items Of The Week – Parabeln  SOUNDS LIKE ME.pdf
[2012/07/11 15:04:17 | 000,042,635 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Parabel (Literatur).pdf
[2012/07/11 14:45:43 | 000,088,911 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Parabel-Merkmale in Deutsch - eine Erklärung.pdf
[2012/07/08 19:56:54 | 000,002,047 | ---- | C] () -- C:\Users\Public\Desktop\Nokia Suite.lnk
[2012/07/08 19:36:57 | 000,002,237 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Nokia Software Updater.lnk
[2012/07/07 15:04:12 | 000,427,450 | ---- | C] () -- C:\Users\RedRa!n\Desktop\07.07.2012 15;03;53  HAPERING.PDF
[2012/07/07 12:27:47 | 000,109,205 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Jutta groß.pdf
[2012/07/07 12:24:56 | 000,115,504 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Beth Zimmer klein.pdf
[2012/07/07 01:00:49 | 000,000,040 | ---- | C] () -- C:\ProgramData\bigksnljxoyjlir
[2011/10/01 15:06:43 | 000,348,160 | ---- | C] () -- C:\windows\System32\lxdncoin.dll
[2011/10/01 15:03:39 | 000,000,044 | ---- | C] () -- C:\windows\System32\lxdnrwrd.ini
[2011/10/01 15:03:30 | 000,438,272 | ---- | C] ( ) -- C:\windows\System32\LXDNhcp.dll
[2011/10/01 15:03:30 | 000,348,160 | ---- | C] () -- C:\windows\System32\LXDNinst.dll
[2011/10/01 15:03:29 | 000,843,776 | ---- | C] ( ) -- C:\windows\System32\lxdnusb1.dll
[2011/10/01 15:03:29 | 000,364,544 | ---- | C] ( ) -- C:\windows\System32\lxdninpa.dll
[2011/10/01 15:03:29 | 000,339,968 | ---- | C] ( ) -- C:\windows\System32\lxdniesc.dll
[2011/10/01 15:03:28 | 001,101,824 | ---- | C] ( ) -- C:\windows\System32\lxdnserv.dll
[2011/10/01 15:03:28 | 000,647,168 | ---- | C] ( ) -- C:\windows\System32\lxdnpmui.dll
[2011/10/01 15:03:28 | 000,053,248 | ---- | C] ( ) -- C:\windows\System32\lxdnprox.dll
[2011/10/01 15:03:27 | 000,569,344 | ---- | C] ( ) -- C:\windows\System32\lxdnlmpm.dll
[2011/10/01 15:03:26 | 000,663,552 | ---- | C] ( ) -- C:\windows\System32\lxdnhbn3.dll
[2011/10/01 15:03:26 | 000,320,168 | ---- | C] ( ) -- C:\windows\System32\lxdnih.exe
[2011/10/01 15:03:26 | 000,208,896 | ---- | C] () -- C:\windows\System32\lxdngrd.dll
[2011/10/01 15:03:25 | 000,851,968 | ---- | C] ( ) -- C:\windows\System32\lxdncomc.dll
[2011/10/01 15:03:25 | 000,594,600 | ---- | C] ( ) -- C:\windows\System32\lxdncoms.exe
[2011/10/01 15:03:25 | 000,376,832 | ---- | C] ( ) -- C:\windows\System32\lxdncomm.dll
[2011/10/01 15:03:24 | 000,365,224 | ---- | C] ( ) -- C:\windows\System32\lxdncfg.exe
[2011/09/12 21:12:35 | 000,019,456 | ---- | C] () -- C:\Users\RedRa!n\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/30 22:13:42 | 000,175,616 | ---- | C] () -- C:\windows\System32\unrar.dll
[2011/08/30 22:13:42 | 000,000,038 | ---- | C] () -- C:\windows\avisplitter.ini
[2011/08/30 22:13:40 | 000,650,752 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2011/08/30 22:13:40 | 000,243,200 | ---- | C] () -- C:\windows\System32\xvidvfw.dll
[2011/08/30 22:13:40 | 000,074,752 | ---- | C] () -- C:\windows\System32\ff_vfw.dll
[2011/08/30 22:06:03 | 000,116,224 | ---- | C] () -- C:\windows\System32\redmonnt.dll
[2011/08/30 22:06:03 | 000,045,056 | ---- | C] () -- C:\windows\System32\unredmon.exe
[2011/08/27 09:12:39 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2011/09/23 15:17:11 | 000,000,000 | -HSD | M] -- C:\Users\RedRa!n\AppData\Roaming\.#
[2011/09/01 22:25:47 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\BatteryBar
[2012/06/01 20:22:16 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Dropbox
[2012/01/02 10:27:45 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoft
[2011/09/08 13:46:50 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/08/30 22:06:02 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\FreePDF
[2011/09/02 11:53:40 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\GameConsole
[2011/09/23 15:19:16 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Go Go Gourmet
[2011/10/01 15:08:44 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Lexmark Productivity Studio
[2011/08/30 22:23:55 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\NetSpeedMonitor
[2012/07/08 20:40:00 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Nokia
[2012/07/08 20:40:01 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Nokia Suite
[2011/09/11 21:40:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\PC Suite
[2011/09/02 11:55:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\PlayFirst
[2012/01/16 00:13:32 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Thunderbird
[2012/05/02 10:48:57 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Tific
[2011/10/20 22:52:32 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\toolplugin
[2012/07/03 00:04:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Windows Live Writer
[2012/06/19 08:57:27 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:ABE89FFE

< End of report >

Extras+gmer_1.zip im Anhang

Malwarebytes Anti-Malware Scan_1:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.05.06

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
RedRa!n :: REDRAIN-PC [Administrator]

05.08.2012 17:55:22
mbam-log-2012-08-05 (20-38-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 309873
Laufzeit: 31 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
D:\Downloads\install_flash_player.exe (Trojan.Downloader) -> Keine Aktion durchgeführt.
C:\Users\RedRa!n\0.019436527458212782.exe (Exploit.Drop.UR.2) -> Keine Aktion durchgeführt.

(Ende)

[Clean + Reboot]

Malwarebytes Anti-Malware Scan_2:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.05.06

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus)
Internet Explorer 9.0.8112.16421
RedRa!n :: REDRAIN-PC [Administrator]

05.08.2012 20:54:55
mbam-log-2012-08-05 (20-54-55).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 309540
Laufzeit: 31 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

OTL_2:

Code:

ATTFilter

OTL logfile created on: 8/5/2012 10:13:57 PM - Run 2
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\RedRa!n\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.48 Gb Total Physical Memory | 3.05 Gb Available Physical Memory | 87.62% Memory free
6.96 Gb Paging File | 6.57 Gb Available in Paging File | 94.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 82.07 Gb Total Space | 41.98 Gb Free Space | 51.16% Space Free | Partition Type: NTFS
Drive D: | 200.93 Gb Total Space | 132.17 Gb Free Space | 65.78% Space Free | Partition Type: NTFS
 
Computer Name: REDRAIN-PC | User Name: RedRa!n | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/08/05 15:55:58 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/06/13 00:31:20 | 001,840,640 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\761fd1afc17f11bf6d49c3a7d16465ca\System.Web.Services.ni.dll
MOD - [2012/06/13 00:30:04 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 00:29:44 | 001,591,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/09 16:39:16 | 001,051,136 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012/05/09 15:13:42 | 000,025,600 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll
MOD - [2012/05/09 15:13:23 | 005,452,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/09 15:13:19 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/09 15:13:18 | 007,967,232 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/09 15:13:10 | 011,492,864 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2010/11/13 01:19:04 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/11/05 03:59:41 | 000,212,992 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/07/11 22:35:51 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/16 18:21:25 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/22 13:51:04 | 000,720,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2012/03/08 18:32:24 | 001,492,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/09/16 23:27:28 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/04/17 02:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Norton 360 Premier Edition\Engine\5.2.2.3\ccSvcHst.exe -- (N360)
SRV - [2011/03/28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010/11/20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010/01/09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010/01/09 21:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\Rezip.exe -- (Rezip)
SRV - [2008/02/28 01:07:26 | 000,594,600 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxdncoms.exe -- (lxdn_device)
SRV - [2008/02/28 01:07:14 | 000,098,984 | ---- | M] () [Auto | Stopped] -- C:\windows\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe -- (lxdnCATSCustConnectService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012/06/21 08:54:58 | 001,589,752 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120711.018\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/06/21 08:54:58 | 000,087,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20120711.018\NAVENG.SYS -- (NAVENG)
DRV - [2012/06/19 02:01:14 | 000,821,920 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20120711.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/06/14 20:39:26 | 000,382,624 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20120711.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/05/31 14:52:02 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/05/31 14:52:02 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/04/22 13:51:38 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2012/01/09 17:28:20 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2012/01/09 17:28:20 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2012/01/09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2012/01/09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/12/13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011/08/30 19:24:02 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/21 03:37:49 | 000,299,640 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\symnets.sys -- (SymNetS)
DRV - [2011/03/31 05:00:09 | 000,516,216 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\srtsp.sys -- (SRTSP)
DRV - [2011/03/31 05:00:09 | 000,050,168 | R--- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\srtspx.sys -- (SRTSPX)
DRV - [2011/03/15 04:31:23 | 000,744,568 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\0502020.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 08:47:10 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\0502020.003\symds.sys -- (SymDS)
DRV - [2011/01/27 07:07:05 | 000,136,312 | R--- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\N360\0502020.003\ironx86.sys -- (SymIRON)
DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/11/06 06:07:10 | 009,923,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/10/26 22:39:04 | 000,125,696 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/06/27 16:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009/04/15 16:28:08 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/12/22 11:03:31] [Kernel | Auto | Stopped] -- C:\Programme\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_def
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=DE&ver=5
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.order.1,S: S", "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - prefs.js..keyword.URL,h: h", "hxxp://search.babylon.com/?babsrc=KW_def&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\IPSFFPlgn\ [2012/05/02 20:45:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\coFFPlgn_2011_7_9_4 [2012/08/05 17:50:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/10/22 18:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/16 18:21:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 18:41:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/05/22 19:21:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/16 18:21:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 18:41:14 | 000,000,000 | ---D | M]
 
[2011/08/30 19:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Extensions
[2012/05/02 11:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions
[2011/09/08 13:42:59 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/10/20 22:52:33 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\RedRa!n\AppData\Roaming\mozilla\Firefox\Profiles\f5n1apte.default\extensions\welcome@toolmin.com
[2011/08/30 23:40:28 | 000,002,448 | ---- | M] () -- C:\Users\RedRa!n\AppData\Roaming\Mozilla\Firefox\Profiles\f5n1apte.default\searchplugins\safesearch.xml
[2012/05/04 17:41:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/01/30 20:33:01 | 000,021,707 | ---- | M] () (No name found) -- C:\USERS\REDRA!N\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F5N1APTE.DEFAULT\EXTENSIONS\ADAPTER@BABYLONTC.COM.XPI
[2012/01/30 20:33:01 | 000,007,972 | ---- | M] () (No name found) -- C:\USERS\REDRA!N\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\F5N1APTE.DEFAULT\EXTENSIONS\OCR@BABYLON.COM.XPI
[2012/06/16 18:21:25 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/07 14:58:09 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/05/04 17:41:20 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/01/30 20:30:25 | 000,002,275 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/05/04 17:41:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/05/04 17:41:20 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/05/04 17:41:20 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/23 11:39:04 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011/10/20 23:09:34 | 000,000,158 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search the web.src
[2012/05/04 17:41:20 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/05/04 17:41:20 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\RedRa!n\AppData\Roaming\toolplugin\toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360 Premier Edition\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" File not found
O4 - HKLM..\Run: [lxdnamon] C:\Program Files\Lexmark 2600 Series\lxdnamon.exe ()
O4 - HKLM..\Run: [lxdnmon.exe] C:\Program Files\Lexmark 2600 Series\lxdnmon.exe ()
O4 - HKLM..\Run: [NSU_agent] C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [afirjwgolftbsye] C:\ProgramData\afirjwgo.exe ()
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - HKCU..\Run: [ShowBatteryBar] C:\Program Files\BatteryBar\ShowBatteryBar.exe ()
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C328763-5E05-4A07-9BAE-48FFFAC62621}: DhcpNameServer = 192.168.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0741551-56A9-4D08-941F-4446F9511A52}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{82335fd3-84d9-11e1-a13e-00245486fe15}\Shell - "" = AutoRun
O33 - MountPoints2\{82335fd3-84d9-11e1-a13e-00245486fe15}\Shell\AutoRun\command - "" = F:\Install.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/05 17:53:11 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Roaming\Malwarebytes
[2012/08/05 17:48:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/05 17:48:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/05 17:48:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012/08/05 17:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/08/05 17:47:55 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
[2012/07/12 18:56:43 | 000,000,000 | ---D | C] -- C:\ProgramData\vsczrnsslemazud
[2012/07/08 20:40:01 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Roaming\Nokia Suite
[2012/07/08 20:25:15 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Local\NokiaAccount
[2012/07/08 19:56:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2012/07/08 19:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Nokia
[2012/07/08 19:56:06 | 000,000,000 | ---D | C] -- C:\Program Files\PC Connectivity Solution
[2012/07/08 19:54:59 | 000,000,000 | ---D | C] -- C:\ProgramData\NokiaInstallerCache
[2012/07/08 19:39:38 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2012/07/08 19:36:57 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nokia
[2012/07/08 19:36:55 | 000,000,000 | ---D | C] -- C:\Users\RedRa!n\AppData\Local\Nokia
[2 C:\Users\RedRa!n\*.tmp files -> C:\Users\RedRa!n\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Users\RedRa!n\Desktop\*.tmp files -> C:\Users\RedRa!n\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/05 22:12:49 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/08/05 22:12:38 | 2804,113,408 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/05 20:59:59 | 000,000,017 | ---- | M] () -- C:\Users\RedRa!n\AppData\Roaming\mbam.context.scan
[2012/08/05 20:52:16 | 000,653,928 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/08/05 20:52:16 | 000,615,810 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/08/05 20:52:16 | 000,129,800 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/08/05 20:52:16 | 000,106,190 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/08/05 17:48:42 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/05 16:09:51 | 000,000,000 | ---- | M] () -- C:\Users\RedRa!n\defogger_reenable
[2012/08/05 16:07:02 | 000,302,592 | ---- | M] () -- C:\Users\RedRa!n\Desktop\mtp7siun.exe
[2012/08/05 15:55:58 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\RedRa!n\Desktop\OTL.exe
[2012/08/05 15:55:54 | 000,050,477 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Defogger.exe
[2012/07/12 19:13:37 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 19:13:37 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 18:56:44 | 000,000,051 | ---- | M] () -- C:\ProgramData\ykyqksqbdrrfyvh
[2012/07/12 18:56:05 | 000,065,536 | ---- | M] () -- C:\ProgramData\afirjwgo.exe
[2012/07/12 18:35:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/07/11 14:05:05 | 000,387,416 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/07/08 19:56:54 | 000,002,047 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Suite.lnk
[2012/07/08 19:36:57 | 000,002,237 | ---- | M] () -- C:\Users\RedRa!n\Desktop\Nokia Software Updater.lnk
[2012/07/07 01:00:49 | 000,000,040 | ---- | M] () -- C:\ProgramData\bigksnljxoyjlir
[2 C:\Users\RedRa!n\*.tmp files -> C:\Users\RedRa!n\*.tmp -> ]
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Users\RedRa!n\Desktop\*.tmp files -> C:\Users\RedRa!n\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/05 20:59:59 | 000,000,017 | ---- | C] () -- C:\Users\RedRa!n\AppData\Roaming\mbam.context.scan
[2012/08/05 17:48:42 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/08/05 17:47:55 | 000,302,592 | ---- | C] () -- C:\Users\RedRa!n\Desktop\mtp7siun.exe
[2012/08/05 17:47:55 | 000,050,477 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Defogger.exe
[2012/08/05 16:09:51 | 000,000,000 | ---- | C] () -- C:\Users\RedRa!n\defogger_reenable
[2012/07/12 18:56:44 | 000,065,536 | ---- | C] () -- C:\ProgramData\afirjwgo.exe
[2012/07/12 18:56:07 | 000,000,051 | ---- | C] () -- C:\ProgramData\ykyqksqbdrrfyvh
[2012/07/08 19:56:54 | 000,002,047 | ---- | C] () -- C:\Users\Public\Desktop\Nokia Suite.lnk
[2012/07/08 19:36:57 | 000,002,237 | ---- | C] () -- C:\Users\RedRa!n\Desktop\Nokia Software Updater.lnk
[2012/07/07 01:00:49 | 000,000,040 | ---- | C] () -- C:\ProgramData\bigksnljxoyjlir
[2011/10/01 15:06:43 | 000,348,160 | ---- | C] () -- C:\windows\System32\lxdncoin.dll
[2011/10/01 15:03:39 | 000,000,044 | ---- | C] () -- C:\windows\System32\lxdnrwrd.ini
[2011/10/01 15:03:30 | 000,438,272 | ---- | C] ( ) -- C:\windows\System32\LXDNhcp.dll
[2011/10/01 15:03:30 | 000,348,160 | ---- | C] () -- C:\windows\System32\LXDNinst.dll
[2011/10/01 15:03:29 | 000,843,776 | ---- | C] ( ) -- C:\windows\System32\lxdnusb1.dll
[2011/10/01 15:03:29 | 000,364,544 | ---- | C] ( ) -- C:\windows\System32\lxdninpa.dll
[2011/10/01 15:03:29 | 000,339,968 | ---- | C] ( ) -- C:\windows\System32\lxdniesc.dll
[2011/10/01 15:03:28 | 001,101,824 | ---- | C] ( ) -- C:\windows\System32\lxdnserv.dll
[2011/10/01 15:03:28 | 000,647,168 | ---- | C] ( ) -- C:\windows\System32\lxdnpmui.dll
[2011/10/01 15:03:28 | 000,053,248 | ---- | C] ( ) -- C:\windows\System32\lxdnprox.dll
[2011/10/01 15:03:27 | 000,569,344 | ---- | C] ( ) -- C:\windows\System32\lxdnlmpm.dll
[2011/10/01 15:03:26 | 000,663,552 | ---- | C] ( ) -- C:\windows\System32\lxdnhbn3.dll
[2011/10/01 15:03:26 | 000,320,168 | ---- | C] ( ) -- C:\windows\System32\lxdnih.exe
[2011/10/01 15:03:26 | 000,208,896 | ---- | C] () -- C:\windows\System32\lxdngrd.dll
[2011/10/01 15:03:25 | 000,851,968 | ---- | C] ( ) -- C:\windows\System32\lxdncomc.dll
[2011/10/01 15:03:25 | 000,594,600 | ---- | C] ( ) -- C:\windows\System32\lxdncoms.exe
[2011/10/01 15:03:25 | 000,376,832 | ---- | C] ( ) -- C:\windows\System32\lxdncomm.dll
[2011/10/01 15:03:24 | 000,365,224 | ---- | C] ( ) -- C:\windows\System32\lxdncfg.exe
[2011/09/12 21:12:35 | 000,019,456 | ---- | C] () -- C:\Users\RedRa!n\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/30 22:13:42 | 000,175,616 | ---- | C] () -- C:\windows\System32\unrar.dll
[2011/08/30 22:13:42 | 000,000,038 | ---- | C] () -- C:\windows\avisplitter.ini
[2011/08/30 22:13:40 | 000,650,752 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2011/08/30 22:13:40 | 000,243,200 | ---- | C] () -- C:\windows\System32\xvidvfw.dll
[2011/08/30 22:13:40 | 000,074,752 | ---- | C] () -- C:\windows\System32\ff_vfw.dll
[2011/08/30 22:06:03 | 000,116,224 | ---- | C] () -- C:\windows\System32\redmonnt.dll
[2011/08/30 22:06:03 | 000,045,056 | ---- | C] () -- C:\windows\System32\unredmon.exe
[2011/08/27 09:12:39 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2011/09/23 15:17:11 | 000,000,000 | -HSD | M] -- C:\Users\RedRa!n\AppData\Roaming\.#
[2011/09/01 22:25:47 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\BatteryBar
[2012/06/01 20:22:16 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Dropbox
[2012/01/02 10:27:45 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoft
[2011/09/08 13:46:50 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/08/30 22:06:02 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\FreePDF
[2011/09/02 11:53:40 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\GameConsole
[2011/09/23 15:19:16 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Go Go Gourmet
[2011/10/01 15:08:44 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Lexmark Productivity Studio
[2011/08/30 22:23:55 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\NetSpeedMonitor
[2012/07/08 20:40:00 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Nokia
[2012/07/08 20:40:01 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Nokia Suite
[2011/09/11 21:40:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\PC Suite
[2011/09/02 11:55:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\PlayFirst
[2012/01/16 00:13:32 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Thunderbird
[2012/05/02 10:48:57 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Tific
[2011/10/20 22:52:32 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\toolplugin
[2012/07/03 00:04:36 | 000,000,000 | ---D | M] -- C:\Users\RedRa!n\AppData\Roaming\Windows Live Writer
[2012/06/19 08:57:27 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:ABE89FFE

< End of report >

gmer_2 im Anhang

BUNDESPOLIZEI - durch das System der automatischen Informationskontrolle gesperrt(Exploit.Drop.UR.2)

Log-Analyse und Auswertung: BUNDESPOLIZEI - durch das System der automatischen Informationskontrolle gesperrt(Exploit.Drop.UR.2)

BUNDESPOLIZEI - durch das System der automatischen Informationskontrolle gesperrt(Exploit.Drop.UR.2)

Ähnliche Themen: BUNDESPOLIZEI - durch das System der automatischen Informationskontrolle gesperrt(Exploit.Drop.UR.2)