| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Exp/cve-2012-1723.brWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
17.08.2012, 22:50
| #1 |
 |  Exp/cve-2012-1723.br Hallo, Der Echtzeit-Scanner von AntiVir hat dieser Tage bei mir den Virus "EXP/CVE-2012-1723.BR" entdeckt. Ich habe ihn sofort in Quarantäne geschickt. Kann ich ihn aus dem Quarantäne-Verzeichnis einfach löschen oder ist er irgendwie noch aktiv? Ich habe wenig Ahnung, was ich da tun kann, weil mir in 15 Jahren Internet noch nix passiert ist mit Viren und ähnlichem Schadzeug. Grüße Ivanhoe Ich habe jetzt auch noch mal Malwarebytes drüberlaufen lassen. Hier das Log: Malwarebytes Anti-Malware 1.62.0.1300 Malwarebytes : Free Anti-Malware download Datenbank Version: v2012.08.17.08 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19298 Fisch :: SCHLEPPI [Administrator] 17.08.2012 23:41:38 mbam-log-2012-08-17 (23-41-38).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 536436 Laufzeit: 3 Stunde(n), 36 Minute(n), 26 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
19.08.2012, 18:34
| #2 |
| /// Helfer-Team  | Exp/cve-2012-1723.br CustomScan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*
%APPDATA%\*AcroIEH*.*
%APPDATA%\*.exe
%APPDATA%\*.tmp
CREATERESTOREPOINT
__________________ |
|
20.08.2012, 08:00
| #3 |
| | Exp/cve-2012-1723.br Hier also der Inhalt des OTL.txt:OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 20.08.2012 08:13:51 - Run 1 OTL by OldTimer - Version 3.2.58.0 Folder = C:\Download Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19298) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 61,58% Memory free 6,19 Gb Paging File | 5,08 Gb Available in Paging File | 81,98% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 59,74 Gb Total Space | 3,18 Gb Free Space | 5,32% Space Free | Partition Type: NTFS Drive D: | 40,22 Gb Total Space | 1,68 Gb Free Space | 4,17% Space Free | Partition Type: NTFS Drive E: | 40,00 Gb Total Space | 11,60 Gb Free Space | 29,00% Space Free | Partition Type: NTFS Drive F: | 60,46 Gb Total Space | 4,31 Gb Free Space | 7,13% Space Free | Partition Type: NTFS Drive G: | 19,85 Gb Total Space | 7,85 Gb Free Space | 39,57% Space Free | Partition Type: NTFS Drive H: | 11,15 Gb Total Space | 5,95 Gb Free Space | 53,31% Space Free | Partition Type: NTFS Drive I: | 327,26 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive J: | 29,82 Gb Total Space | 27,26 Gb Free Space | 91,40% Space Free | Partition Type: FAT32 Computer Name: SCHLEPPI | User Name: Fisch | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.19 22:49:55 | 000,598,016 | ---- | M] (OldTimer Tools) -- C:\Download\OTL.exe PRC - [2012.08.10 09:01:02 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.21 09:51:00 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\internet\Mozilla Firefox\firefox.exe PRC - [2012.05.10 18:13:57 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.10 18:13:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.10 18:13:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.01.09 01:02:10 | 003,419,648 | ---- | M] (Ingo Eckel) -- C:\tools\Idoswin Pro\IdoswinPro.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2010.11.05 10:28:14 | 000,083,248 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\Programme\Sybase\SQL Anywhere 9\win32\dbsrv9.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.06.10 04:27:04 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre1.6.0_07\bin\jusched.exe PRC - [2008.01.25 15:43:22 | 000,716,800 | ---- | M] (TOSHIBA Corporation.) -- C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe PRC - [2008.01.22 14:25:26 | 000,712,704 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\FlashCards\TCrdMain.exe PRC - [2008.01.22 11:00:30 | 004,624,384 | ---- | M] () -- C:\Programme\Camera Assistant Software for Toshiba\CEC_MAIN.exe PRC - [2008.01.21 16:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2008.01.21 04:23:32 | 000,319,544 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe PRC - [2008.01.17 16:27:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\Power Saver\TPwrMain.exe PRC - [2008.01.17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\Power Saver\TosCoSrv.exe PRC - [2008.01.09 15:02:08 | 001,056,768 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\ConfigFree\NDSTray.exe PRC - [2007.12.29 10:06:02 | 000,430,080 | ---- | M] () -- C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe PRC - [2007.12.25 14:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe PRC - [2007.12.03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe PRC - [2007.11.21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe PRC - [2007.11.05 17:21:48 | 000,431,104 | ---- | M] (Hauppauge Computer Works) -- C:\Programme\WinTV\EPG Services\System\EPGService.exe PRC - [2007.10.25 17:41:18 | 000,413,696 | ---- | M] (Chicony) -- C:\Programme\Camera Assistant Software for Toshiba\traybar.exe PRC - [2007.03.06 10:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) -- C:\Programme\Common Files\InterVideo\DeviceService\DevSvc.exe PRC - [2007.02.12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe ========== Modules (No Company Name) ========== MOD - [2012.07.21 09:50:58 | 002,003,424 | ---- | M] () -- C:\internet\Mozilla Firefox\mozjs.dll MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- F:\Download\RarExt.dll MOD - [2008.01.22 11:00:30 | 004,624,384 | ---- | M] () -- C:\Programme\Camera Assistant Software for Toshiba\CEC_MAIN.exe MOD - [2007.12.29 10:06:02 | 000,430,080 | ---- | M] () -- C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe MOD - [2007.12.25 12:03:40 | 000,015,184 | ---- | M] () -- C:\Programme\Toshiba\PCDiag\NotifyPCD.dll MOD - [2007.12.14 21:40:00 | 000,090,112 | ---- | M] () -- C:\Programme\Toshiba\FlashCards\TWarnMsg\TWarnMsg.dll MOD - [2007.12.14 21:28:38 | 004,726,784 | ---- | M] () -- C:\Programme\Toshiba\FlashCards\BlackPng.dll MOD - [2006.12.01 18:55:42 | 000,009,216 | ---- | M] () -- C:\Programme\Toshiba\TBS\NotifyTBS.dll MOD - [2006.10.10 12:44:16 | 000,009,728 | ---- | M] () -- C:\Programme\Toshiba\TOSHIBA Assist\NotifyX.dll MOD - [2006.10.07 12:57:04 | 000,053,248 | ---- | M] () -- C:\Programme\Toshiba\TOSHIBA Disc Creator\NotifyTDC.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - File not found [Auto | Stopped] -- K:\Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.10 18:13:57 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.10 18:13:55 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.05.28 09:15:47 | 000,073,600 | ---- | M] () [Auto | Running] -- C:\Windows\System32\ezGOSvc.dll -- (ezGOSvc) SRV - [2011.03.21 13:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2010.11.05 10:28:14 | 000,083,248 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\Programme\Sybase\SQL Anywhere 9\win32\dbsrv9.exe -- (Lexware_Datenbank_Plus) SRV - [2008.01.21 16:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.17 16:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2007.12.25 14:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe -- (ConfigFree Service) SRV - [2007.12.03 17:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service) SRV - [2007.11.21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) SRV - [2007.11.05 17:21:48 | 000,431,104 | ---- | M] (Hauppauge Computer Works) [Auto | Running] -- C:\Programme\WinTV\EPG Services\System\EPGService.exe -- (EPGService) SRV - [2007.03.06 10:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Programme\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service) SRV - [2007.02.12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (Tosrfcom) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\igdkmd32.sys -- (igfx) DRV - [2012.05.10 18:13:57 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.10 18:13:57 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.07.25 17:30:56 | 000,033,536 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL2832UUSB.sys -- (RTL2832UUSB) DRV - [2011.07.25 17:30:54 | 000,189,184 | ---- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL2832UBDA.sys -- (RTL2832UBDA) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.07.06 15:33:40 | 000,015,616 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw95rc.sys -- (hcw95rc) DRV - [2009.07.06 15:30:58 | 000,573,440 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hcw95bda.sys -- (hcw95bda) DRV - [2009.03.18 18:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV - [2008.11.17 15:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER) DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008.02.01 12:46:08 | 000,187,904 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDART.sys -- (CnxtHdAudAddService) DRV - [2008.02.01 08:56:47 | 000,160,816 | ---- | M] (Auerswald GmbH & Co.KG ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\auusb.sys -- (auusb) DRV - [2008.01.30 17:24:00 | 003,483,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008.01.21 15:42:24 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32) DRV - [2008.01.15 11:34:58 | 000,048,472 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR) DRV - [2007.12.17 11:45:20 | 000,018,432 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR) DRV - [2007.11.09 14:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ) DRV - [2007.10.17 23:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2007.09.26 06:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) DRV - [2007.04.09 17:13:00 | 000,008,192 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\QIOMem.sys -- (QIOMem) DRV - [2006.11.02 09:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2006.10.23 17:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec) DRV - [2006.10.18 12:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst) DRV - [2005.02.23 15:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.de IE - HKLM\..\SearchScopes,DefaultScope = {75CF8883-C925-4A4B-9ED9-5C9CD5B65C43} IE - HKLM\..\SearchScopes\{75CF8883-C925-4A4B-9ED9-5C9CD5B65C43}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rls=com.microsoft:*:IE-SearchBox&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7; IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.de IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\..\SearchScopes\{75CF8883-C925-4A4B-9ED9-5C9CD5B65C43}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSEA IE - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.taz.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.2.0.7165 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Adobe\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\internet\Mozilla Firefox\components [2012.07.21 09:51:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\internet\Mozilla Firefox\plugins [2012.08.14 12:30:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Components: C:\internet\Mozilla Thunderbird\components [2012.08.14 12:30:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.5\extensions\\Plugins: C:\internet\Mozilla Thunderbird\plugins [2012.08.14 12:30:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.06.21 20:39:14 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\internet\Mozilla Firefox\components [2012.07.21 09:51:00 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\internet\Mozilla Firefox\plugins [2012.08.14 12:30:07 | 000,000,000 | ---D | M] [2011.01.19 18:47:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fisch\AppData\Roaming\mozilla\Extensions [2011.01.19 18:47:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fisch\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.06.05 14:57:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fisch\AppData\Roaming\mozilla\Firefox\Profiles\9me8x6mx.default\extensions [2010.05.03 09:03:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Fisch\AppData\Roaming\mozilla\Firefox\Profiles\9me8x6mx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.11.07 14:17:56 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Fisch\AppData\Roaming\mozilla\Firefox\Profiles\9me8x6mx.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\..\Toolbar\WebBrowser: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [00TCrdMain] C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony) O4 - HKLM..\Run: [HDMICtrlMan] C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.) O4 - HKLM..\Run: [HSON] C:\Programme\Toshiba\TBS\HSON.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found O4 - HKLM..\Run: [SmoothView] C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TPwrMain] C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000..\Run: [] File not found O4 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe () O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\Simon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk = File not found O4 - Startup: C:\Users\Simon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = File not found O7 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-350069359-3773661745-2086913480-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fisch\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 10.5.1) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CD90F79C-C00C-45DD-8339-EA07C2B2ECD0}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - File not found O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [1999.09.25 18:28:22 | 000,000,971 | R--- | M] () - I:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\AutoRun\command - "" = I:\aoesetup.exe -- [1999.09.15 02:47:34 | 000,585,790 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\directx\command - "" = I:\DIRECTX\DXSETUP.EXE -- [1999.01.09 05:10:00 | 000,096,768 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\dplay\command - "" = I:\DIRECTX\DPLAY61A.EXE -- [1999.06.19 02:35:30 | 000,485,600 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\dxdiag\command - "" = I:\GOODIES\AR40DEU.EXE -- [1999.06.29 18:17:26 | 005,994,880 | R--- | M] (InstallShield Software Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\dxinfo\command - "" = I:\GOODIES\DIRECTX\DXINFO.EXE -- [1997.07.15 11:00:00 | 000,299,520 | R--- | M] (Microsoft Corp.) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\dxtest\command - "" = I:\DIRECTX\DXDIAG.EXE -- [1999.01.09 05:10:00 | 001,253,648 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\dxtool\command - "" = I:\GOODIES\DIRECTX\DXTOOL.EXE -- [1997.07.15 11:00:00 | 000,033,280 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\log\command - "" = I:\goodies\machine\machine.exe -- [1999.08.18 00:05:36 | 000,208,896 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\machine\command - "" = I:\GOODIES\MACHINE\MACHINE.EXE -- [1999.08.18 00:05:36 | 000,208,896 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\setup\command - "" = I:\aoesetup.exe -- [1999.09.15 02:47:34 | 000,585,790 | R--- | M] (Microsoft Corporation) O33 - MountPoints2\{12e201a4-848c-11dd-89fe-806e6f6e6963}\Shell\zone\command - "" = I:\GOODIES\MSZONE\ZONEA600.EXE -- [1999.09.02 02:16:04 | 006,753,985 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found NetSvcs: ezGOSvc - C:\Windows\System32\ezGOSvc.dll () MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: UVS11 Preload - hkey= - key= - C:\Programme\Ulead Systems\Ulead VideoStudio 11\uvPL.exe (InterVideo Digital Technology Corporation) SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: Hamachi2Svc - K:\Hamachi\hamachi-2.exe File not found SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.mpegacm - C:\Programme\Common Files\Ulead Systems\Mpeg\MPEGACM.acm (Ulead Systems, Inc.) Drivers32: msacm.ulmp3acm - C:\Programme\Common Files\Ulead Systems\Mpeg\ulmp3acm.acm (Ulead systems) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.I420 - emYUV.dll File not found Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation) Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation) Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.ax (Intel Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.08.16 16:25:30 | 000,000,000 | ---D | C] -- C:\Users\Fisch\AppData\Roaming\VSRevoGroup [2012.08.14 12:26:52 | 000,000,000 | ---D | C] -- C:\Users\Fisch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\tools [2012.08.10 09:20:42 | 000,000,000 | ---D | C] -- C:\Users\Fisch\AppData\Roaming\Malwarebytes [2012.08.10 09:20:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.10 09:20:27 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.10 09:20:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.08 13:36:00 | 000,000,000 | ---D | C] -- C:\Macromedia [2012.07.31 13:26:42 | 000,000,000 | ---D | C] -- C:\Users\Fisch\AppData\Roaming\pdfforge [2012.07.31 13:26:07 | 000,081,920 | ---- | C] (pdfforge GbR) -- C:\Windows\System32\pdfcmon.dll [2012.07.31 13:25:57 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator [2012.07.21 17:28:02 | 000,000,000 | ---D | C] -- C:\Users\Fisch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ [2012.07.21 17:27:46 | 000,000,000 | ---D | C] -- C:\Users\Fisch\Documents\VirtualDJ [2008.11.02 16:03:24 | 000,152,848 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Common Files\Comdlg32.ocx [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.20 07:36:38 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.20 07:36:38 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.20 07:36:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.17 23:34:12 | 000,000,132 | ---- | M] () -- C:\Users\Fisch\AppData\Roaming\wklnhst.dat [2012.08.16 14:04:53 | 003,852,574 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.16 14:04:53 | 001,186,086 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.16 14:04:53 | 001,072,930 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.16 14:04:53 | 001,011,734 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.16 13:58:17 | 000,344,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.13 11:12:02 | 005,566,640 | ---- | M] () -- C:\Users\Fisch\Desktop\AVSUPINF.zip [2012.08.10 09:20:29 | 000,000,946 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.13 11:12:02 | 005,566,640 | ---- | C] () -- C:\Users\Fisch\Desktop\AVSUPINF.zip [2012.08.10 09:20:29 | 000,000,946 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.09 11:26:38 | 000,000,399 | ---- | C] () -- C:\Windows\vtplus32.ini [2012.06.09 11:26:32 | 000,000,030 | ---- | C] () -- C:\Windows\System32\UNWISE.INI [2012.06.05 12:02:13 | 000,000,132 | ---- | C] () -- C:\Users\Fisch\AppData\Roaming\wklnhst.dat [2012.02.18 12:19:45 | 000,073,600 | ---- | C] () -- C:\Windows\System32\ezGOSvc.dll [2011.10.25 23:49:23 | 000,007,411 | ---- | C] () -- C:\Windows\HCWPNP.INI [2011.06.11 14:42:10 | 000,000,552 | ---- | C] () -- C:\Users\Fisch\AppData\Local\d3d8caps.dat [2011.06.10 20:41:03 | 000,000,680 | RHS- | C] () -- C:\Users\Fisch\ntuser.pol [2011.03.31 21:11:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.12.31 17:19:13 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe [2010.10.21 14:19:42 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll [2010.10.21 14:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll [2010.10.21 14:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll [2010.10.21 14:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll [2010.01.29 21:10:09 | 000,000,118 | ---- | C] () -- C:\Users\Fisch\AppData\Roaming\default.rss [2009.04.29 10:51:54 | 000,024,206 | ---- | C] () -- C:\Users\Fisch\AppData\Roaming\UserTile.png [2008.10.11 01:21:28 | 000,041,984 | ---- | C] () -- C:\Users\Fisch\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.09.22 22:34:55 | 000,000,016 | -H-- | C] () -- C:\Users\Fisch\AppData\Roaming\mxfilerelatedcache.mxc2 [2008.09.22 22:34:55 | 000,000,016 | -H-- | C] () -- C:\Users\Fisch\AppData\Local\mxfilerelatedcache.mxc2 [2008.09.22 22:34:54 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2 [2008.09.22 22:34:45 | 000,000,016 | -H-- | C] () -- C:\Users\Fisch\mxfilerelatedcache.mxc2 [2008.09.20 17:24:20 | 000,000,680 | ---- | C] () -- C:\Users\Fisch\AppData\Local\d3d9caps.dat ========== LOP Check ========== [2012.05.24 12:52:19 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\AnvSoft [2012.06.11 12:31:00 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Audacity [2012.05.31 12:04:29 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\CD-LabelPrint [2012.04.27 17:07:16 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\DVDVideoSoft [2011.04.03 11:51:34 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\DVDVideoSoftIEHelpers [2010.12.03 13:48:00 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\EAC [2012.07.20 08:08:13 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Foxit Software [2010.11.26 16:28:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\JAM Software [2008.09.30 12:40:09 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Lexware [2011.06.22 10:25:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\PC Suite [2012.07.31 13:32:42 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\pdfforge [2009.04.29 10:51:54 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\PeerNetworking [2012.06.05 12:37:16 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Template [2011.01.19 18:47:18 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Thunderbird [2008.09.24 23:10:11 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Toshiba [2009.05.04 01:45:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Ulead Systems [2012.08.16 16:25:30 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\VSRevoGroup [2011.12.26 16:37:47 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\WinTrack [2011.01.20 08:48:15 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\EAC [2012.06.05 13:41:27 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\Foxit Software [2011.06.05 19:07:23 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\go [2008.10.16 09:04:59 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\Lexware [2011.08.18 23:02:28 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\PC Suite [2010.11.04 09:21:24 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\Thunderbird [2009.09.28 11:18:16 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\Toshiba [2009.09.22 09:49:12 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\Ulead Systems [2010.01.06 17:23:33 | 000,000,000 | ---D | M] -- C:\Users\Ilona\AppData\Roaming\WinTrack [2011.09.05 08:00:12 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\go [2008.10.09 14:03:22 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\Lexware [2010.12.05 14:02:19 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\Thunderbird [2009.08.26 20:32:08 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\TOSHIBA [2009.05.03 12:09:04 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\Ulead Systems [2011.12.04 19:44:02 | 000,000,000 | ---D | M] -- C:\Users\Marvin\AppData\Roaming\WinTrack [2012.08.04 20:33:39 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\.minecraft [2011.02.07 17:12:44 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\CoSoSys [2012.04.27 17:07:16 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\DVDVideoSoft [2011.06.10 20:49:18 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\EAC [2012.08.05 18:41:09 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Foxit Software [2012.08.19 16:15:07 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\go [2012.06.08 20:23:41 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\gtk-2.0 [2008.09.26 16:46:05 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Lexware [2011.04.25 17:00:48 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\LucasArts [2011.06.21 22:29:49 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\PC Suite [2010.03.28 00:37:22 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Petroglyph [2012.06.01 20:32:30 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Synthesia [2008.10.05 18:59:15 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Template [2010.11.06 18:11:14 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Thunderbird [2008.11.12 21:14:41 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\TOSHIBA [2010.08.28 14:45:17 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\Ulead Systems [2012.01.04 20:36:24 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\WinTrack [2012.04.20 16:59:08 | 000,000,000 | ---D | M] -- C:\Users\Simon\AppData\Roaming\XMedia Recode [2012.08.19 22:52:03 | 000,032,626 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2008.11.23 23:10:27 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\AccurateRip [2011.04.28 12:40:25 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Adobe [2012.05.24 12:52:19 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\AnvSoft [2009.10.07 14:45:50 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Apple Computer [2008.12.26 12:32:24 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\ArcSoft [2008.09.18 07:55:59 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\ATI [2012.06.11 12:31:00 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Audacity [2011.10.16 10:45:24 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Avira [2012.05.31 12:04:29 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\CD-LabelPrint [2012.02.22 19:50:19 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\dvdcss [2012.04.27 17:07:16 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\DVDVideoSoft [2011.04.03 11:51:34 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\DVDVideoSoftIEHelpers [2010.12.03 13:48:00 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\EAC [2012.07.20 08:08:13 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Foxit Software [2008.09.18 10:07:58 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Google [2009.09.18 15:02:49 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\GTek [2009.09.18 15:57:35 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\HP [2010.08.15 11:07:38 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\HpUpdate [2008.09.18 07:55:25 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Identities [2008.09.17 23:04:28 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\InstallShield [2010.11.26 16:28:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\JAM Software [2008.09.30 12:40:09 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Lexware [2008.09.19 11:56:04 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Macromedia [2012.08.10 09:20:42 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Malwarebytes [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Media Center Programs [2012.07.22 13:09:08 | 000,000,000 | --SD | M] -- C:\Users\Fisch\AppData\Roaming\Microsoft [2008.10.31 12:59:00 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Mozilla [2009.12.01 18:11:19 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Nero [2011.06.22 10:25:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\PC Suite [2012.07.31 13:32:42 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\pdfforge [2009.04.29 10:51:54 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\PeerNetworking [2012.08.16 16:26:04 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Skype [2008.10.31 12:59:04 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Talkback [2012.06.05 12:37:16 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Template [2011.01.19 18:47:18 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Thunderbird [2008.09.24 23:10:11 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Toshiba [2009.05.04 01:45:17 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Ulead Systems [2012.07.30 12:30:36 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\vlc [2012.08.16 16:25:30 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\VSRevoGroup [2010.12.09 18:45:28 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\Winamp [2011.09.09 17:13:05 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\WinRAR [2011.12.26 16:37:47 | 000,000,000 | ---D | M] -- C:\Users\Fisch\AppData\Roaming\WinTrack < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > [2003.01.28 11:10:36 | 000,057,404 | ---- | M] (Hauppauge Computer Works) -- C:\Exec.exe [2002.09.17 21:00:58 | 000,057,399 | ---- | M] (Hauppauge Computer Works) -- C:\hcw.exe [2011.01.13 12:00:24 | 000,117,344 | ---- | M] (Hauppauge Computer Works) -- C:\Ir.exe [1999.06.25 09:55:30 | 000,149,504 | ---- | M] () -- C:\UNir32.EXE < MD5 for: AGP440.SYS > [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTOR.SYS > [2007.09.30 00:03:32 | 000,384,024 | ---- | M] (Intel Corporation) MD5=16A4671255CFB842225F0FDB6DBDB414 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys [2007.09.30 00:03:32 | 000,384,024 | ---- | M] (Intel Corporation) MD5=16A4671255CFB842225F0FDB6DBDB414 -- C:\Toshiba\Drivers\Robson\Winall\Driver64\IaStor.sys [2007.09.30 00:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys [2007.09.30 00:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Toshiba\Drivers\Robson\Winall\Driver\IaStor.sys [2007.09.30 00:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys [2007.09.30 00:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* > [2008.09.18 07:55:33 | 000,000,174 | -HS- | M] () -- C:\Users\Fisch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini < %APPDATA%\*AcroIEH*.* > < %APPDATA%\*.exe > < %APPDATA%\*.tmp > < > < End of report > |
|
20.08.2012, 14:34
| #4 |
| /// Helfer-Team | Exp/cve-2012-1723.br 1. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
21.08.2012, 09:27
| #5 |
| | Exp/cve-2012-1723.br Voilà die LOG-Datei: # AdwCleaner v1.801 - Logfile created 08/21/2012 at 10:18:52 # Updated 14/08/2012 by Xplode # Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # User : Fisch - SCHLEPPI # Boot Mode : Normal # Running from : C:\Download\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:\Users\Fisch\AppData\LocalLow\AskToolbar Folder Found : C:\Users\Simon\AppData\LocalLow\AskToolbar Folder Found : C:\Users\Fisch\AppData\Roaming\pdfforge Folder Found : C:\Program Files\Ask.com Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} File Found : C:\Users\Simon\Uninstall.exe ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\AskToolbarInfo Key Found : HKCU\Software\AppDataLow\Software\AskToolbar Key Found : HKCU\Software\Ask.com Key Found : HKCU\Software\Ask.com.tmp Key Found : HKCU\Software\Conduit Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1 Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} Key Found : HKLM\SOFTWARE\Software ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.19298 [OK] Registry is clean. -\\ Mozilla Firefox v5.0 (de) Profile name : default File : C:\Users\Fisch\AppData\Roaming\Mozilla\Firefox\Profiles\9me8x6mx.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\m18r38tk.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Ilona\AppData\Roaming\Mozilla\Firefox\Profiles\po04tmn1.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\3rgqy4bs.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\9uv1vzn8.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [4481 octets] - [21/08/2012 10:18:53] ########## EOF - C:\AdwCleaner[R1].txt - [4609 octets] ########## |
|
21.08.2012, 15:41
| #6 |
| /// Helfer-Team | Exp/cve-2012-1723.br Sehr gut! 
danach: ESET Online Scanner Vorbereitung
__________________ --> Exp/cve-2012-1723.br |
|
22.08.2012, 07:49
| #7 |
| | Exp/cve-2012-1723.br Hier die neue LOG-Datei von AdwCleaner. Eset lade ich herunter, lasse es durchlaufen und lade den Log später. Grüße Ivanhoe # AdwCleaner v1.801 - Logfile created 08/21/2012 at 18:01:11 # Updated 14/08/2012 by Xplode # Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # User : Fisch - SCHLEPPI # Boot Mode : Normal # Running from : C:\Download\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Users\Fisch\AppData\Roaming\pdfforge File Deleted : C:\Users\Simon\Uninstall.exe ***** [Registry] ***** Key Deleted : HKCU\Software\Ask.com.tmp Key Deleted : HKCU\Software\Conduit Key Deleted : HKLM\SOFTWARE\Software ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.19298 [OK] Registry is clean. -\\ Mozilla Firefox v5.0 (de) Profile name : default File : C:\Users\Fisch\AppData\Roaming\Mozilla\Firefox\Profiles\9me8x6mx.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\m18r38tk.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Ilona\AppData\Roaming\Mozilla\Firefox\Profiles\po04tmn1.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\3rgqy4bs.default\prefs.js [OK] File is clean. Profile name : default File : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\9uv1vzn8.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [4610 octets] - [21/08/2012 10:18:53] AdwCleaner[R2].txt - [2510 octets] - [21/08/2012 17:56:47] AdwCleaner[S1].txt - [2467 octets] - [21/08/2012 18:01:11] ########## EOF - C:\AdwCleaner[S1].txt - [2595 octets] ########## Und hier noch mal das Log von Eset: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=b40ff310bd2c5c499fa0a530cba86052 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-22 11:23:15 # local_time=2012-08-22 01:23:15 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=1792 16777215 100 0 26864977 26864977 0 0 # compatibility_mode=5892 16776573 100 100 1083 183152387 0 0 # compatibility_mode=8192 67108863 100 0 885 885 0 0 # scanned=276130 # found=0 # cleaned=0 # scan_time=14936 Und hier noch mal das Log von Eset: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=b40ff310bd2c5c499fa0a530cba86052 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-22 11:23:15 # local_time=2012-08-22 01:23:15 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=1792 16777215 100 0 26864977 26864977 0 0 # compatibility_mode=5892 16776573 100 100 1083 183152387 0 0 # compatibility_mode=8192 67108863 100 0 885 885 0 0 # scanned=276130 # found=0 # cleaned=0 # scan_time=14936[/QUOTE] Entschuldigung, ich habe das Eset-Log eigenständig postzen wollen und dann konnte ich es nicht mehr editieren. Also: Eset-Log hängt doppelt an meinem letzten Post Ivanhoe |
|
22.08.2012, 19:39
| #8 |
| /// Helfer-Team | Exp/cve-2012-1723.br Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck |
|
27.08.2012, 10:52
| #9 |
| | Exp/cve-2012-1723.br PluginCheck Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen. Überprüft wird: Browser, Flash, Java und Adobe Reader Version. Firefox 14.0.1 ist aktuell Flash (11,4,402,265) ist aktuell. Java (1,7,0,6) ist aktuell. undefined Zurück |
|
27.08.2012, 18:15
| #10 |
| /// Helfer-Team | Exp/cve-2012-1723.br Sehr gut! damit bist Du sauber und entlassen!  adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
|
28.08.2012, 12:20
| #11 |
| | Exp/cve-2012-1723.br Dann vielen herzlichen Dank für den Entlassungsschein. Ivanhoe |
|
| Themen zu Exp/cve-2012-1723.br |
| ahnung, aktiv, antivir, echtzeit-scanner, einfach, entdeck, exp/cve-2012-1723.br, inter, interne, internet, jahre, löschen, quarantäne, sofort, viren, virus, wenig, wenig ahnung |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
